Bump pa11y from 9.0.1 to 10.0.0

[dependabot]

Bumps pa11y from 9.0.1 to 10.0.0.

Release notes

Sourced from pa11y's releases.

v10.0.0

Pa11y 10 requires a stable (even-numbered) Node.js version of 22 or above, updates to the latest version of Puppeteer (25) and Axe (4.13), updates several other dependencies, and includes some GitHub actions and documentation cleanup.

Changes in pa11y@10

• Breaking: Upgrade Node.js support: Pa11y 10 requires a stable (even-numbered) Node.js version of 22.13.0 or above
• Breaking: Upgrade puppeteer to 25 from 24. This resolves an issue with installing browsers, but requires platform-specific tools to unzip the browser files. See the system requirements for details (this should not cause an issue in most cases).
• Significant dependency changes (potentially impacting Pa11y results):
  • Remove kleur dependency in favor of the built-in util.styleText function, which is available in Node.js 22.13.0 and above (#834).
  • Upgrade axe-core to 4.13 from 4.11. This includes rule fixes that may change results when using the axe runner. See axe-core releases for complete details.
• Other dependency changes:
  • Upgrade commander to 15.0 from 14.0.
  • Upgrade semver to 7.8 from 7.7.
• Other changes: Refactor code and tests for dependency compatibility, update support table, update actions, and fix some links in the README (#825, thanks @​TejasAmle).

v9.1.1

• Fix several issues with loading custom runners, including errors when loading any custom runner on Windows. (#798)
• Update debug messages related to opening the page and navigating to the target URL. (#701)
• Update dependencies (no functional changes)

Full diff for pa11y@9.1.1

• 9.1.0...9.1.1

v9.1.0

Pa11y 9.1 includes updates and improvements to both htmlcs and axe runners, replacement of mockery with quibble in the test suite to resolve security issues, an upgrade to ESLint v9 with flat config, and various other updates.

Changes

• Update to the new @pa11y/html_codesniffer fork, which incorporates the latest unreleased updates from html_codesniffer and resolves several issues (#698).
• Incorporate several updates and improvements to the axe runner:
  • Update axe-core to 4.11 from 4.10, which includes fixes for numerous rules that may affect Pa11y results. See the axe-core release notes for complete details.
  • Update the axe runner with a user-specified option to control how issues requiring manual review are handled, which resolves several issues. Added CLI arg --level-cap-when-needs-review <level> (default: error), which caps the severity of any issue that axe reports as requiring manual review. This is not a breaking change as the default behavior remains unchanged. (#685)
• Replace mockery with quibble for mocking in the test suite, removing the deprecated mockery dependency and resolving critical vulnerability CVE-2022-37614 / GHSA-gmwp-3pwc-3j3g. (#772)
• Update to ESLint v9 and flat config using eslint-config-pa11y, refactored for ESLint and flat config changes. (#778)
• Add example JSON and JavaScript config files.
• Update other dependencies (no functional changes)

Full diff for pa11y@9.1.0

• 9.0.1...9.1.0

Changelog

Sourced from pa11y's changelog.

10.0.0 (2026-08-27)

Pa11y 10 requires a stable (even-numbered) Node.js version of 22 or above, updates to the latest version of Puppeteer (25) and Axe (4.13), updates several other dependencies, and includes some GitHub actions and documentation cleanup.

Changes in pa11y@10

• Breaking: Upgrade Node.js support: Pa11y 10 requires a stable (even-numbered) Node.js version of 22.13.0 or above
• Breaking: Upgrade puppeteer to 25 from 24. This resolves an issue with installing browsers, but requires platform-specific tools to unzip the browser files. See the system requirements for details (this should not cause an issue in most cases).
• Significant dependency changes (potentially impacting Pa11y results):
  • Remove kleur dependency in favor of the built-in util.styleText function, which is available in Node.js 22.13.0 and above (#834).
  • Upgrade axe-core to 4.13 from 4.11. This includes rule fixes that may change results when using the axe runner. See axe-core releases for complete details.
• Other dependency changes:
  • Upgrade commander to 15.0 from 14.0.
  • Upgrade semver to 7.8 from 7.7.
• Other changes: Refactor code and tests for dependency compatibility, update support table, update actions, and fix some links in the README (#825, thanks @​TejasAmle).

9.1.1 (2026-02-26)

• Fix several issues with loading custom runners, including errors when loading any custom runner on Windows. (#798)
• Update debug messages related to opening the page and navigating to the target URL. (#701)
• Update dependencies (no functional changes)

Full diff for pa11y@9.1.1

• 9.1.0...9.1.1

9.1.0 (2026-02-03)

Pa11y 9.1 includes updates and improvements to both htmlcs and axe runners, replacement of mockery with quibble in the test suite to resolve security issues, an upgrade to ESLint v9 with flat config, and various other updates.

Changes

• Update to the new @pa11y/html_codesniffer fork, which incorporates the latest unreleased updates from html_codesniffer and resolves several issues (#698).
• Incorporate several updates and improvements to the axe runner:
  • Update axe-core to 4.11 from 4.10, which includes fixes for numerous rules that may affect Pa11y results. See the axe-core release notes for complete details.
  • Update the axe runner with a user-specified option to control how issues requiring manual review are handled, which resolves several issues. Added CLI arg --level-cap-when-needs-review <level> (default: error), which caps the severity of any issue that axe reports as requiring manual review. This is not a breaking change as the default behavior remains unchanged. (#685)
• Replace mockery with quibble for mocking in the test suite, removing the deprecated mockery dependency and resolving critical vulnerability CVE-2022-37614 / GHSA-gmwp-3pwc-3j3g. (#772)
• Update to ESLint v9 and flat config using eslint-config-pa11y, refactored for ESLint and flat config changes. (#778)
• Add example JSON and JavaScript config files.
• Update other dependencies (no functional changes)

Full diff for pa11y@9.1.0

• 9.0.1...9.1.0

Commits

• 920ad86 Release Pa11y v10.0.0 (#849)
• 46402f7 Resolving the Symlink Vulnerability of extract-zip (#848)
• 6d9c190 Update dependencies and GitHub Actions, fix integration test timeouts (#846)
• dc8dd03 Replace kleur with util.StyleText (#834)
• 850325b fix: correct two typos in README (#825)
• cf9318c Bump actions/checkout from 6 to 7 (#832)
• 70cc6db Bump semver from 7.8.0 to 7.8.5 (#833)
• 8f99005 Bump axe-core from 4.11.4 to 4.12.1 (#830)
• eb2ed46 Bump commander from 14.0.3 to 15.0.0 (#826)
• d5d91d2 Bump puppeteer from 24.37.5 to 25.2.1 (#820)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[rbruhn]

Closing: pa11y is being removed in #97.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.