fix(security): bump websocket-driver 0.7.4 → 0.7.5

.circleci/config.yml

@@ -5,15 +5,15 @@ defaults: &defaults
 
 unix_box: &unix_box
   docker:
-    - image: cimg/node:16.18-browsers
+    - image: cimg/node:22.16-browsers
 
 unix_nightly_box: &unix_nightly_box
   docker:
     - image: cimg/node:lts-browsers
 
 orbs:
   puppeteer: threetreeslight/puppeteer@0.1.2
-  browser-tools: circleci/browser-tools@1.4.4
+  browser-tools: circleci/browser-tools@1.5.1
 
 set_npm_auth: &set_npm_auth
   run: npm config set "//registry.npmjs.org/:_authToken" $NPM_AUTH
@@ -33,9 +33,7 @@ restore_build: &restore_build
 commands:
   browser-tools-job:
     steps:
-      - browser-tools/install-browser-tools:
-          # TODO: remove when chromedriver downloads are fixed
-          chrome-version: 116.0.5845.96
+      - browser-tools/install-browser-tools
 
 jobs:
   # Fetch and cache dependencies.
@@ -57,19 +55,21 @@ jobs:
       - browser-tools-job
       - <<: *set_npm_auth
       - run: npm ci
+      - run: npm rebuild esbuild --ignore-scripts=false --foreground-scripts
       - run: npx browser-driver-manager install chromedriver --verbose
       - save_cache:
           key: v9-cache-unix-{{ checksum "package-lock.json" }}
           paths:
             - node_modules
 
-  # Build and cache axe.js
+  # Build and cache built files
   build_unix:
     <<: *defaults
     <<: *unix_box
     steps:
       - checkout
       - <<: *restore_dependency_cache_unix
+      - run: npm run prepare
       - run: npm run build
       - save_cache:
           key: v9-cache-build-<< pipeline.git.revision >>
@@ -185,8 +185,9 @@ jobs:
       - run:
           name: Install Firefox Nightly
           command: |
-            wget -O firefox-nightly.tar.bz2 "https://download.mozilla.org/?product=firefox-nightly-latest-ssl&os=linux64&lang=en-US"
-            tar xf firefox-nightly.tar.bz2
+            # Assumes Firefox >= 135; in earlier versions, this resolves to a .tar.bz2 instead
+            wget -O firefox-nightly.tar.xz "https://download.mozilla.org/?product=firefox-nightly-latest-ssl&os=linux64&lang=en-US"
+            tar xf firefox-nightly.tar.xz
       - run:
           name: Set Environment Variable
           command: echo "export FIREFOX_NIGHTLY_BIN=$(pwd)/firefox/firefox-bin" >> $BASH_ENV
@@ -243,15 +244,15 @@ jobs:
       - <<: *restore_dependency_cache_unix
       - run: npm run test:rule-help-version
 
-  # Test node API
-  test_node:
+  # Test jsdom API
+  test_jsdom:
     <<: *defaults
     <<: *unix_box
     steps:
       - checkout
       - <<: *restore_dependency_cache_unix
       - <<: *restore_build
-      - run: npm run test:node
+      - run: npm run test:jsdom
 
   # Release a "next" version
   next_release:
@@ -363,7 +364,7 @@ workflows:
       - test_rule_help_version:
           requires:
             - build_unix
-      - test_node:
+      - test_jsdom:
           requires:
             - build_unix
       # Verify the sri history is correct
@@ -388,7 +389,7 @@ workflows:
             - test_virtual_rules
             - build_api_docs
             - test_rule_help_version
-            - test_node
+            - test_jsdom
             - verify_sri
           filters:
             branches:
@@ -406,7 +407,7 @@ workflows:
             - test_virtual_rules
             - build_api_docs
             - test_rule_help_version
-            - test_node
+            - test_jsdom
           filters:
             branches:
               only: develop

.eslintignore

@@ -7,5 +7,6 @@ doc/api/*
 doc/examples/jest_react/*.js
 
 lib/core/imports/*.js
+lib/core/utils/uuid.js
 axe.js
-axe.min.js
+axe.min.js

.github/ISSUE_TEMPLATE.md

@@ -0,0 +1,28 @@
+<!--
+Thanks for reporting an issue to axe-core. Please provide all necessary info to reproduce the issue. Without adequate details, your issue may be closed without investigation.
+
+If you’re reporting a bug, include a description of the issue and a page or code snippet where it can be reproduced. Please make sure you have tested this with the latest version of axe-core. When proposing a new rule, please use our rule template: https://github.com/dequelabs/axe-core/blob/develop/doc/rule-proposal.md
+
+Describe what the desired behavior would be, and how it applies to axe-core's  "Accessibility Supported" policy: https://github.com/dequelabs/axe-core/blob/develop/doc/accessibility-supported.md
+
+Issues can be reported for the axe Extension, the axe Linter (VS Code, IntelliJ) as well as the axe-core npm library.
+-->
+
+Product: <<axe-core | axe Extension | axe Linter>>
+
+Expectation: << Describe what you expect the product to do >>
+
+Actual: << Describe what the product actually does >>
+
+Motivation: << Describe why you want the behavior to be changed >>
+
+<pre><code>
+axe-core version: X.Y.Z
+axe-webdriver, extension or other integration version: X.Y.Z
+
+Browser and Assistive Technology versions
+
+For Tooling issues:
+- Node version: XX  <!-- run `node --version` -->
+- Platform:  <!-- Mac, Linux, Windows -->
+</code></pre>

.github/dependabot.yml

@@ -0,0 +1,60 @@
+version: 2
+
+updates:
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    schedule:
+      interval: 'monthly'
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: 'chore'
+    groups:
+      # Any updates not caught by the group config will get individual PRs
+      gha-low-risk:
+        update-types:
+          - 'minor'
+          - 'patch'
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: 'npm'
+    directory: '/'
+    schedule:
+      interval: 'monthly'
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: 'chore'
+    ignore:
+      # Prevent updates to ESM-only versions
+      - dependency-name: 'chalk'
+        versions: ['>=5.0.0']
+      - dependency-name: 'execa'
+        versions: ['>=6.0.0']
+      - dependency-name: 'inquirer'
+        versions: ['>=9.0.0']
+      - dependency-name: 'chai'
+        versions: ['>=5.0.0']
+      - dependency-name: 'conventional-commits-parser'
+        versions: ['>=6.0.0']
+      # Prevent Webpack error caused by v0.11+ of esbuild
+      # @see https://github.com/dequelabs/axe-core/issues/3771
+      - dependency-name: 'esbuild'
+        versions: ['>=0.11.0']
+      # Prevent colorjs.io issue caused by >v0.4.3
+      # @see https://github.com/dequelabs/axe-core/issues/4428
+      - dependency-name: 'colorjs.io'
+        versions: ['>0.4.3']
+      # Still need to support node 18
+      - dependency-name: 'glob'
+        versions: ['>=11.0.0']
+      # Use node 4 types for backward compatibility
+      - dependency-name: '@types/node'
+        versions: ['>=5.0.0']
+    groups:
+      # Any updates not caught by the group config will get individual PRs
+      npm-low-risk:
+        update-types:
+          - 'minor'
+          - 'patch'
+    cooldown:
+      default-days: 7