build(deps): bump geo-optimizer-skill from 4.18.3 to 4.19.4 in /.github/workflows

[dependabot]

Bumps geo-optimizer-skill from 4.18.3 to 4.19.4.

Release notes

Sourced from geo-optimizer-skill's releases.

v4.19.4 — keyword stuffing false positives, URL 400, docs and sitemap fixes

Fixed

• Web API: a URL carrying stray brackets (a badge snippet pasted with its Markdown tail, https://site.com)](https://...) made /badge and six other URL endpoints return HTTP 500 (ValueError: Invalid IPv6 URL). They now return 400 with the usual invalid-URL message.
• Docs site: the Starlight favicon pointed to src/assets/geoready-logo.svg, which Starlight turns into the URL /src/assets/geoready-logo.svg (404 on every docs page). It now uses /favicon.svg from public/.
• Site: the automatic sitemap-index.xml no longer lists the pages that carry noindex (the mock report, the report shell and the visual lab). robots.txt points to the hand-built /sitemap.xml, which was already clean.
• Docs: every docs page now has exactly one <h1> (21 pages repeated the title as a body heading and the docs home hero used a third); the Perplexity crawler link in ai-bots-reference no longer returns 404.
• Docs theme, light: Starlight's --sl-color-white token was the paper colour but is the strongest text colour in Starlight, so page titles, the sidebar group labels and the Note callout text were near-white on white (1.09:1). The token is now ink. The doc card paragraphs lost an opacity that pushed their code spans under 4.5:1, and the dark-theme "Get Started" button text is dark (it was white on light teal, 1.9:1).
• Keyword-stuffing checks (audit_negative and the keyword_stuffing citability method) no longer flag a page's own brand name or the function words of its language (#607). Function-word lists now cover English, Italian, German, French, Spanish, Portuguese and Dutch, picked from <html lang> (every list when the attribute is missing); a declared language without a list skips the check. The brand comes from og:site_name, JSON-LD Organization/WebSite/Brand names, and a short <title> or <h1> prefix or suffix. The citability method also needs at least 5 uses of a word, and its word pattern now keeps ü, ß and other non-ASCII letters whole. Thresholds and weights are unchanged.

Security

• Website dependencies: npm audit fix on frontend/package-lock.json (lockfile only). The production audit goes from 40 findings to 29; the rest sit behind a major @astrojs/starlight upgrade and are build-time tools of a static site.

Changed

• CI also tests Python 3.10 (declared but never tested) and 3.14, and the package now carries the 3.14 classifier. No runtime change.

v4.19.3 — non-Latin keyword stuffing fix and clearer 504 message

Changed

• The web audit (/api/audit and the PDF route) now says on a 504 that the site took more than 60 seconds and that the CLI (geo audit --url <url>) has no such cap. Only the detail text changes; the status code and the 60 s limit are unchanged.

Documentation

• docs/json-contract.md: state that when error is set, score and band are defaults and do not describe the site.

Fixed

• The keyword stuffing check now counts words in any alphabet. It matched only Latin letters, so on Cyrillic, Greek and other non-Latin pages the word total shrank to the few Latin words and a normal brand term could be flagged as stuffing.

v4.19.2 — Recommendations grouped by category

Added

• Added AuditResult.recommendations_by_category, also emitted by geo audit --format json and the web API (schema_version stays 1, additive field). It groups the strings of recommendations by the score_breakdown category that produced them (robots, meta, signals, ...), plus two non-scored keys: blockers (CDN/WAF block, content that needs JavaScript, critical prompt injection, critical UGC injection risk) and other (non-critical UGC advisory, negative signals, WebMCP, multimodal). recommendations is unchanged. Unreachable-site and HTTP-error results carry a single recommendation under {"other": [...]}; batch timeout/exception results (core/batch_audit.py) have both fields empty. New core helpers build_categorized_recommendations() and group_recommendations_by_category(); build_recommendations() keeps its signature and output. See docs/json-contract.md.

v4.19.1 — security hardening and audit fixes

Security

• The async HTTP path (used by geo audit when httpx is installed and by batch/sitemap audits) now connects to the IP validated by the anti-SSRF check instead of resolving the hostname again, closing a DNS-rebinding window; SNI and certificate checks still use the hostname. With an HTTP(S) proxy configured, requests sent through the proxy are resolved by the proxy, as on the sync path (#577).
• Response size limits are enforced while the body streams, on both the sync and async paths: a live response was previously read in full before the max_size check, and redirect bodies are no longer read at all (#576, #577).
• POST /api/logs/analyze is now rate-limited like the other POST endpoints (#580).
• Server-rendered reports at /report/{id} send X-Robots-Tag: noindex, nofollow (#571).

Changed

• Brand & Entity: a schema name now counts for brand-name consistency for every Organization subtype (LocalBusiness, Restaurant, Store, ...), not only for the literal Organization, and checks that read only the first @type of a list now consider every declared type. Sites using these shapes can score higher, and brand_entity.primary_name can change to the schema name (#579).
• G-BYLINE now resolves an author declared as an @id reference (Yoast, RankMath) to a Person or Organization node, so those pages pass instead of reporting "No author found" (#581).
• The web API JSON has a new optional top-level score_penalty (negative-signal penalty, 0 or below); score_breakdown still lists only rubric categories (#580).
• mcp is pinned below 2.0, since mcp 2.x removed the FastMCP API the server uses; on Python 3.9, which mcp 1.x does not support, the [mcp] and [all] extras now install without it (#575).

Fixed

• geo audit --format rich no longer truncates the category scores at 80 and 100 columns: the rubric v2 llms.txt label is shorter in the terminal dashboard and the bar and score columns keep a minimum width.
• A malformed JSON-LD field (non-string @type, offers or aggregateRating as a string, sameAs as a number or object, a null @graph, ...) no longer makes the whole audit fail (#579).
• The sync audit now detects a CDN-blocked llms.txt (403/406) and retries it, as the async path already did; the same site could differ by up to 18 points between the two paths (#569).
• Batch and sitemap audits no longer time out healthy pages: the per-URL deadline is 60 s instead of the 10 s performance budget (#556, #570).
• The llms.txt CDN retry no longer blocks the event loop in async and batch audits (#581).
• Connection errors are retried at most 4 times instead of up to 16, and a server's Retry-After is capped at 10 s (#576).

... (truncated)

Changelog

Sourced from geo-optimizer-skill's changelog.

[4.19.4] — 2026-10-17

Fixed

• Web API: a URL carrying stray brackets (a badge snippet pasted with its Markdown tail, https://site.com)](https://...) made /badge and six other URL endpoints return HTTP 500 (ValueError: Invalid IPv6 URL). They now return 400 with the usual invalid-URL message.
• Docs site: the Starlight favicon pointed to src/assets/geoready-logo.svg, which Starlight turns into the URL /src/assets/geoready-logo.svg (404 on every docs page). It now uses /favicon.svg from public/.
• Site: the automatic sitemap-index.xml no longer lists the pages that carry noindex (the mock report, the report shell and the visual lab). robots.txt points to the hand-built /sitemap.xml, which was already clean.
• Docs: every docs page now has exactly one <h1> (21 pages repeated the title as a body heading and the docs home hero used a third); the Perplexity crawler link in ai-bots-reference no longer returns 404.
• Docs theme, light: Starlight's --sl-color-white token was the paper colour but is the strongest text colour in Starlight, so page titles, the sidebar group labels and the Note callout text were near-white on white (1.09:1). The token is now ink. The doc card paragraphs lost an opacity that pushed their code spans under 4.5:1, and the dark-theme "Get Started" button text is dark (it was white on light teal, 1.9:1).
• Keyword-stuffing checks (audit_negative and the keyword_stuffing citability method) no longer flag a page's own brand name or the function words of its language (#607). Function-word lists now cover English, Italian, German, French, Spanish, Portuguese and Dutch, picked from <html lang> (every list when the attribute is missing); a declared language without a list skips the check. The brand comes from og:site_name, JSON-LD Organization/WebSite/Brand names, and a short <title> or <h1> prefix or suffix. The citability method also needs at least 5 uses of a word, and its word pattern now keeps ü, ß and other non-ASCII letters whole. Thresholds and weights are unchanged.

Security

• Website dependencies: npm audit fix on frontend/package-lock.json (lockfile only). The production audit goes from 40 findings to 29; the rest sit behind a major @astrojs/starlight upgrade and are build-time tools of a static site.

Changed

• CI also tests Python 3.10 (declared but never tested) and 3.14, and the package now carries the 3.14 classifier. No runtime change.

[4.19.3] — 2026-10-16

Changed

• The web audit (/api/audit and the PDF route) now says on a 504 that the site took more than 60 seconds and that the CLI (geo audit --url <url>) has no such cap. Only the detail text changes; the status code and the 60 s limit are unchanged.

Documentation

• docs/json-contract.md: state that when error is set, score and band are defaults and do not describe the site.

Fixed

• The keyword stuffing check now counts words in any alphabet. It matched only Latin letters, so on Cyrillic, Greek and other non-Latin pages the word total shrank to the few Latin words and a normal brand term could be flagged as stuffing.

[4.19.2] — 2026-10-14

Added

• Added AuditResult.recommendations_by_category, also emitted by geo audit --format json and the web API (schema_version stays 1, additive field). It groups the strings of recommendations by the score_breakdown category that produced them (robots, meta, signals, ...), plus two non-scored keys: blockers (CDN/WAF block, content that needs JavaScript, critical prompt injection, critical UGC injection risk) and other (non-critical UGC advisory, negative signals, WebMCP, multimodal). recommendations is unchanged. Unreachable-site and HTTP-error results carry a single recommendation under {"other": [...]}; batch timeout/exception results (core/batch_audit.py) have both fields empty. New core helpers build_categorized_recommendations() and group_recommendations_by_category(); build_recommendations() keeps its signature and output. See docs/json-contract.md.

[4.19.1] — 2026-10-14

Security

• The async HTTP path (used by geo audit when httpx is installed and by batch/sitemap audits) now connects to the IP validated by the anti-SSRF check instead of resolving the hostname again, closing a DNS-rebinding window; SNI and certificate checks still use the hostname. With an HTTP(S) proxy configured, requests sent through the proxy are resolved by the proxy, as on the sync path (#577).
• Response size limits are enforced while the body streams, on both the sync and async paths: a live response was previously read in full before the max_size check, and redirect bodies are no longer read at all (#576, #577).
• POST /api/logs/analyze is now rate-limited like the other POST endpoints (#580).
• Server-rendered reports at /report/{id} send X-Robots-Tag: noindex, nofollow (#571).

Changed

• Brand & Entity: a schema name now counts for brand-name consistency for every Organization subtype (LocalBusiness, Restaurant, Store, ...), not only for the literal Organization, and checks that read only the first @type of a list now consider every declared type. Sites using these shapes can score higher, and brand_entity.primary_name can change to the schema name (#579).
• G-BYLINE now resolves an author declared as an @id reference (Yoast, RankMath) to a Person or Organization node, so those pages pass instead of reporting "No author found" (#581).
• The web API JSON has a new optional top-level score_penalty (negative-signal penalty, 0 or below); score_breakdown still lists only rubric categories (#580).
• mcp is pinned below 2.0, since mcp 2.x removed the FastMCP API the server uses; on Python 3.9, which mcp 1.x does not support, the [mcp] and [all] extras now install without it (#575).

Fixed

• geo audit --format rich no longer truncates the category scores at 80 and 100 columns: the rubric v2 llms.txt label is shorter in the terminal dashboard and the bar and score columns keep a minimum width.
• A malformed JSON-LD field (non-string @type, offers or aggregateRating as a string, sameAs as a number or object, a null @graph, ...) no longer makes the whole audit fail (#579).
• The sync audit now detects a CDN-blocked llms.txt (403/406) and retries it, as the async path already did; the same site could differ by up to 18 points between the two paths (#569).

... (truncated)

Commits

• ac8b2ba fix(audit): stop flagging brand names and function words as keyword stuffing ...
• 735d29d chore(release): include the site hygiene and docs contrast fixes in v4.19.4
• de34a89 chore(release): cut v4.19.4
• 463b057 chore(release): cut v4.19.3
• fe50dc0 docs(json-contract): say that score and band mean nothing when error is set (...
• b0fbc62 fix(web): point to the CLI when the audit times out (#599)
• 2b8bd09 fix(audit): count non-Latin letters in the keyword stuffing word list (#598)
• 9972434 docs(roadmap): reflect the WordPress plugin and per-category recommendations ...
• db6c3f9 chore(release): cut v4.19.2 (#586)
• 473b7d4 feat(audit): expose recommendations grouped by category (#585)
• Additional commits viewable in compare view