Repository navigation
Bump axe-core from 4.12.1 to 4.14.0 in /sandbox/browser-web-v1 - #39
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [axe-core](https://github.com/dequelabs/axe-core) from 4.12.1 to 4.14.0. - [Release notes](https://github.com/dequelabs/axe-core/releases) - [Changelog](https://github.com/dequelabs/axe-core/blob/develop/CHANGELOG.md) - [Commits](dequelabs/axe-core@v4.12.1...v4.14.0) --- updated-dependencies: - dependency-name: axe-core dependency-version: 4.14.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| "type": "module", | ||
| "dependencies": { | ||
| "axe-core": "4.12.1", | ||
| "axe-core": "4.14.0", |
There was a problem hiding this comment.
🔴 Existing benchmark runs reject the upgraded evaluator
After rebuilding the template, axe-core changes its hash, but published benchmark versions retain the old environment hash. evaluateFrontendRun rejects their runs with environment_hash_mismatch, preventing evaluation.
Learn more
The evaluator template build hash includes the lockfile, so this dependency change produces a new template hash (template fingerprint). seedRankedCatalog hashes that template with the evaluator policy, but published benchmark versions keep their stored environment hash because catalog seeding uses onConflictDoNothing (benchmark insert). evaluateFrontendRun compares both stored hashes with the current configuration before starting a sandbox. The stale axeCore value in EVALUATION_ENVIRONMENT_V1 also makes the package-to-descriptor test fail.
Example: A benchmark published with template hash A has environment hash H(A). Deployment configures a newly built template with hash B. Its pending run still has H(A), so the evaluator rejects it before execution.
Recommended fix: Keep the existing v1 template available for existing runs, and introduce a new versioned environment policy, template, and benchmark versions for the upgraded axe-core. Route each run to its recorded environment; update the frozen-package assertion to check the corresponding policy.
Was this helpful? React with 👍 or 👎 to provide feedback.
| "type": "module", | ||
| "dependencies": { | ||
| "axe-core": "4.12.1", | ||
| "axe-core": "4.14.0", |
There was a problem hiding this comment.
🔍 Security impact absent from PR body
The PR body lists release notes but does not explain the security impact of changing the evaluator dependency, as CONTRIBUTING.md requires.
Was this helpful? React with 👍 or 👎 to provide feedback.
Bumps axe-core from 4.12.1 to 4.14.0.
Release notes
Sourced from axe-core's releases.
... (truncated)
Changelog
Sourced from axe-core's changelog.
... (truncated)
Commits
e797173chore(release): v4.14.0 (#5438)6976881chore(release): 4.14.0d53cb0afix(label-content-name-mismatch): add support for cjk word splitting (#5437)35a38d8fix(aria-required-children): explain presentational children that cannot be i...2ba0812fix(target-size): ignore overlapping links with the same destination (#5428)1e33c6cfix(aria-allowed-attr): report case-sensitive aria attributes with non-lowerc...f59642echore: bump mocha from 11.8.0 to 12.0.2 (#5426)6efcb6echore: bump emoji-regex from 10.6.0 to 11.0.0 (#5427)2da49a3chore: bump the npm-low-risk group across 1 directory with 7 updates (#5425)aa4a0a1fix(aria-hidden-focus): suggest removing aria-hidden in the fail messages (#5...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)