Bump axe-core from 4.12.1 to 4.13.0 in /sandbox/browser-web-v1 - #31
Bump axe-core from 4.12.1 to 4.13.0 in /sandbox/browser-web-v1#31dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [axe-core](https://github.com/dequelabs/axe-core) from 4.12.1 to 4.13.0. - [Release notes](https://github.com/dequelabs/axe-core/releases) - [Changelog](https://github.com/dequelabs/axe-core/blob/develop/CHANGELOG.md) - [Commits](dequelabs/axe-core@v4.12.1...v4.13.0) --- updated-dependencies: - dependency-name: axe-core dependency-version: 4.13.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| "type": "module", | ||
| "dependencies": { | ||
| "axe-core": "4.12.1", | ||
| "axe-core": "4.13.0", |
There was a problem hiding this comment.
🔴 Recorded accessibility-tool version no longer matches the version actually used in evaluations
The accessibility checker used by the browser evaluator was upgraded ("axe-core": "4.13.0" at sandbox/browser-web-v1/package.json:6) without updating the frozen environment record that is stored with every evaluation, so runs are labelled with a version that was not actually used.
Impact: Evaluation results are recorded with the wrong accessibility-tool version, breaking reproducibility claims, and the environment consistency check fails.
Frozen environment descriptor drift between package.json and EVALUATION_ENVIRONMENT_V1
lib/domain/ranked-catalog.ts:45 still declares axeCore: "4.12.1". This descriptor is persisted as evaluationPolicy for runs (lib/evaluation/frontend.ts:58, lib/data/catalog-admin.ts:312), while the sandbox evaluator imports axe-core from sandbox/browser-web-v1/package.json (sandbox/browser-web-v1/evaluate.mjs:4), now 4.13.0. tests/security-policy.test.ts:1258-1276 asserts the two must match, so the local gate (npm test) required by CONTRIBUTING.md will fail.
Prompt for agents
The axe-core dependency in sandbox/browser-web-v1/package.json was bumped to 4.13.0, but the frozen evaluation environment descriptor EVALUATION_ENVIRONMENT_V1 in lib/domain/ranked-catalog.ts still records axeCore: "4.12.1". That descriptor is persisted as the evaluationPolicy for every frontend evaluation run (lib/evaluation/frontend.ts, lib/data/catalog-admin.ts), so stored provenance would claim a version that was not used, and tests/security-policy.test.ts ("browser evaluator packages match the frozen environment descriptor") will fail. Decide whether the environment pin should be updated in lockstep (and whether bumping the checker changes scoring behavior enough to require a new environment/snapshot version), then keep package.json, the lockfile, and the descriptor consistent.
Was this helpful? React with 👍 or 👎 to provide feedback.
| "type": "module", | ||
| "dependencies": { | ||
| "axe-core": "4.12.1", | ||
| "axe-core": "4.13.0", |
There was a problem hiding this comment.
🔍 axe-core 4.13.0 changes rule outcomes, which can shift accessibility scores
The evaluator counts critical accessibility violations from axe.run(document) (sandbox/browser-web-v1/evaluate.mjs:254-266). Release 4.13.0 enables ElementInternals support by default, adds/changes several rules (deprecated ARIA attrs flagged as needs-review, aria-prohibited-attr changes, color-contrast stacking-context fixes) and the upstream notes themselves say issue numbers are likely to change. Because the sandbox is a pinned, reproducibility-critical scoring environment, this bump can change scores for previously graded submissions; a reviewer should decide whether this warrants a new evaluation environment/snapshot version rather than an in-place pin bump.
Was this helpful? React with 👍 or 👎 to provide feedback.
Bumps axe-core from 4.12.1 to 4.13.0.
Release notes
Sourced from axe-core's releases.
... (truncated)
Changelog
Sourced from axe-core's changelog.
Commits
1cc54b9chore(release): v4.13.0 (#5288)a1c9ebbchore(release): 4.13.098400d7test(arialabelledby-text): cover closed shadow DOM and out-of-tree idrefs (#5...bcd791cfeat(standards/ariaAttrs): add caseInsensitive property for attributes (#5224)fd6fa9ffix(aria-prohibited-attr): visible aria-labelledby requires review only (#5285)013ee82ci: increase wait-for-npm-ready timeout for publish scan delay (#5286)c5fd013fix(landmark-unique): exclude section/form with non-landmark roles from landm...dcd13f2feat(i18n): Add Swedish locale (#5190)a713bd8test(hasAriaValue): reenable skipped test due to firefox crash (#5229)fb94f8afix(standards): update aria-errormessage and aria-details to be idrefs (#5157)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)