chore(release): v4.11.2 (#5049)

### [4.11.2](v4.11.1...v4.11.2)
(2026-03-30)

### Bug Fixes

- **aria-valid-attr-value:** handle multiple aria-errormessage IDs
([#4973](#4973))
([9322148](9322148))
- **aria:** prevent getOwnedVirtual from returning duplicate nodes
([#4987](#4987))
([99d1e77](99d1e77)),
closes [#4840](#4840)
- **DqElement:** avoid calling constructors with cloneNode
([#5013](#5013))
([88bc57f](88bc57f))
- **existing-rule:** aria-busy now shows an error message for a use with
unallowed children
([#5017](#5017))
([dded75a](dded75a))
- **scrollable-region-focusable:** clarify the issue is in safari
([#4995](#4995))
([2567afd](2567afd)),
closes
[WebKit#190870](https://github.com/dequelabs/WebKit/issues/190870)
[WebKit#277290](https://github.com/dequelabs/WebKit/issues/277290)
- **scrollable-region-focusable:** do not fail scroll areas when all
content is visible without scrolling
([#4993](#4993))
([240f8b5](240f8b5))
- **target-size:** determine offset using clientRects if target is
display:inline
([#5012](#5012))
([69d81c1](69d81c1))
- **target-size:** ignore widgets that are inline with other inline
elements ([#5000](#5000))
([cf8a3c0](cf8a3c0))

Author: WilcoFiers

.github/actions/install-deps/action.yml

@@ -56,7 +56,8 @@ runs:
       id: setup-chrome
       uses: browser-actions/setup-chrome@b94431e051d1c52dcbe9a7092a4f10f827795416 # v2.1.0
       with:
-        chrome-version: ${{ inputs.nightly == 'true' && 'beta' || 'stable' }}
+        # @see https://github.com/dequelabs/axe-core/issues/5027
+        chrome-version: ${{ inputs.nightly == 'true' && 'beta' || 145 }}
         install-chromedriver: true
         install-dependencies: true
     - name: Install Firefox

.github/workflows/deploy.yml

@@ -173,6 +173,8 @@ jobs:
       - name: Make Release Script Executable
         run: chmod +x ./node-github-release.sh
       - name: Create GitHub Release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: ./node-github-release.sh
   validate-deploy:
     name: Validate Deployment

.github/workflows/update-generated-files.yaml

@@ -29,7 +29,7 @@ jobs:
       - name: Check for changes
         id: changes
         run: |
-          changes=$(git status --porcelain)
+          changes=$(git status --porcelain | tr -d '\n')
           # see https://unix.stackexchange.com/a/509498
           echo $changes | grep . && echo "Changes detected" || echo "No changes"
           echo "changes=$changes" >> "$GITHUB_OUTPUT"

CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [4.11.2](https://github.com/dequelabs/axe-core/compare/v4.11.1...v4.11.2) (2026-03-30)
+
+### Bug Fixes
+
+- **aria-valid-attr-value:** handle multiple aria-errormessage IDs ([#4973](https://github.com/dequelabs/axe-core/issues/4973)) ([9322148](https://github.com/dequelabs/axe-core/commit/9322148b69924d6ae2d2dd46e6109bc2fc53abd3))
+- **aria:** prevent getOwnedVirtual from returning duplicate nodes ([#4987](https://github.com/dequelabs/axe-core/issues/4987)) ([99d1e77](https://github.com/dequelabs/axe-core/commit/99d1e77f351db586c79020372efc59608e604a1c)), closes [#4840](https://github.com/dequelabs/axe-core/issues/4840)
+- **DqElement:** avoid calling constructors with cloneNode ([#5013](https://github.com/dequelabs/axe-core/issues/5013)) ([88bc57f](https://github.com/dequelabs/axe-core/commit/88bc57fd3de12cd69d365b3f385ce9a2e30b7bd5))
+- **existing-rule:** aria-busy now shows an error message for a use with unallowed children ([#5017](https://github.com/dequelabs/axe-core/issues/5017)) ([dded75a](https://github.com/dequelabs/axe-core/commit/dded75a9acc9a2350926f46f04e0f1de522f43d6))
+- **scrollable-region-focusable:** clarify the issue is in safari ([#4995](https://github.com/dequelabs/axe-core/issues/4995)) ([2567afd](https://github.com/dequelabs/axe-core/commit/2567afd5c32398c6a488240b066bb0d335f6dc6a)), closes [WebKit#190870](https://github.com/dequelabs/WebKit/issues/190870) [WebKit#277290](https://github.com/dequelabs/WebKit/issues/277290)
+- **scrollable-region-focusable:** do not fail scroll areas when all content is visible without scrolling ([#4993](https://github.com/dequelabs/axe-core/issues/4993)) ([240f8b5](https://github.com/dequelabs/axe-core/commit/240f8b53ad168521a63b54d0053b96ce430c7184))
+- **target-size:** determine offset using clientRects if target is display:inline ([#5012](https://github.com/dequelabs/axe-core/issues/5012)) ([69d81c1](https://github.com/dequelabs/axe-core/commit/69d81c1cbb6a61a272884516c7983dcd17d28a42))
+- **target-size:** ignore widgets that are inline with other inline elements ([#5000](https://github.com/dequelabs/axe-core/issues/5000)) ([cf8a3c0](https://github.com/dequelabs/axe-core/commit/cf8a3c039b121c0c64a1eb8805c586659b69f3c1))
+
 ### [4.11.1](https://github.com/dequelabs/axe-core/compare/v4.11.0...v4.11.1) (2026-01-06)
 
 ### Bug Fixes

CLAUDE.md

@@ -0,0 +1,102 @@
+# axe-core — Claude Code Context
+
+**Last updated:** 2026-03-19
+
+## 0. Fundamental Standards
+
+- **Formatting:** Run `npm run fmt` (Prettier) and `npm run eslint` before every commit. No exceptions.
+- **Zero-Exception Testing:** 100% coverage goal. Run `npm test` before completion. `feat`/`fix` and other behavior-changing PRs require unit + integration tests where applicable; see `doc/code-submission-guidelines.md` for exceptions (e.g., some `chore`/docs changes).
+- **Import Rule:** Directory-level import restrictions are strictly enforced. See `eslint.config.js`.
+- **Commits:** Angular commit convention is mandatory. PRs with non-conforming commits will be rejected. See `doc/code-submission-guidelines.md`.
+- **Issues:** All unresolved issues tracked in [GitHub Issues](https://github.com/dequelabs/axe-core/issues).
+
+## 1. Technical Guidelines
+
+### Code Structure
+
+- **Return Early:** Keep the happy path left-aligned. Handle errors/edge cases first with early returns — never nest when you can exit.
+- **Exports:** Default export at the top of the file, immediately after imports.
+- **JSDoc:** Add JSDoc/DocBlock comments where appropriate, especially for exported APIs and complex logic. Document parameters and return types. See `doc/code-submission-guidelines.md` (source of truth) and `doc/developer-guide.md` for additional guidance.
+- **Naming:** Files and rule/check IDs in kebab-case. Functions in camelCase. Booleans prefixed `is`/`has`/`should`. Constants in `UPPER_SNAKE_CASE`.
+- **Variables:** Declare at point of use, not at the top of the function.
+
+### Virtual Nodes vs. HTMLElement
+
+- **Prefer Virtual Nodes** for attribute access and property reads (`virtualNode.attr()`, `virtualNode.props`).
+- **Use real DOM** only when you need DOM APIs (e.g., `getBoundingClientRect`, `getRootNode`).
+- **`core/utils/` functions** should default to real DOM inputs/outputs, except utilities that are explicitly documented as operating on `VirtualNode` (for example, tree or selector helpers). Avoid introducing new `VirtualNode`-dependent utilities unless there is a clear performance or API benefit.
+- **Conversion:** Use `getNodeFromTree()` from `core/utils` when you receive an ambiguous input (such as a `VirtualNode`, selector, or mixed type) and need to resolve it to a real DOM `Node`.
+
+### Import Restrictions (Hard Rules)
+
+- `standards/` → nothing (pure data, no imports).
+- `core/utils/` → other `core/utils`, `core/base`, `standards` via **direct file paths only** (no index).
+- `core/imports/` → node modules **only** (the only place npm imports are allowed).
+- `commons/` → other `commons` (direct paths), `core/utils` (index OK).
+- `checks/` and `rules/` → any directory (index OK).
+- **Never** import `commons` from `core/utils`. This is the most commonly rejected violation.
+
+### Checks & Rules
+
+- **Check evaluate functions:** Return `true` (pass), `false` (fail), or `undefined` (incomplete). Use `this.data()` to pass values to message templates and to provide incomplete-result detail.
+- **Rule JSON:** Use `all`, `any`, `none` check arrays. `selector` + optional `matches` to scope candidates. Valid `impact` values: `"minor"`, `"moderate"`, `"serious"`, `"critical"`.
+- **Standards data:** Never hardcode ARIA/HTML lists in checks. Query from `standards/` via `commons/standards` functions.
+- **Messages:** All user-facing strings live in check/rule JSON `metadata.messages`. Use `${data.property}` templates. Support singular/plural variants. Update `locales/_template.json` whenever messages change (auto-synced on `npm run build`).
+
+### High-Risk Areas (Extra Scrutiny Required)
+
+- **Color contrast:** Handles all CSS color formats, opacity, blend modes, stacking contexts, text-shadow. Return `undefined` when background cannot be determined. See `doc/developer-guide.md`.
+- **ARIA validation:** Must stay current with spec. Query roles/attrs from `standards/aria-roles.js` and `standards/aria-attrs.js`. Handle implicit vs. explicit roles. See `doc/rule-development.md`.
+- **Hidden elements:** Use `isVisibleToScreenReaders()`, not CSS visibility alone. Account for `aria-hidden="true"` and Shadow DOM boundaries.
+- **i18n:** Update `locales/_template.json` on every message change and commit the generated file alongside source.
+
+## 2. Testing
+
+- **Structure:** Mirror `lib/` exactly under `test/`. File `lib/commons/text/sanitize.js` → `test/commons/text/sanitize.js`.
+- **Checks:** Use `axe.testUtils.MockCheckContext()`. Only reset `checkContext` in `afterEach` — `fixture` and `axe._tree` are auto-cleared.
+- **Integration tests:** All rule changes require an HTML + JSON pair. Use `test/integration/rules/<rule-name>/` for mocha-hosted tests or `test/integration/full/<rule-name>/` when the rule requires a full HTML page. JSON selectors must use axe array format (`["#id"]`; iframes: `["iframe", "#id"]`). Also update or create virtual-rules tests where appropriate.
+- **Shadow DOM:** Every relevant check/rule must include an open Shadow DOM test case using `queryShadowFixture`.
+- **Logging:** Do not commit `console.log` statements.
+
+## 3. Build & Commits
+
+- **Bundles (`axe.js`, `axe.min.js`)** are auto-generated for releases/publishing and are not committed to the repo (they are gitignored).
+- **Locales template (`locales/_template.json`)** is auto-generated. When message strings change, regenerate this file and commit it in the same commit as the source changes — never in a separate commit.
+- **One change per PR.** Do not mix refactoring with feature work.
+- **Commit format:** `<type>(<scope>): <subject>` — imperative, lowercase, no period, ≤100 chars total. Body explains motivation. Footer: `Closes issue #123` or full URL. See `doc/code-submission-guidelines.md` for the full type list.
+
+**Example:**
+
+```
+fix(aria-valid-attr-value): handle multiple aria-errormessage IDs
+
+When aria-errormessage contains multiple space-separated IDs, verify
+all IDs exist in aria-describedby instead of matching the full string.
+
+Closes issue #4957
+```
+
+## 4. Documentation & API Changes
+
+- **New rules:** Update `CHANGELOG.md`. `doc/rule-descriptions.md` is auto-generated by `npm run build`.
+- **API changes:** Update `doc/API.md` and `axe.d.ts` TypeScript definitions.
+- **Breaking changes:** Avoid breaking changes — prefer supporting both old and new formats simultaneously. If unavoidable, add `BREAKING CHANGE: description` to commit footer, include migration guide in `CHANGELOG.md`, and tag deprecated code with `@deprecated` JSDoc.
+
+## 5. Examples (Copy-Paste Reference)
+
+- **Code patterns:** `doc/examples/code-patterns.md` — return early, default export, imports, JSDoc, Virtual Node usage
+- **Test patterns:** `doc/examples/test-patterns.md` — unit tests, check tests, Shadow DOM tests, integration test HTML+JSON
+- **Rule & check templates:** `doc/examples/rule-check-templates.md` — JSON templates for rules and checks, evaluate function pattern
+- **PR review patterns:** `doc/examples/pr-review-patterns.md` — common reviewer feedback, anti-patterns, what reviewers look for
+
+## 6. Reference Docs & Help
+
+- **Contributing guide:** `CONTRIBUTING.md`
+- **Import rules detail:** `eslint.config.js`
+- **Code submission standards:** `doc/code-submission-guidelines.md`
+- **Developer guide:** `doc/developer-guide.md`
+- **Rule development:** `doc/rule-development.md`
+- **API reference:** `doc/API.md`
+- **Pull Request Checklist:** `doc/pull-request-checklist.md`
+- **Slack:** [axe-community](https://accessibility.deque.com/axe-community)
+- **Issues:** [GitHub Issues](https://github.com/dequelabs/axe-core/issues)

axe.d.ts

@@ -467,6 +467,10 @@ declare namespace axe {
   }
 
   interface Utils {
+    getElementSource: (
+      element: Node | null | undefined,
+      options?: { maxLength?: number; attrLimit?: number }
+    ) => string;
     getFrameContexts: (
       context?: ElementContext,
       options?: RunOptions

bower.json

@@ -1,6 +1,6 @@
 {
   "name": "axe-core",
-  "version": "4.11.1",
+  "version": "4.11.2",
   "deprecated": true,
   "contributors": [
     {

doc/examples/code-patterns.md

@@ -0,0 +1,152 @@
+# Code Pattern Examples
+
+Quick-reference examples for axe-core coding conventions.
+
+## Default Export at Top
+
+```javascript
+// GOOD: Default export right after imports
+import { getRole } from '../../commons/aria';
+import { isVisible } from '../../commons/dom';
+
+export default function myFunction(node, options) {
+  // function body
+}
+
+// BAD: Export buried at bottom of file
+import { getRole } from '../../commons/aria';
+
+function myFunction(node, options) {
+  // body
+}
+
+// ... more code ...
+
+export default myFunction; // Too far from top
+```
+
+## Return Early Pattern
+
+```javascript
+// GOOD: Main path left-aligned, edge cases exit early
+export default function processValue(value) {
+  if (!value) {
+    return null;
+  }
+
+  if (value.length < 3) {
+    throw new Error('Value too short');
+  }
+
+  const normalized = normalize(value);
+  const result = transform(normalized);
+  return result;
+}
+
+// BAD: Nested conditionals
+export default function processValue(value) {
+  let result;
+  if (value) {
+    if (value.length >= 3) {
+      const normalized = normalize(value);
+      result = transform(normalized);
+    } else {
+      throw new Error('Value too short');
+    }
+  } else {
+    result = null;
+  }
+  return result;
+}
+```
+
+## Import Restrictions
+
+```javascript
+// GOOD: commons importing from core/utils via index
+import { getNodeFromTree } from '../../core/utils';
+
+// GOOD: commons importing other commons directly
+import getExplicitRole from '../aria/get-explicit-role';
+
+// BAD: core/utils importing from commons — NEVER DO THIS
+import { isDisabled } from '../../commons/forms';
+
+// BAD: importing from index in core/utils — use direct path
+import { someUtil } from './index'; // Use: import someUtil from './some-util';
+```
+
+## JSDoc Comments
+
+### Standard function
+
+```javascript
+/**
+ * Determines if an element is a native select element
+ * @method isNativeSelect
+ * @memberof axe.commons.forms
+ * @param {VirtualNode|Element} node Node to determine if select
+ * @returns {Boolean}
+ */
+import nodeLookup from '../../core/utils/node-lookup';
+
+function isNativeSelect(node) {
+  const { vNode } = nodeLookup(node);
+  const nodeName = vNode.props.nodeName;
+  return nodeName === 'select';
+}
+```
+
+### Check evaluate function
+
+```javascript
+/**
+ * Check if an element's `role` attribute uses any abstract role values.
+ *
+ * Abstract roles are taken from the `ariaRoles` standards object from the roles `type` property.
+ *
+ * ##### Data:
+ * <table class="props">
+ *   <thead>
+ *     <tr>
+ *       <th>Type</th>
+ *       <th>Description</th>
+ *     </tr>
+ *   </thead>
+ *   <tbody>
+ *     <tr>
+ *       <td><code>String[]</code></td>
+ *       <td>List of all abstract roles</td>
+ *     </tr>
+ *   </tbody>
+ * </table>
+ *
+ * @memberof checks
+ * @return {Boolean} True if the element uses an `abstract` role. False otherwise.
+ */
+function abstractroleEvaluate(node, options, virtualNode) {
+  // implementation
+}
+```
+
+## Virtual Node vs HTMLElement
+
+```javascript
+// Use Virtual Node for attribute access and property reads
+function myCheck(node, options, virtualNode) {
+  const role = virtualNode.attr('role'); // Cached attribute access
+  const nodeName = virtualNode.props.nodeName;
+
+  // Only access real node when you need DOM APIs
+  const rect = node.getBoundingClientRect();
+  const rootNode = node.getRootNode();
+}
+
+// Convert ambiguous input using nodeLookup
+import nodeLookup from '../../core/utils/node-lookup';
+
+function myFunction(nodeOrVirtual) {
+  const { vNode, domNode } = nodeLookup(nodeOrVirtual);
+  // vNode = VirtualNode, domNode = real DOM node
+}
+```

doc/examples/pr-review-patterns.md

@@ -0,0 +1,69 @@
+# PR Review Patterns
+
+Common feedback and anti-patterns observed in axe-core code reviews.
+
+## What Gets Called Out
+
+### 1. Missing Tests
+
+- Every behavior-changing code change needs unit tests
+- Rule changes need integration tests (HTML + JSON pair)
+- Shadow DOM test coverage required for relevant checks/rules
+
+### 2. Commit Message Format
+
+- Wrong type/scope
+- Not imperative present tense
+- Subject too long or capitalized
+- Missing issue reference in footer
+
+### 3. Import Violations
+
+- `core/utils` importing from `commons` (forbidden)
+- Using index imports where direct file paths are required
+- Importing node modules outside `core/imports`
+
+### 4. Code Style Issues
+
+- Not using return early pattern
+- Default export not at top of file
+- Nested conditionals when early return would work
+- Missing JSDoc comments
+
+### 5. Performance Concerns
+
+- Unnecessary DOM queries in loops
+- Not caching Virtual Node properties
+- Computing same value repeatedly instead of storing it
+
+### 6. Incomplete Results
+
+- Not returning `undefined` when a check can't determine the result
+- Missing `incomplete` message variants in check JSON
+- Not setting appropriate `this.data()` for incomplete cases
+
+### 7. Accessibility Edge Cases
+
+- Not considering all ARIA states
+- Missing edge cases for hidden elements
+- Not handling Shadow DOM properly
+
+## What Reviewers Love
+
+1. Comprehensive test coverage including edge cases
+2. Clear, detailed commit messages with motivation
+3. JSDoc comments that explain "why" not just "what"
+4. Performance-conscious code that caches appropriately
+5. Following existing patterns in similar files
+6. Integration tests that cover both pass and fail cases
+
+## Common PR Mistakes
+
+1. Not running `npm test` locally before pushing
+2. Not committing auto-generated `locales/_template.json` in the same commit as message source changes
+3. Changing multiple unrelated things in one PR — split refactoring from feature work
+4. Not updating integration tests when changing rule behavior
+5. `console.log` statements should not be committed
+6. Not handling `null` or `undefined` gracefully
+7. Hardcoding strings that should come from `standards/` data
+8. Changing public APIs without `BREAKING CHANGE` in commit footer