Skip to content

[WIP] [DO NOT MERGE] v4.11.2 diff#17

Open
danielweck wants to merge 140 commits intov4.11.2_BASEfrom
v4.11.2_DAISY
Open

[WIP] [DO NOT MERGE] v4.11.2 diff#17
danielweck wants to merge 140 commits intov4.11.2_BASEfrom
v4.11.2_DAISY

Conversation

@danielweck
Copy link
Copy Markdown
Member

@danielweck danielweck commented Apr 9, 2026

THIS PR IS FOR TRACKING / CODE DIFF PURPOSES ONLY, DO NOT MERGE.

This PR supersedes #16

NPM package publish:
https://www.npmjs.com/package/@daisy/axe-core-for-ace
https://www.npmjs.com/package/@daisy/axe-core-for-ace/v/4.11.2-canary.1

Tracking of code changes since 4.11.2:
dequelabs/axe-core@v4.11.2...master
dequelabs/axe-core@v4.11.2...develop

Axe 4.11.2 official release: https://github.com/dequelabs/axe-core/tree/v4.11.2
...and changelog: https://github.com/dequelabs/axe-core/blob/v4.11.2/CHANGELOG.md

Ace "legacy" patches:

https://github.com/daisy/ace/blob/cf896185ea675b041c64624639b59a5c9179eeb2/packages/ace-core/src/scripts/axe-patch-aria-roles.js#L3-L15

https://github.com/daisy/ace/blob/cf896185ea675b041c64624639b59a5c9179eeb2/packages/ace-core/src/scripts/axe-patch-is-aria-role-allowed.js#L74-L103

https://github.com/daisy/ace/blob/cf896185ea675b041c64624639b59a5c9179eeb2/packages/ace-core/src/scripts/axe-patch-listitem.js#L97-L134

https://github.com/daisy/ace/blob/cf896185ea675b041c64624639b59a5c9179eeb2/packages/ace-core/src/scripts/axe-patch-only-list-items.js#L215-L272

https://github.com/daisy/ace/blob/2eb8d7af5ba3b1e939857b94e39a5b8146ededfd/packages/ace-core/src/scripts/ace-axe.js#L220-L229

https://github.com/daisy/ace/blob/2eb8d7af5ba3b1e939857b94e39a5b8146ededfd/packages/ace-core/src/scripts/ace-axe.js#L93-L176

https://github.com/daisy/ace/blob/2eb8d7af5ba3b1e939857b94e39a5b8146ededfd/packages/ace-core/src/scripts/ace-axe.js#L179-L194

https://github.com/daisy/ace/blob/2eb8d7af5ba3b1e939857b94e39a5b8146ededfd/packages/ace-core/src/scripts/ace-axe.js#L195-L208

https://github.com/daisy/ace/blob/2eb8d7af5ba3b1e939857b94e39a5b8146ededfd/packages/ace-core/src/scripts/ace-axe.js#L209-L215

Useful references:

Ace:

https://github.com/daisy/ace/blob/ace-next/packages/ace-core/src/scripts/ace-axe.js#L94

https://github.com/daisy/ace/blob/ace-next/tests/data/axerule-dpubroles/EPUB/content_001.xhtml#L13-L17

daisy/ace#274 (comment)

daisy/ace#239

daisy/ace#274

W3C:

https://lists.w3.org/Archives/Public/public-publ-wg/2020Sep/0023.html

https://lists.w3.org/Archives/Public/public-epub-wg/2020Sep/0007.html

w3c/dpub-aria#22

w3c/dpub-aria#15

w3c/epub-specs#1316

w3c/html-aria#99

w3c/aria#748

w3c/epubcheck#1018

https://www.w3.org/TR/dpub-aria-1.0/

https://w3c.github.io/dpub-aria/

https://www.w3.org/TR/html-aria/

https://idpf.github.io/epub-guides/epub-aria-authoring/

Axe:

dequelabs#2759

dequelabs#1677 (comment)

Daisy-Axe:

https://github.com/daisy/axe-core/blob/v4.11.1_DAISY/test/integration/rules/aria-allowed-role/aria-allowed-role.html#L7-L10

https://github.com/daisy/axe-core/blob/v4.11.1_DAISY/lib/commons/aria/lookup-table.js#L592-L608

https://github.com/daisy/axe-core/blob/v4.11.1_DAISY/lib/checks/aria/aria-required-children-evaluate.js#L12

@danielweck
changed package name to denote DAISY fork
da2deae
@danielweck
initial patching (scripts/axe-patch-is-aria-role-allowed.js scripts/a…
bdcf58d 
…xe-patch-listitem scripts/axe-patch-only-list-items)
@danielweck
Mocha fast bail
5830ea9
@danielweck
semver is same as Axe Core but with DAISY addon suffix. Also added NP…
8b3740d 
…M run test-fast command
@danielweck
semver is reflected in auto-generated doc
723b98a
@danielweck
added unit tests for implicit/explicit and DPUB role parsing
2e70235
@danielweck
Scoped NPM package name, and files selection for NPM publish
4ce706d
@danielweck
NPM public publish
1c9a0b2
@danielweck
Merge branch 'v4.1.1_DAISY' into v4.1.2_DAISY
6590f7f
@danielweck
rules MD
ea67596
@danielweck
ignore epub:type
e04a57a
@danielweck
Merge branch 'v4.1.2_DAISY' into v4.1.3_DAISY
af3e209
@danielweck
Unit tests require package.json version without canary or arbitrary e…
161d97e 
…xtension (e.g. 4.1.3-daisy.0)
@danielweck
landmark-one-main now with page-no-duplicate-main in addition to page…
2a6ab7e 
…-has-main (DAISY Ace)
@danielweck
doc: landmark-one-main now with page-no-duplicate-main in addition to…
dae726f 
… page-has-main (DAISY Ace)
@danielweck
intermediary commit (Axe hook seems to stash things in the working co…
2b5bb2d 
…py ... so I need to test a full commit)
@danielweck
main element and div with role
6121f22
@danielweck
added unit test for landmark-no-duplicate-main to pass content with n…
10be613 
…o main landmark at all
@danielweck
matching-aria-role check port (untranslated)
72707cf
@danielweck
epub-type-has-matching-role pagebreak-label ported from Ace (translat…
45529c1 
…ed now)
@danielweck
working XHTML unit tests for EPUB in Axe! (port from Ace)
5e5e6a7
@danielweck
page-break label test (check)
e460f1d
@danielweck
Merge branch 'v4.1.3_DAISY' into v4.1.4_DAISY
da8e26c
@danielweck
fixed semantic versioning handling (major.minor.patch-prerelease.buil…
908db3d 
…dmetadata)
@danielweck
fixed dd, dt, dl, dfn lookup table
9d64963
@danielweck
re-instated DAISY mods
2565b38
@danielweck
DAISY landmark-one-main rule really is "has a unique main landmark ..…
d61e3dd 
…. if it has one (optional)"
@danielweck
get role type is super class role now (DAISY patch)
e8e5645
@danielweck
super class role checks
20748a7
@danielweck
owned roles fix for biblioentry and doc-endnote
3ce8040
@danielweck
chore(dev): comments
4eea567
@danielweck
chore(dev): Flox/Nix (lockfile will follow)
ff72899
@danielweck
chore(dev): Flox/Nix lockfile
4eeb10e
@danielweck
chore(dev): NPM package updates with SFW Socket Security Firewall and…
d7ebd47 
… Taze [skip ci]
@danielweck
fix: lint (prettier) [skip ci]
9a38ba1
@danielweck
fix: test tweaks
3740fb5
@danielweck
chore(NPM): publish GitHub Actions Workflow YAML for release tag v* p…
13a0d7f 
…ush (with ruleset protection) triggers Trusted Publishing [skip ci]
@danielweck
chore(CI): test trigger, build and test (no publish)
b9d978c
@danielweck
chore(CI): disable default Deque Axe-Core GitHub Actions Workflow YAML
60f4286
@danielweck
chore(CI): YAML jobs tweaks
b59f080
@danielweck
chore(CI): NPM audit is optional
6513189
@danielweck
chore(CI): Chrome tests
d27910f
@danielweck
chore(CI): test again
8e20b78
@danielweck
chore(CI): YAML indent
182717e
@danielweck
chore(CI): Chrome --no-sandbox
59260d4
@danielweck
chore(CI): limit to non-headless chrome testing, and activate trusted…
2bae0aa 
… publishing
@danielweck
chore(release): version bump to 4.11.1-canary.2 (release tag will tri…
5567c45 
…gger Trusted Publishing from GitHub Actions CI, see publish.yml Workflow)
@danielweck
Merge branch 'v4.11.1_DAISY' into v4.11.2_DAISY
8215d15
@danielweck
fix: package lock update
d267328
@danielweck
chore(CI): GitHub Actions YAML Workflow definition tweaks: permission…
f3655e1 
… and env de-hoisting, also disabled unnecessary checkout persist-credentials
@danielweck
fix(CI): added BUILD + TEST GitHub Actions Workflow YAML (check Chrom…
12035d4 
…e and ChromeHeadless, where the PUBLISH flow only checks Chrome)
@danielweck
chore(CI): renamed incorrect GitHub Actions Workflow Job (build and t…
b0bb99d 
…est was publish) and force use of Chromium 146 to match the DAISY fork
@danielweck
chore(CI): tested successfully with Chromium 146, testing latest (sho…
949f23b 
…uld be 147?)
@danielweck
fix(CI): Chrome version shell must be specified
b354cfa
@danielweck
chore(CI): Chromium latest is 149, testing with stable which should b…
d2e0539 
…e 147...
@danielweck
chore(dev): GitHub Actions YAML Workflow Trusted Publishing OpenIDCon…
ab6a9ac 
…nect API endpoint to exchange NPM_TOKEN (technical documentation, not to be used!) [skip ci]
@socket-security
Copy link
Copy Markdown

socket-security Bot commented Apr 24, 2026 •
edited
Loading

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedaxe-core@​4.11.1 ⏵ 4.11.2100 +11001009970
Updatedesbuild@​0.10.2 ⏵ 0.28.091 -1100 +273 +193 +2100
Updated@​babel/​preset-env@​7.29.0 ⏵ 7.29.2971007797100
Addedbrowser-driver-manager@​2.0.17810010077100
Updated@​babel/​runtime-corejs3@​7.29.0 ⏵ 7.29.21001007996100
Updated@​types/​node@​24.3.0 ⏵ 24.12.2100 +110081 +195100
Updatedglobals@​17.3.0 ⏵ 17.4.0100 +110086 +192100
Updatedserve-handler@​6.1.6 ⏵ 6.1.79910010087100
Updatedcore-js@​3.48.0 ⏵ 3.49.094 +1100100 +188100
Updatedeslint@​9.39.2 ⏵ 9.39.489 +110010095100
Updatedtypescript@​5.9.3 ⏵ 6.0.2100 +110090 +19990
Updatedstart-server-and-test@​2.1.3 ⏵ 2.1.598 +110010091100
Updatedchromedriver@​142.0.3 ⏵ 147.0.192 +110010095 -1100
Updatedlint-staged@​16.2.7 ⏵ 16.4.0100 +110010092100
Updatedsinon@​21.0.1 ⏵ 21.1.09610098 +194100
Addedtaze@​19.11.09810010094100
Updateddotenv@​16.0.3 ⏵ 16.6.199100100 +194100
Updatedselenium-webdriver@​4.41.0 ⏵ 4.42.09510010095 +5100

View full report

@socket-security
Copy link
Copy Markdown

socket-security Bot commented Apr 24, 2026 •
edited
Loading

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@danielweck