[Yangjunjie-Lin]

Scanly 2.1.0 — Link Intelligence

Adds optional @scanly/url-safety with local URL signals, canonicalization/redaction, bounded cache and single-flight ownership, a browser-safe client/controller, DNS-pinned SSRF-protected server inspection, lookup-only reputation adapters, structured advisory LLM integration, and deterministic authority-aware scoring. Demo URL intelligence is disabled by default; barcode images/frames never enter the network layer.

Qualified feature source

SOURCE_SHA: bdf9e55
TREE_SHA: c72430a2ab0a2d47e7cd095325088f1e053a5c41
BASE_SHA: f0d10d2

All GitHub workflows on this source passed, including CI, Full Benchmark, Browser Benchmark, Tracking Benchmark, Industrial Benchmark, Public API, Device Evidence Validation and Native Mobile. This includes actual Worker/WASM soak, iOS, Android emulator, Native Core and Native Memory qualification; it does not claim physical-device validation.

Local evidence includes 148 URL safety tests (65 SSRF tests), 46/19/19 browser E2E, 48 browser benchmark cases, a 1,000-frame actual Worker/WASM soak, full Realtime/Tracking/Industrial gates, package import and installed-tarball/type/browser-boundary smoke, and PUBLIC_API_2_1_GO. Coverage thresholds were not lowered. Source/evidence Git fixture timeouts alone use a bounded 30-second budget on slow Windows hosts; decoder/security deadlines are unchanged.

The final same-machine URL benchmark observed baseline/current decoder medians 270.17/268.86 ms, local analysis P95 0.090 ms, and one remote call for 100 repeated URLs. Reports are development/feature qualification, not a publication record.

Release blocked — no publication claim

Local npm authentication returns 401 and @scanly/url-safety is not currently retrievable from the registry (404). Fresh 11-package publishing/Trusted Publisher credentials must be verified. Candidate artifact/reproducibility/signing evidence and the guarded Stable manifest must be finalized before any signed v2.1.0 tag or publication. No tag, GitHub Release or npm artifact was published by this PR.

v2.0.0/v2.0.1 tags, manifests, releases, artifact bytes, SBOMs, checksums and publication records are unchanged. Issue #13 remains independent and open.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
qr-decoder	Ready	Preview	Sep 10, 2026 1:20pm UTC

[Yangjunjie-Lin]

Final local verification completed: npm run check PASS, 827 unit/integration tests, coverage lines 91.04% / branches 76.74% (thresholds unchanged). URL safety 148 tests and SSRF subset 65 PASS. Local browser E2E 46/19/19, browser benchmark 48, real 1,000-frame Worker/WASM soak, Realtime 20/20, Tracking 34/34, Industrial gates and URL benchmark PASS. PUBLIC_API_2_1_GO and URL_SAFETY_SECURITY_GO. Feature verdict: SCANLY_LINK_INTELLIGENCE_GO. Qualified feature source bdf9e55; develop merge 6b017b5 has the same tree. Publication remains blocked: npm identity 401, new package lookup 404, fresh 11-package publisher and final candidate artifact/reproducibility/signing qualification required. No v2.1.0 tag, GitHub Release, npm publication or provenance claim. Old Stable integrity verifier passed both frozen releases; origin tag identities unchanged; Issue #13 remains OPEN.