chore(deps): the open dependency updates and the axe 4.14 fixes, for 4.7.0 #1338

Merged

claude-bot merged 15 commits from chore/deps-4.7.0 into main 2026-11-05 20:35:08 +00:00

Conversation 1 Commits 15 Files changed 9 +50 -133

claude-bot commented 2026-11-05 18:31:48 +00:00

Collaborator

Copy link

The owner asked on 2026-11-05 to include everything known in 4.7.0, not to plan a point release. This combines six open PRs onto today's main, so CI tests them together as they'll ship:

PR	Update	Why it was red
#1228	React and React DOM 19.3.1	runner disk full (Oct 27), not the update
#1229	@axe-core/playwright 4.14.0	real: the stricter label-content-name-mismatch rule
#1244	the accessible-name fixes for axe 4.14	runner disk full; never reached axe
#1236	Mailpit 1.32 (e2e stack)	runner disk full
#1237	authlib 1.9.1	image extraction failure on the runner
#1238	eslint 10.13.0	runner disk full, plus a conflict with main

• Conflict: package.json keeps main's autoprefixer 10.6.2 with eslint 10.13.0. The lockfile was rebuilt from main's with npm install --package-lock-only.
• Changelog: a fragment lists the updates. #1244 already carries its own.

Checked locally: npm ci is clean; eslint has 0 errors; the full frontend suite passes, 290 files and 5,737 tests; the changelog check is OK.

For CI: the backend suite (authlib); all three end-to-end projects (the stack changed with Mailpit), which is where axe 4.14 runs. #1244's fixes target the scene button and the storyline chapter links that #1229's current run flagged. A third node, a menu button on the prep sheet (.btn--ghost.btn--sm[aria-haspopup="menu"]), appeared after #1244 was written, so CI will say whether it still needs a fix.

After merge, Renovate closes its four PRs and #1229 by itself; I'll close #1244 as landed.

🤖 Generated with Claude Code

The owner asked on 2026-11-05 to include everything known in 4.7.0, not to plan a point release. This combines six open PRs onto today's main, so CI tests them together as they'll ship: | PR | Update | Why it was red | |---|---|---| | #1228 | React and React DOM 19.3.1 | runner disk full (Oct 27), not the update | | #1229 | @axe-core/playwright 4.14.0 | real: the stricter `label-content-name-mismatch` rule | | #1244 | the accessible-name fixes for axe 4.14 | runner disk full; never reached axe | | #1236 | Mailpit 1.32 (e2e stack) | runner disk full | | #1237 | authlib 1.9.1 | image extraction failure on the runner | | #1238 | eslint 10.13.0 | runner disk full, plus a conflict with main | - **Conflict:** `package.json` keeps main's autoprefixer 10.6.2 with eslint 10.13.0. The lockfile was rebuilt from main's with `npm install --package-lock-only`. - **Changelog:** a fragment lists the updates. #1244 already carries its own. **Checked locally:** `npm ci` is clean; eslint has 0 errors; the **full frontend suite passes, 290 files and 5,737 tests**; the changelog check is OK. **For CI:** the backend suite (authlib); all three end-to-end projects (the stack changed with Mailpit), which is where axe 4.14 runs. #1244's fixes target the scene button and the storyline chapter links that #1229's current run flagged. A third node, a menu button on the prep sheet (`.btn--ghost.btn--sm[aria-haspopup="menu"]`), appeared after #1244 was written, so CI will say whether it still needs a fix. After merge, Renovate closes its four PRs and #1229 by itself; I'll close #1244 as landed. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 14 commits 2026-11-05 18:31:49 +00:00

chore(deps): update dependency authlib to v1.9.1 77a9a0d6d1

fix(deps): update react monorepo to v19.3.1 0568c77de4

chore(deps): update dependency eslint to v10.13.0 81c09ae6be

chore(deps): update axllent/mailpit docker tag to v1.32 56ea076cca

chore(deps): update dependency @axe-core/playwright to v4.14.0 b6412438a2

fix(a11y): accessible names contain the visible words (axe 4.14) ... eb794bf08a

axe-core 4.14 adds label-content-name-mismatch, which the journeys'
WCAG checks fail on two places:

- Prep's shelf card scene button showed "File it" / "Move" but was
  named "File in a scene: <title>". It is now "File it in a scene:"
  or "Move to a scene:", per its state.
- The storyline's chapter links had an aria-label over a visible
  number disc. The "Chapter" and ":" words are now sr-only text
  around the disc, so the name is unchanged and contains what is seen.

Rides on Renovate's @axe-core/playwright 4.14.0 bump (#1229).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

chore(deps): update dependency @axe-core/playwright to v4.14.0 0e1752c09b

Merge remote-tracking branch 'origin/renovate/authlib-1.x' into chore/deps-4.7.0 b581ad2264

Merge remote-tracking branch 'origin/renovate/axllent-mailpit-1.x' into chore/deps-4.7.0 2e82e07772

Merge remote-tracking branch 'origin/renovate/react-monorepo' into chore/deps-4.7.0 8cbe749745

Merge remote-tracking branch 'origin/renovate/axe-core-playwright-4.x' into chore/deps-4.7.0 f8d4a79473

Merge remote-tracking branch 'origin/fix/1229-axe-4.14-name-mismatch' into chore/deps-4.7.0 a5d19b8cde

Merge remote-tracking branch 'origin/renovate/eslint-monorepo' into chore/deps-4.7.0 ... 918664450f

# Conflicts:
#	webapp/frontend/package-lock.json
#	webapp/frontend/package.json

docs(changelog): the dependency updates in 4.7.0 ... 2553f5efbf

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude-bot commented 2026-11-05 19:55:12 +00:00

Author

Collaborator

Copy link

First CI run (2553f5ef): the backend (authlib 1.9.1), both frontend shards (React 19.3.1, eslint 10.13.0) and every other job passed. The end-to-end projects:

• Phone: infra. The image build lost the PGDG signing key download (curl: (56) … unexpected eof), the same blip as on #1333.
• Desktop and keyboard: two real failures, on the first try and the retry:
  1. a11y-wiki-pages: axe 4.14 label-content-name-mismatch on .ed-tool--olist, the wiki editor's numbered-list button, which shows "1." and was named "Numbered list".
  2. j6-what-happened.spec.js:426: no chapter link matched /^Chapter \d+: /. #1244 split the hidden words round the number disc, which is laid out as a box, so the name read "Chapter 2 : The Accord".

Fixed in the latest commit. I checked each candidate against axe 4.14 and Chromium's own names before choosing:

• The button is named "1. Numbered list", which has 0 violations. Hiding the glyph didn't help and "(1.)" still failed. The tooltip stays "Numbered list".
• The chapter link has "Chapter 2:" as one hidden piece, with the disc hidden from readers. The name is "Chapter 2: The Accord" again (0 violations), with no aria-label for the rule to compare.

The editor, editor-pane and storyline tests pass (130), and eslint is clean. CI is running again on all three projects.

**First CI run (2553f5ef):** the backend (authlib 1.9.1), both frontend shards (React 19.3.1, eslint 10.13.0) and every other job passed. The end-to-end projects: - **Phone:** infra. The image build lost the PGDG signing key download (`curl: (56) … unexpected eof`), the same blip as on #1333. - **Desktop and keyboard:** two real failures, on the first try and the retry: 1. `a11y-wiki-pages`: axe 4.14 `label-content-name-mismatch` on `.ed-tool--olist`, the wiki editor's numbered-list button, which shows "1." and was named "Numbered list". 2. `j6-what-happened.spec.js:426`: no chapter link matched `/^Chapter \d+: /`. #1244 split the hidden words round the number disc, which is laid out as a box, so the name read "Chapter 2 : The Accord". **Fixed** in the latest commit. I checked each candidate against axe 4.14 and Chromium's own names before choosing: - **The button** is named "1. Numbered list", which has 0 violations. Hiding the glyph didn't help and "(1.)" still failed. The tooltip stays "Numbered list". - **The chapter link** has "Chapter 2:" as one hidden piece, with the disc hidden from readers. The name is "Chapter 2: The Accord" again (0 violations), with no aria-label for the rule to compare. The editor, editor-pane and storyline tests pass (130), and eslint is clean. CI is running again on all three projects.

rbrooks added 1 commit 2026-11-05 19:55:15 +00:00

fix(a11y): the numbered-list button and the storyline's chapter links under axe 4.14 (#1229) ... d986d82e13

CI's journeys on the combined dependency branch found two more:
- The wiki editor's numbered-list button showed "1." and was named
  "Numbered list". Checked against axe 4.14 in Chromium: hiding the
  glyph doesn't help and "(1.)" still fails; "1. Numbered list" passes.
  The tooltip stays "Numbered list".
- #1244 split a chapter link's hidden words round the number disc, which
  is laid out as a box, so the name read "Chapter 2 : The Accord" and
  J6's /^Chapter \d+: / matched nothing. "Chapter 2:" is now one hidden
  piece and the disc is hidden from readers: the name is "Chapter 2: The
  Accord" again, with no aria-label for the rule to compare.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude-bot merged commit a429406984 into main 2026-11-05 20:35:08 +00:00

claude-bot referenced this pull request from a commit 2026-11-05 20:35:10 +00:00

Merge pull request 'chore(deps): the open dependency updates and the axe 4.14 fixes, for 4.7.0' (#1338)

claude-bot referenced this pull request 2026-11-05 20:35:16 +00:00

fix(a11y): axe 4.14 — accessible names contain the visible words (supersedes #1229) #1244

rbrooks referenced this pull request from a commit 2026-11-05 20:35:30 +00:00

chore(release): v4.7.0-rc4

claude-bot referenced this pull request 2026-11-05 20:35:33 +00:00

chore(release): v4.7.0-rc4 #1339

claude-bot referenced this pull request 2026-11-06 01:34:12 +00:00

CI: store the PGDG signing key in the repo, so image builds stop failing when its download drops #1346

claude-bot referenced this pull request 2026-11-06 08:06:50 +00:00

CI: the PGDG signing key is kept in the repo (#1346) #1356

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

backend

Issue related to the backend

  

bot

Issue related to the bot

  

bug

Something is not working

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

frontend

Issue related to the frontend

  

help wanted

Need some help

  

invalid

Something is wrong

  

question

More information is needed

  

recording

Issue related to the recording system

  

security

Security hardening / vulnerability work

  

wontfix

This won't be fixed

No labels

backend

bot

bug

duplicate

enhancement

frontend

help wanted

invalid

question

recording

security

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

rbrooks/Quest-Board!1338

No description provided.