Skip to content

Bump axe-core from 4.12.1 to 4.13.0 in /sandbox/browser-web-v1 #31

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Bump axe-core from 4.12.1 to 4.13.0 in /sandbox/browser-web-v1 #31

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions sandbox/browser-web-v1/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion sandbox/browser-web-v1/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
"private": true,
"type": "module",
"dependencies": {
"axe-core": "4.12.1",
"axe-core": "4.13.0",

@devin-ai-integration devin-ai-integration Bot Aug 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Recorded accessibility-tool version no longer matches the version actually used in evaluations

The accessibility checker used by the browser evaluator was upgraded ("axe-core": "4.13.0" at sandbox/browser-web-v1/package.json:6) without updating the frozen environment record that is stored with every evaluation, so runs are labelled with a version that was not actually used.
Impact: Evaluation results are recorded with the wrong accessibility-tool version, breaking reproducibility claims, and the environment consistency check fails.

Frozen environment descriptor drift between package.json and EVALUATION_ENVIRONMENT_V1

lib/domain/ranked-catalog.ts:45 still declares axeCore: "4.12.1". This descriptor is persisted as evaluationPolicy for runs (lib/evaluation/frontend.ts:58, lib/data/catalog-admin.ts:312), while the sandbox evaluator imports axe-core from sandbox/browser-web-v1/package.json (sandbox/browser-web-v1/evaluate.mjs:4), now 4.13.0. tests/security-policy.test.ts:1258-1276 asserts the two must match, so the local gate (npm test) required by CONTRIBUTING.md will fail.

Prompt for agents 
The axe-core dependency in sandbox/browser-web-v1/package.json was bumped to 4.13.0, but the frozen evaluation environment descriptor EVALUATION_ENVIRONMENT_V1 in lib/domain/ranked-catalog.ts still records axeCore: "4.12.1". That descriptor is persisted as the evaluationPolicy for every frontend evaluation run (lib/evaluation/frontend.ts, lib/data/catalog-admin.ts), so stored provenance would claim a version that was not used, and tests/security-policy.test.ts ("browser evaluator packages match the frozen environment descriptor") will fail. Decide whether the environment pin should be updated in lockstep (and whether bumping the checker changes scoring behavior enough to require a new environment/snapshot version), then keep package.json, the lockfile, and the descriptor consistent.
Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

@devin-ai-integration devin-ai-integration Bot Aug 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 axe-core 4.13.0 changes rule outcomes, which can shift accessibility scores

The evaluator counts critical accessibility violations from axe.run(document) (sandbox/browser-web-v1/evaluate.mjs:254-266). Release 4.13.0 enables ElementInternals support by default, adds/changes several rules (deprecated ARIA attrs flagged as needs-review, aria-prohibited-attr changes, color-contrast stacking-context fixes) and the upstream notes themselves say issue numbers are likely to change. Because the sandbox is a pinned, reproducibility-critical scoring environment, this bump can change scores for previously graded submissions; a reviewer should decide whether this warrants a new evaluation environment/snapshot version rather than an in-place pin bump.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

"playwright": "1.62.0"
}
}
Loading