chore(release): version 4.2.0

[WilcoFiers]

Features

• add axe.frameMessenger with configurable allowedOrigins (#2880) (b27bab3)
• aria-allowed-attr: add ARIA 1.2 prohibited attrs check (#2764) (4a77e88)
• empty-table-header: new rule to flag empty table headers (#2811) (813ee7e)
• frame-focusable-content: new rule to test iframes with tabindex=-1 do not have focusable content (#2785) (aeb044c)
• locale: missing translations for DE (#2704) (f312994)
• locale: Polish translation (#2677) (c46979f)
• nested-interactive: new rule to flag nested interactive elements (#2691) (13a7cf1)
• role-text: add role-text rule (#2702) (7c05162)
• setup/teardown: add functions to setup and teardown axe-core internal data, deprecate axe._tree (#2738) (9d19f24)
• standards: add graphics roles (#2761) (22032cc)
• standards/aria-roles: add presentational children property (#2689) (78c239c)
• utils.getRule: add function to get rule by id (#2724) (9d0af53)
• utils/matches: support selectors level 4 :not and :is (#2742) (21d9b0e)
• virtual-node: add attrNames property which returns list of attribute names (#2741) (1d864b4)

Bug Fixes

• aria-allowed-attr: error when generic elements use aria-label and aria-labelledy (#2766) (64379e1)
• aria-required-children: allow group and rowgroup roles (#2661) (5a264e4)
• aria-required-children: only match for roles that require children (#2703) (95de169)
• aria-valid-attr-value: pass for aria-errormessage when aria-invalid is not set or false (#2721) (93a765c)
• aria-valid-attr-value: report when aria-labelledby ref is not in DOM (#2723) (116eb06)
• aria-valid-attr-value: return false when int type attribute uses invalid values (#2710) (ce9917e)
• bypass: mark as needs review rather than failure (#2818) (bb41b3e)
• focus-order-semantics: allow role=tooltip to pass (#2871) (dc526d8)
• heading-order: handle iframe as first result (#2876) (33428d8)
• respondable: Avoid message duplication with messageId (#2816) (4bd0acf)
• respondable: work on iframes in shadow DOM (#2857) (38cad94)
• avoid 'undefined' showing in check messages (#2779) (3beb0b1)
• properly translate checks when building axe.js using --lang (#2848) (76545b0)
• aria-required-parent: only match for roles that require parents (#2707) (ce8281e)
• color-contrast: account for text client rects that start outside the parent container (#2682) (a4e4a34)
• color-contrast-matches: do not pass empty string to getElementById (#2739) (0b0fec2)
• frame-title: update rule description to be more descriptive (#2735) (159e25b)
• heading-order: allow partial context to pass (#2622) (f8baee6)
• landmark-complementary-is-top-level: allow aside inside main (#2740) (9388c96)
• metadata: consistenct use of 'must' and 'should' (#2770) (603b612)
• region: allow role=alertdialog as region (#2660) (b928df7)
• select-name: fix typo in accessible name help (#2676) (6b916b9)
• to-grid/get-headers: work with rowspan=0 (#2722) (508190b)
• types: Add noHtml option (#2810) (c03c826)
• utils: fix warning thrown by Webpack (#2843) (0826177), closes #2840
• utils: remove attributes from source string (#2803) (8e8c4fa)
• add noHtml to axe.configure (#2789) (5c8dec8)
• do not allow postMessage with axe version of x.y.z (#2790) (5acda82)

[stephenmathieson]

CI failure:

1) latest axe version (4.2) rule help docs should be active:

      Uncaught AssertionError [ERR_ASSERTION]: The expression evaluated to a falsy value:

  assert(res.statusCode >= 200 && res.statusCode <= 299)

      + expected - actual

      -false
      +true
      
      at ClientRequest.<anonymous> (test/test-rule-help-version.js:15:7)
      at HTTPParser.parserOnIncomingClient [as onIncoming] (_http_client.js:565:21)
      at HTTPParser.parserOnHeadersComplete (_http_common.js:111:17)
      at TLSSocket.socketOnData (_http_client.js:451:20)
      at addChunk (_stream_readable.js:288:12)
      at readableAddChunk (_stream_readable.js:269:11)
      at TLSSocket.Readable.push (_stream_readable.js:224:10)
      at TLSWrap.onStreamRead [as onread] (internal/stream_base_commons.js:94:17)

Looks like the tests get mad when we bump the version number? 🤔

[WilcoFiers]

Release Audit

• fix(region): allow role=alertdialog as region #2660
• tests: run ChromeHeadless for integration test  #2670 Security check was missing
• feat(standards/aria-roles): add presentational children property #2689
• fix(to-grid/get-headers): work with rowspan=0 #2722
• feat(standards): add graphics roles #2761
• feat(frame-focusable-content): new rule to test iframes with tabindex=-1 do not have focusable content #2785
• fix(utils): fix warning thrown by Webpack #2843
• feat: add axe.frameMessenger with configurable allowedOrigins #2880
• chore(deps): [security] bump ini from 1.3.5 to 1.3.8 #2869

[dylanb]

#2843 is not reviewed for security
#2761 is not reviewed for security

@WilcoFiers how did we miss so many security reviews?

[straker]

@dylanb #2843 and #2761 were both reviewed for security. 2843 had the security app checked and 2761 wasn't working so Wilco left a comment.

[stephenmathieson]

FWIW I believe there's a bug (also a GitHub "feature") in the security review app which prevents it from working unless contributors allow edits from maintainers on their PRs. The app doesn't have write access to commits authored by non-Deque'ers, so it cannot change their statuses.

When this happens, it'd be nice if the robot would let us know (by placing a comment on the PR or something) rather than forcing me to dig thru logs 🤷 Unfortunately I doubt I'll have any time to work on this in the near future, so it may be up to @dequelabs/axe-api-team.

Adding a try/catch here which created a comment in the catch is probably all we need.

[dylanb]

@dylanb #2843 and #2761 were both reviewed for security. 2843 had the security app checked and 2761 wasn't working so Wilco left a comment.

#2843 does not have the security review checked

[dylanb]

FWIW I believe there's a bug (also a GitHub "feature") in the security review app which prevents it from working unless contributors allow edits from maintainers on their PRs. The app doesn't have write access to commits authored by non-Deque'ers, so it cannot change their statuses.

When this happens, it'd be nice if the robot would let us know (by placing a comment on the PR or something) rather than forcing me to dig thru logs 🤷 Unfortunately I doubt I'll have any time to work on this in the near future, so it may be up to @dequelabs/axe-api-team.

Can someone take this on? @WilcoFiers we need to make this a priority

[straker]

That's odd. The one and only commit was approved for security

[dylanb]

reviewed, status not good as noted above