mgr/dashboard: bump axe-core from 4.4.3 to 4.11.1 in /src/pybind/mgr/dashboard/frontend

[dependabot]

Bumps axe-core from 4.4.3 to 4.11.1.

Release notes

Sourced from axe-core's releases.

Release 4.11.1

Release summary

This release addresses a number of false positives, which may result in a slightly lower number of issues reported. It also resolves a problem that caused the color contrast rule skip a page in edge cases. A page that wasn't tested because of this edge case may now be tested, and so could see new color contrast issues reported.

Lastly this rule corrects a few of the newly released RGAA tags, so when running an RGAA ruleset which rules run, and how they are mapped to RGAA is slightly different.

Bug Fixes

• allow shadow roots in axe.run contexts (#4952) (d4aee16), closes #4941
• color contrast fails for oklch and oklab with none (#4959) (8f249fd)
• color-contrast: do not incomplete on textarea (#4968) (d271788), closes #4947
• commons/color: Match browser behavior for out-of-gamut oklch colors (#4908) (5036be8)
• don't runs rules that select html on nested html elements (#4969) (1e9a5c3)
• replaced luminance threshold constant 0.03928 with 0.04045 (#4934) (316967d), closes #4933
• rgaa: adjust mapping of aria-hidden-* and valid-lang (#4935) (77571f2)
• valid-lang: update valid-langs for newer language codes (#4966) (c3f5446), closes #4963

Release 4.11.0

This release adds the new RGAA standard to many rules. Of particular note is that some best practice rules under WCAG are required under the RGAA standard: focus-order-semantics (experimental), region, skip-link, table-duplicate-name. This means that these rules are tagged as both best-practice and RGAAv4. Applications which are filtering rules based on the best-practice tags will need to update the logic in order to handle RGAA rules that are tagged best-practice.

Features

• add RGAA tags to rules (#4862) (53a925a)
• aria-prohibited-attr: add support for fallback roles (#4325) (62a19a9)
• axe.d.ts: add nodeSerializer typings (#4551) (a2f3a48), closes #4093
• DqElement: deprecate fromFrame function (#4881) (374c376), closes #4093
• DqElement: Truncate large html strings when the element has a large outerHTML string (#4796) (404a4fb), closes #4544
• get-xpath: return proper relative selector for id (#4846) (1035f9e), closes #4845
• i18n: Add Portugal Portuguese translation (#4725) (5b6a65a)
• incomplete with node on which an error occurred (#4863) (32ed8da)
• locale: Added ru locale (#4565) (067b01d)
• tap: some best practice rules map to RGAA (#4895) (bc33f4c)
• td-headers-attr: report headers attribute referencing other elements as unsupported (#4589) (ec7c6c8), closes #3987

Bug Fixes

• aria-allowed-role: add form to allowed roles of form element (#4588) (8aa47ac), closes /github.com/dequelabs/axe-core/blob/develop/lib/standards/html-elms.js#L264
• aria-allowed-role: Add math to allowed roles for img element (#4658) (95b6c18), closes #4657
• autocomplete-valid : Ignore readonly autocomplete field (#4721) (491f4ec), closes #4708
• autocomplete-valid: treat values "xon" and "xoff" as non-WCAG-violations (#4878) (52bc611), closes #4877
• axe.d.ts: add typings for preload options object (#4543) (cfd2974)
• button-name,input-button-name,input-img-alt: allow label to give accessible name (#4607) (a9710d7), closes #4472 #3696 #3696
• captions: fix grammar in captions check incomplete message (#4661) (11de515)
• color-contrast: do not run on elements with font-size: 0 (#4822) (d77c885), closes #4820
• consistently parse tabindex, following HTML 5 spec (#4637) (645a850), closes #4632
• core: measure perf for async checks (#4609) (7e9bacf)
• fix grammar when using "alternative text" in a sentence (#4811) (237a586), closes #4394
• get-ancestry: add nth-child selector for multiple siblings of shadow root (#4606) (1cdd6c3), closes #4563

... (truncated)

Changelog

Sourced from axe-core's changelog.

4.11.1 (2026-01-06)

Bug Fixes

• allow shadow roots in axe.run contexts (#4952) (d4aee16), closes #4941
• color contrast fails for oklch and oklab with none (#4959) (8f249fd)
• color-contrast: do not incomplete on textarea (#4968) (d271788), closes #4947
• commons/color: Match browser behavior for out-of-gamut oklch colors (#4908) (5036be8)
• don't runs rules that select html on nested html elements (#4969) (1e9a5c3)
• replaced luminance threshold constant 0.03928 with 0.04045 (#4934) (316967d), closes #4933
• rgaa: adjust mapping of aria-hidden-* and valid-lang (#4935) (77571f2)
• valid-lang: update valid-langs for newer language codes (#4966) (c3f5446), closes #4963

4.11.0 (2025-10-07)

Features

• add RGAA tags to rules (#4862) (53a925a)
• aria-prohibited-attr: add support for fallback roles (#4325) (62a19a9)
• axe.d.ts: add nodeSerializer typings (#4551) (a2f3a48), closes #4093
• DqElement: deprecate fromFrame function (#4881) (374c376), closes #4093
• DqElement: Truncate large html strings when the element has a large outerHTML string (#4796) (404a4fb), closes #4544
• get-xpath: return proper relative selector for id (#4846) (1035f9e), closes #4845
• i18n: Add Portugal Portuguese translation (#4725) (5b6a65a)
• incomplete with node on which an error occurred (#4863) (32ed8da)
• locale: Added ru locale (#4565) (067b01d)
• tap: some best practice rules map to RGAA (#4895) (bc33f4c)
• td-headers-attr: report headers attribute referencing other elements as unsupported (#4589) (ec7c6c8), closes #3987

Bug Fixes

• aria-allowed-role: add form to allowed roles of form element (#4588) (8aa47ac), closes /github.com/dequelabs/axe-core/blob/develop/lib/standards/html-elms.js#L264
• aria-allowed-role: Add math to allowed roles for img element (#4658) (95b6c18), closes #4657
• autocomplete-valid : Ignore readonly autocomplete field (#4721) (491f4ec), closes #4708
• autocomplete-valid: treat values "xon" and "xoff" as non-WCAG-violations (#4878) (52bc611), closes #4877
• axe.d.ts: add typings for preload options object (#4543) (cfd2974)
• button-name,input-button-name,input-img-alt: allow label to give accessible name (#4607) (a9710d7), closes #4472 #3696 #3696
• captions: fix grammar in captions check incomplete message (#4661) (11de515)
• color-contrast: do not run on elements with font-size: 0 (#4822) (d77c885), closes #4820
• consistently parse tabindex, following HTML 5 spec (#4637) (645a850), closes #4632
• core: measure perf for async checks (#4609) (7e9bacf)
• fix grammar when using "alternative text" in a sentence (#4811) (237a586), closes #4394
• get-ancestry: add nth-child selector for multiple siblings of shadow root (#4606) (1cdd6c3), closes #4563
• get-ancestry: don't error when there is no parent (#4617) (a005703)
• locale: fix typos in japanese (ja) locale (#4856) (3462cc5)
• locale: fixed typos in german (DE) locale (#4631) (b7736de)
• locale: proofread and updated de.json (#4643) (8060ada)
• meta-viewport: lower impact to moderate (#4887) (2f32aa5), closes #4714
• no-autoplay-audio: don't timeout for preload=none media elements (#4684) (cdc871e)
• performanceTimer: throwing in axe catch clause (#4852) (a4ade04), closes /github.com/dequelabs/axe-core/blob/e7dae4ec48cbfef74de9f833fdcfb178c1002985/lib/core/base/rule.js#L297-L300

... (truncated)

Commits

• fbd2f40 chore(release): v4.11.1 (#4981)
• 0618216 chore(release): 4.11.1
• c3f5446 fix(valid-lang): update valid-langs for newer language codes (#4966)
• d271788 fix(color-contrast): do not incomplete on textarea (#4968)
• 1e9a5c3 fix: don't runs rules that select html on nested html elements (#4969)
• d4aee16 fix: allow shadow roots in axe.run contexts (#4952)
• 1680105 chore: bump the npm-low-risk group across 1 directory with 5 updates (#4979)
• aedf51e chore: bump actions/download-artifact from 6.0.0 to 7.0.0 (#4978)
• 142ec4e chore: bump actions/upload-artifact from 5.0.0 to 6.0.0 (#4977)
• 1e10103 chore: bump stefanzweifel/git-auto-commit-action from 7.0.0 to 7.1.0 in the g...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for axe-core since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)