Repository navigation
build(deps-dev): bump @axe-core/playwright from 4.13.0 to 4.14.0 - #85
Conversation
dependabot
Bot
added
dependencies
|
Local validation of this update rebased onto the markdown-it audit fix exposed a new axe-core 4.14.0 failure: label-content-name-mismatch on both Reset View buttons. Their aria-label values are Reset weekly velocity camera and Reset day and hour cadence camera, neither of which includes the full visible text Reset View. The focused suite passed 26 tests and failed the accessibility scan. Leaving this PR unmerged pending repair and green CI. |
011fffe to
46aef3f
Compare
Bumps [@axe-core/playwright](https://github.com/dequelabs/axe-core-npm) from 4.13.0 to 4.14.0. - [Release notes](https://github.com/dequelabs/axe-core-npm/releases) - [Changelog](https://github.com/dequelabs/axe-core-npm/blob/develop/CHANGELOG.md) - [Commits](dequelabs/axe-core-npm@v4.13.0...v4.14.0) --- updated-dependencies: - dependency-name: "@axe-core/playwright" dependency-version: 4.14.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
46aef3f to
ae64bc8
Compare
|
Rebased onto merged accessibility fix #87. Full local validation now passes with axe-core 4.14.0, including all 64 browser tests with zero accessibility violations, mutation qualification, dependency/source security, risk/coverage, lint, and performance checks. The two Reset View violations reported earlier are fixed by #87. |
|
@sfl review |
![hemsoft-sfl-reviewer[bot]](https://avatars.githubusercontent.com/in/5406096?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Verdict: PASS • Round 1
Review done by gpt-6.1-sol
Updates development dependency @axe-core/playwright and transitive axe-core from 4.13.0 to 4.14.0. Security, accuracy and quality passes found no evidenced blocking defects within the static coverage described below; the verdict is clean within that coverage.
🔨 Full-Spectrum Review Summary
Effort: high
Review time: 1m 28s
Token count: Unavailable
| Pass | 🔴 Critical | 🟠 High | 🟡 Medium | ⚪ Low |
|---|---|---|---|---|
| 🔒 Security | 0 | 0 | 0 | 0 |
| ✅ Accuracy | 0 | 0 | 0 | 0 |
| 🧰 Quality & Maintainability | 0 | 0 | 0 | 0 |
| Total | 0 | 0 | 0 | 0 |
Key Findings
No material defects found.
Coverage
- Files reviewed:
package.jsonpackage-lock.json
- Context read:
README.md.github/dependabot.yml.github/workflows/validate.yml.github/workflows/benchmark.yml.github/workflows/pages.ymlplaywright.config.jstests/browser/accessibility.spec.jstests/browser/fixture.jsscripts/build_browser_assets.jsdequelabs/axe-core-npm:packages/playwright/package.jsondequelabs/axe-core-npm:packages/playwright/src/index.tsdequelabs/axe-core-npm:packages/playwright/src/utils.tsdequelabs/axe-core-npm:packages/playwright/src/browser.tsdequelabs/axe-core-npm:packages/playwright/tsup.config.tsdequelabs/axe-core-npm:packages/playwright/test/commonjsTest.jsdequelabs/axe-core-npm:utils/esbuild-plugin-cjs-interop.ts
- Verified:
- Compare
base_commit.shaand final commit SHA match both reserved revisions; inspected the complete two-file diff. - Exact-head recursive tree contains no repository
AGENTS.md. - Manifest and lockfile pins agree; locked
axe-coresatisfies~4.14.0, andplaywright-coresatisfies the declared peer range. - Changed lock entries retain npm registry URLs, integrity hashes and development-only classification.
- CI selects Node
22; README specifies22.22.2or later22.x, compatible with the new>=22.12.0requirement. - Upstream tag resolves to
2375f7f5523a2accaeef91a3cb12e30a46e7fbea; exact-ref exports, implementation and CommonJS compatibility assertions support the existing.default,include()andanalyze()usage. - Upstream comparison shows the wrapper's source change adds error cause preservation; reviewed scan rejection propagation and temporary-page cleanup.
- Accessibility test awaits analysis and rejects violations; fixture rejects unexpected external requests.
- Browser asset builder uses
threeandesbuild, so this update does not require regenerating its committed bundle.
- Compare
- Not verified:
- Published npm tarball contents and integrity correspondence were not independently checked; review used GitHub source and committed lock metadata.
- Transitive
axe-corerule implementation and resulting scan outcomes were not independently established. - Current vulnerability advisory status was not independently checked.
- Unchanged README claims outside dependency installation and accessibility integration were outside this review's scope.
- Tests run: None. Reviewer execution is disabled.
HemSoft full-spectrum review • 3 evidence-based passes • Reviewed head ae64bc8261cbfe6224b6b8c1bebe82d2b72b0fdf • SFL v0
|
Additional verification: all 64 browser tests and the controlled failure probe/full performance benchmark also passed under Node 22.22.2. Current head ae64bc8 has SFL PASS with no unresolved threads. Waiting for the remaining CI validation jobs before guarded merge. |
Bumps @axe-core/playwright from 4.13.0 to 4.14.0.
Release notes
Sourced from @axe-core/playwright's releases.
Changelog
Sourced from @axe-core/playwright's changelog.
Commits
2375f7fchore: release v4.14.0 (#1479)d1531a9fix(cli): restore bin paths and lint published package tarballs (#1467) (#1468)8b31968fix(cli): restore bin paths and lint published package tarballs (#1467)556d23cchore: RC v4.14.0 (#1463)74c9144chore: RC v4.14.05617347ci: provide pnpm via action-setup in release workflows (#1461)6da92cbchore: bump the webdriverio group across 1 directory with 7 updates (#1449)36e019fchore: bump adm-zip from 0.6.0 to 0.6.1 (#1443)e820472chore: bump nx from 23.1.1 to 23.2.1 (#1459)4fe97e0chore: bump proxy-addr from 2.0.7 to 2.0.8 (#1458)Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.