Update eslint 8.57.1 → 10.4.1 (major)

[depfu]

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

↗️ axe-core (indirect, 4.11.3 → 4.12.1) · Repo · Changelog

Release Notes

4.12.1

Bug FixesThis release does not impact axe results.

• axe.d.ts: make enabled property of RuleMetadata optional (#5129) (7eb3d2d)

4.12.0

In this release you'll find:

1. A new aria-tab-name rule that tests role="tab" elements have an accessible name
2. The landmark-complementary-is-top-level rule is deprecated, as ARIA no longer requires this
3. Preparations for Element Internal support (behind a feature flag)
4. Various other bug fixes for target-size, scrollable-region-focusable, and more

This release can see reveal new issues, as well as close out a few existing ones that might have come from false positives or the now deprecated rule.

Features

• add gather-internals.js external script (#5099) (c61d58b), closes #5080
• aria-allowed/prohibited-attr, aria-required-parent/children: partially support element internals role (#5080) (417b48a), closes #5039 #4259
• axe.externalAPIs: add public api for setting elementInternal data (#5105) (63bab8f)
• core: expose normalizeRunOptions (#4998) (b8e6a59)
• expose axe.resetLocale() to restore the default locale (#5108) (c2b5292), closes #5107
• getRules: include rule enabled state in returned objects (#5118) (75bf772), closes #5116
• list,listitem: support element internals role (#5119) (7d9d696)
• new-rule: check that aria-tab have an accessible name (#5001) (0d4e4e7), closes #4842
• rules: deprecate landmark-complementary-is-top-level rules (#4992) (9e09139), closes #4950
• utils: add getElementInternals function (#5077) (1c15f82)

Bug Fixes

• aria-allowed-attr: restrict br and wbr elements to aria-hidden only (#4974) (c6245e7)
• aria-conditional-attr: add support for radio (#5100) (8223c98)
• aria-valid-attr-value: handle multiple aria-errormessage IDs (#4973) (0489e30)
• aria: prevent getOwnedVirtual from returning duplicate nodes (#4987) (48ca955), closes #4840
• commons/text: exclude natively hidden elements from aria-labelledby accessible name (#5076) (ea7202c), closes #4704
• DqElement: avoid calling constructors with cloneNode (#5013) (0281fa1)
• existing-rule: aria-busy now shows an error message for a use with unallowed children (#5017) (2067b87)
• helpUrl: ensure axe.configure always updates the help URLs (#5114) (c4f60ff)
• label-content-name-mismatch: match visible text with aria-label and exclude invisible text (#5096) (3a012a1)
• locale: ensure all subtags are correctly set (#5112) (13005ed)
• scrollable-region-focusable: clarify the issue is in safari (#4995) (4ec5211), closes WebKit#190870 WebKit#277290
• scrollable-region-focusable: do not fail scroll areas when all content is visible without scrolling (#4993) (838707a)
• target-size: determine offset using clientRects if target is display:inline (#5012) (a4b8091)
• target-size: ignore position: fixed elements that are offscreen when page is scrolled (#5066) (1229a6e), closes #5065
• target-size: ignore widgets that are inline with other inline elements (#5000) (a8dd81b)
• utils/getAncestry: escape node name (#5079) (d1fabaa), closes #5078
• utils: Add null check to parseCrossOriginStylesheet, closes #5074 (#5075) (f12ef32)
• utils: update isShadowRoot to use spec-compliant custom element regex (#5059) (edc6ce2), closes #5030

4.11.4

This release addresses an issue with ancestry selectors. It is unlikely to change the number of issues found by axe-core.

Bug Fixes

• commons/text: exclude natively hidden elements from aria-labelledby accessible name (#5076) (df34adf), closes #4704
• utils/getAncestry: escape node name (#5079) (6e68d0a), closes #5078

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 44 commits:

• chore(release): 4.12.1 (#5152)
• chore(release): 4.12.1
• test: support with-aria-* attributes on testutils-element (#5137)
• fix(axe.d.ts): make enabled property of RuleMetadata optional (#5129)
• chore: migrate Karma to Web Test Runner (#5121)
• ci: continue-on-error for text_examples (#5124)
• ci: continue-on-error for text_examples
• chore(release): v4.12.0 (#5122)
• chore(release): 4.12.0
• feat(getRules): include rule enabled state in returned objects (#5118)
• docs(check-options): fix duplicate "the" (passLength/failLength rows) (#5113)
• fix(utils): Add null check to parseCrossOriginStylesheet, closes #5074 (#5075)
• feat(list,listitem): support element internals role (#5119)
• ci: ignore gather-internals.js from import deploy validation (#5110)
• fix(utils): update isShadowRoot to use spec-compliant custom element regex (#5059)
• fix(locale): ensure all subtags are correctly set (#5112)
• fix(helpUrl): ensure axe.configure always updates the help URLs (#5114)
• feat: expose axe.resetLocale() to restore the default locale (#5108)
• feat(axe.externalAPIs): add public api for setting elementInternal data (#5105)
• feat: add gather-internals.js external script (#5099)
• fix(label-content-name-mismatch): match visible text with aria-label and exclude invisible text (#5096)
• chore: add perf timing to runPartial (#5103)
• fix(aria-conditional-attr): add support for radio (#5100)
• chore: bump typescript from 5.9.3 to 6.0.3 (#5090)
• chore: bump actions/upload-artifact from 7.0.0 to 7.0.1 in the gha-low-risk group (#5088)
• chore: bump jsdom from 28.1.0 to 29.0.2 (#5092)
• chore: bump start-server-and-test from 2.1.5 to 3.0.2 (#5093)
• chore: bump the npm-low-risk group across 1 directory with 8 updates (#5101)
• feat(aria-allowed/prohibited-attr, aria-required-parent/children): partially support element internals role (#5080)
• chore(utils/is-valid-custom-element-name): helper function to determine if custom-element nodeName is valid (#5097)
• chore: code mod to refactor test dir (#5068)
• ci(deploy): use gh cli to create github release (#5094)
• chore: merge master into develop (#5084)
• chore: Release 4.11.4 (#5081)
• fix(sri-history): correct axe.js hash for 4.11.4
• chore(release): 4.11.4
• fix(commons/text): exclude natively hidden elements from aria-labelledby accessible name (#5076)
• fix(commons/text): exclude natively hidden elements from aria-labelledby accessible name (#5076)
• chore: fix cherry-pick script buffer size error for large git logs (#5071)
• fix(utils/getAncestry): escape node name (#5079)
• chore: fix cherry-pick script buffer size error for large git logs (#5071)
• fix(utils/getAncestry): escape node name (#5079)
• feat(utils): add `getElementInternals` function (#5077)
• chore: merge master into develop (#5072)

↗️ es-object-atoms (indirect, 1.1.1 → 1.1.2) · Repo · Changelog

Release Notes

1.1.2 (from changelog)

Commits

• [Dev Deps] update @ljharb/eslint-config, @ljharb/tsconfig, auto-changelog, eslint, npmignore 41e3d94
• [types] improve isObject type 758edc2

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 3 commits:

• v1.1.2
• [Dev Deps] update `@ljharb/eslint-config`, `@ljharb/tsconfig`, `auto-changelog`, `eslint`, `npmignore`
• [types] improve `isObject` type

↗️ function.prototype.name (indirect, 1.1.8 → 1.2.0) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 9 commits:

• v1.2.0
• [Refactor] use `is-document.all`
• [Refactor] better support cjs-module-lexer
• [New] add types
• [Robustness] use `es-errors`, `es-define-property`
• [Dev Deps] update `eslint`
• [actions] update workflows
• [Deps] update `call-bind`, `call-bound`, `hasown`
• [Dev Deps] update `@ljharb/eslint-config`, `auto-changelog`, `eslint`, `for-each`, `has-strict-mode`, `make-generator-function`, `npmignore`, `tape`

↗️ hasown (indirect, 2.0.3 → 2.0.4) · Repo · Changelog

Release Notes

2.0.4 (from changelog)

Commits

• [types] drop the dead key-narrowing overload fdab00e
• [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint 91f6247

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 3 commits:

• v2.0.4
• [types] drop the dead key-narrowing overload
• [Dev Deps] update `@ljharb/eslint-config`, `auto-changelog`, `eslint`

↗️ js-yaml (indirect, 4.1.1 → 4.2.0) · Repo · Changelog

Release Notes

4.2.0 (from changelog)

Added

• Added docs/safety.md with notes about processing untrusted YAML.
• Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
• Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
• Added sourcemaps to dist/ builds.

Changed

• Stop resolving numbers with underscores as numeric scalars, #627.
• Switched dev toolchains to Vite / neostandard.
• Updated demo.
• Reorganized tests.
• dist/ files are no longer kept in the repository.

Fixed

• Fix parsing of properties on the first implicit block mapping key, #62.
• Fix trailing whitespace handling when folding flow scalar lines, #307.
• Reject top-level block scalars without content indentation, #280.
• Ensure numbers survive round-trip, #737.
• Fix test coverage for issue #221.
• Fix flow scalar trailing whitespace folding, #307.
• Fix digits in YAML named tag handles.

Security

• Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

Does any of this look wrong? Please let us know.

↗️ string.prototype.trim (indirect, 1.2.10 → 1.2.11) · Repo · Changelog

Release Notes

1.2.11 (from changelog)

Commits

• [Fix] make right-trim linear for all inputs, not just non-trailing-whitespace 2c66b5e
• [Refactor] Handle pathological strings better 91e5eb6
• [actions] update workflows 09b9c7d
• [Dev Deps] update @ericcornelissen/assert-time, @ljharb/eslint-config, auto-changelog, eslint, for-each, has-strict-mode, npmignore 816817a
• [Deps] update call-bind, call-bound, es-abstract, es-object-atoms 733f19d
• [readme] remove dead badges 738a1e6
• [readme] replace runkit CI badge with shields.io check-runs badge 3c6a604

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 8 commits:

• v1.2.11
• [actions] update workflows
• [readme] remove dead badges
• [Deps] update `call-bind`, `call-bound`, `es-abstract`, `es-object-atoms`
• [Dev Deps] update `@ericcornelissen/assert-time`, `@ljharb/eslint-config`, `auto-changelog`, `eslint`, `for-each`, `has-strict-mode`, `npmignore`
• [Fix] make right-trim linear for all inputs, not just non-trailing-whitespace
• [Refactor] Handle pathological strings better
• [readme] replace runkit CI badge with shields.io check-runs badge

↗️ string.prototype.trimend (indirect, 1.0.9 → 1.0.10) · Repo · Changelog

Release Notes

1.0.10 (from changelog)

Commits

• [Fix] avoid quadratic runtime trimming strings with large internal whitespace runs 14ee151
• [actions] update workflows 867fda8
• [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, has-strict-mode, npmignore c1dad08
• [Deps] update call-bind, call-bound, es-object-atoms 9f23631
• [readme] remove dead badges 5156bc8
• [readme] replace runkit CI badge with shields.io check-runs badge 79f9686

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 7 commits:

• v1.0.10
• [actions] update workflows
• [readme] remove dead badges
• [Deps] update `call-bind`, `call-bound`, `es-object-atoms`
• [Dev Deps] update `@ljharb/eslint-config`, `auto-changelog`, `eslint`, `has-strict-mode`, `npmignore`
• [Fix] avoid quadratic runtime trimming strings with large internal whitespace runs
• [readme] replace runkit CI badge with shields.io check-runs badge

🆕 @​eslint/config-array (added, 0.23.5)

🆕 @​eslint/config-helpers (added, 0.6.0)

🆕 @​eslint/core (added, 1.2.1)

🆕 @​eslint/object-schema (added, 3.0.5)

🆕 @​eslint/plugin-kit (added, 0.7.2)

🆕 @​humanfs/core (added, 0.19.2)

🆕 @​humanfs/node (added, 0.16.8)

🆕 @​humanfs/types (added, 0.15.0)

🆕 @​humanwhocodes/retry (added, 0.4.3)

🆕 @​types/esrecurse (added, 4.3.1)

🆕 is-document.all (added, 1.0.0)

🆕 eslint-visitor-keys (added, 5.0.1)

🆕 balanced-match (added, 4.0.4)

🆕 brace-expansion (added, 5.0.6)

🆕 eslint (added, 10.4.1)

🆕 eslint-scope (added, 9.1.2)

🆕 espree (added, 11.2.0)

🆕 file-entry-cache (added, 8.0.0)

🆕 flat-cache (added, 4.0.1)

🆕 minimatch (added, 10.2.5)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[depfu]

Closed in favor of #284.