chore(deps): update minor-patch

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@types/node (source)	^25.9.1 → ^25.9.2			devDependencies	patch
@vitest/browser (source)	^4.1.7 → ^4.1.8			devDependencies	patch
axe-core (source)	^4.11.4 → ^4.12.0			devDependencies	minor
semgrep/semgrep	1.164.0 → 1.165.0			container	minor

---

Release Notes

vitest-dev/vitest (@​vitest/browser)

v4.1.8

Compare Source

   🐞 Bug Fixes

• browser:
  • Disable client cdp API when allowWrite/allowExec: false [backport to v4]  -  by @​hi-ogawa and Codex in #​10450 (e4067)
  • Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4]  -  by @​toxik and @​Zelys-DFKH in #​10474 (675b4)

    View changes on GitHub

dequelabs/axe-core (axe-core)

v4.12.0

Compare Source

Features

• add gather-internals.js external script (#​5099) (c61d58b), closes #​5080
• aria-allowed/prohibited-attr, aria-required-parent/children: partially support element internals role (#​5080) (417b48a), closes #​5039 #​4259
• axe.externalAPIs: add public api for setting elementInternal data (#​5105) (63bab8f)
• core: expose normalizeRunOptions (#​4998) (b8e6a59)
• expose axe.resetLocale() to restore the default locale (#​5108) (c2b5292), closes #​5107
• getRules: include rule enabled state in returned objects (#​5118) (75bf772), closes #​5116
• list,listitem: support element internals role (#​5119) (7d9d696)
• new-rule: check that aria-tab have an accessible name (#​5001) (0d4e4e7), closes #​4842
• rules: deprecate landmark-complementary-is-top-level rules (#​4992) (9e09139), closes #​4950
• utils: add getElementInternals function (#​5077) (1c15f82)

Bug Fixes

• aria-allowed-attr: restrict br and wbr elements to aria-hidden only (#​4974) (c6245e7)
• aria-conditional-attr: add support for radio (#​5100) (8223c98)
• aria-valid-attr-value: handle multiple aria-errormessage IDs (#​4973) (0489e30)
• aria: prevent getOwnedVirtual from returning duplicate nodes (#​4987) (48ca955), closes #​4840
• commons/text: exclude natively hidden elements from aria-labelledby accessible name (#​5076) (ea7202c), closes #​4704
• DqElement: avoid calling constructors with cloneNode (#​5013) (0281fa1)
• existing-rule: aria-busy now shows an error message for a use with unallowed children (#​5017) (2067b87)
• helpUrl: ensure axe.configure always updates the help URLs (#​5114) (c4f60ff)
• label-content-name-mismatch: match visible text with aria-label and exclude invisible text (#​5096) (3a012a1)
• locale: ensure all subtags are correctly set (#​5112) (13005ed)
• scrollable-region-focusable: clarify the issue is in safari (#​4995) (4ec5211), closes WebKit#190870 WebKit#277290
• scrollable-region-focusable: do not fail scroll areas when all content is visible without scrolling (#​4993) (838707a)
• target-size: determine offset using clientRects if target is display:inline (#​5012) (a4b8091)
• target-size: ignore position: fixed elements that are offscreen when page is scrolled (#​5066) (1229a6e), closes #​5065
• target-size: ignore widgets that are inline with other inline elements (#​5000) (a8dd81b)
• utils/getAncestry: escape node name (#​5079) (d1fabaa), closes #​5078
• utils: Add null check to parseCrossOriginStylesheet, closes #​5074 (#​5075) (f12ef32)
• utils: update isShadowRoot to use spec-compliant custom element regex (#​5059) (edc6ce2), closes #​5030

4.11.4 (2026-04-23)

Bug Fixes

• commons/text: exclude natively hidden elements from aria-labelledby accessible name (#​5076) (df34adf), closes #​4704
• utils/getAncestry: escape node name (#​5079) (6e68d0a), closes #​5078

4.11.3 (2026-04-13)

Bug Fixes

• aria-allowed-attr: restrict br and wbr elements to aria-hidden only (#​4974) (1d80163)
• target-size: ignore position: fixed elements that are offscreen when page is scrolled (#​5066) (5906273), closes #​5065

4.11.2 (2026-03-30)

Bug Fixes

• aria-valid-attr-value: handle multiple aria-errormessage IDs (#​4973) (9322148)
• aria: prevent getOwnedVirtual from returning duplicate nodes (#​4987) (99d1e77), closes #​4840
• DqElement: avoid calling constructors with cloneNode (#​5013) (88bc57f)
• existing-rule: aria-busy now shows an error message for a use with unallowed children (#​5017) (dded75a)
• scrollable-region-focusable: clarify the issue is in safari (#​4995) (2567afd), closes WebKit#190870 WebKit#277290
• scrollable-region-focusable: do not fail scroll areas when all content is visible without scrolling (#​4993) (240f8b5)
• target-size: determine offset using clientRects if target is display:inline (#​5012) (69d81c1)
• target-size: ignore widgets that are inline with other inline elements (#​5000) (cf8a3c0)

4.11.1 (2026-01-06)

Bug Fixes

• allow shadow roots in axe.run contexts (#​4952) (d4aee16), closes #​4941
• color contrast fails for oklch and oklab with none (#​4959) (8f249fd)
• color-contrast: do not incomplete on textarea (#​4968) (d271788), closes #​4947
• commons/color: Match browser behavior for out-of-gamut oklch colors (#​4908) (5036be8)
• don't runs rules that select html on nested html elements (#​4969) (1e9a5c3)
• replaced luminance threshold constant 0.03928 with 0.04045 (#​4934) (316967d), closes #​4933
• rgaa: adjust mapping of aria-hidden-* and valid-lang (#​4935) (77571f2)
• valid-lang: update valid-langs for newer language codes (#​4966) (c3f5446), closes #​4963

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.