Skip to content

Commit b2597e7

Browse files
mattobeemattobee
committed
Update dependencies to latest semver-safe versions
Resolves 5 security vulnerabilities (ReDoS in markdown-it, ajv, minimatch; prototype pollution in flatted; path traversal in h3). Prettier 3.8.1 reformatted four SKILL.md files. Also fixes .gitignore to properly ignore Playwright test-results directory.
1 parent 451fb8a commit b2597e7

6 files changed

Lines changed: 1471 additions & 963 deletions

File tree

‎.agents/skills/estimating-accessibility-effort/SKILL.md‎

Lines changed: 29 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -32,24 +32,24 @@ Effort estimates based only on the issue description are unreliable. Before esti
3232

3333
For each issue, produce:
3434

35-
| Field | Description |
36-
|-------|-------------|
37-
| **Issue** | One-sentence description of the problem |
38-
| **WCAG** | Success criterion reference (e.g., 2.1.1 Keyboard) |
39-
| **Severity** | Critical (A violation, blocker), Serious (AA violation), Moderate (best practice) |
40-
| **Scope** | How many files, components, or pages are affected |
41-
| **Effort** | T-shirt size: XS, S, M, L, XL (see definitions below) |
42-
| **Rationale** | Brief explanation of what the fix involves and why it takes this much effort |
43-
| **Dependencies** | Other issues or changes this fix depends on or enables |
35+
| Field | Description |
36+
| ---------------- | --------------------------------------------------------------------------------- |
37+
| **Issue** | One-sentence description of the problem |
38+
| **WCAG** | Success criterion reference (e.g., 2.1.1 Keyboard) |
39+
| **Severity** | Critical (A violation, blocker), Serious (AA violation), Moderate (best practice) |
40+
| **Scope** | How many files, components, or pages are affected |
41+
| **Effort** | T-shirt size: XS, S, M, L, XL (see definitions below) |
42+
| **Rationale** | Brief explanation of what the fix involves and why it takes this much effort |
43+
| **Dependencies** | Other issues or changes this fix depends on or enables |
4444

4545
### Effort definitions
4646

47-
| Size | Typical scope | Examples |
48-
|------|--------------|---------|
49-
| **XS** | Single attribute or property change. One file, no logic changes. | Add missing `alt` text, add `aria-label` to a button, add `autocomplete` attribute, add `lang` attribute |
50-
| **S** | Localised change within one component. May involve a few attributes and minor template restructuring. | Associate error messages with fields via `aria-describedby`, add visible labels to replace placeholder-only labels, add `aria-live` to a status region |
51-
| **M** | Changes to one component plus its consumers, or changes spanning 2-5 files. May require new state management. | Implement keyboard navigation for a custom widget, add focus management to a modal (trap + return), make a data table sortable by keyboard, add skip link |
52-
| **L** | Structural changes affecting multiple components or a shared layout. May require new components, hooks, or utility functions. | Redesign a drag-and-drop interface to have a keyboard alternative, retrofit focus management across all route changes, build an accessible combobox to replace a custom dropdown |
47+
| Size | Typical scope | Examples |
48+
| ------ | ---------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
49+
| **XS** | Single attribute or property change. One file, no logic changes. | Add missing `alt` text, add `aria-label` to a button, add `autocomplete` attribute, add `lang` attribute |
50+
| **S** | Localised change within one component. May involve a few attributes and minor template restructuring. | Associate error messages with fields via `aria-describedby`, add visible labels to replace placeholder-only labels, add `aria-live` to a status region |
51+
| **M** | Changes to one component plus its consumers, or changes spanning 2-5 files. May require new state management. | Implement keyboard navigation for a custom widget, add focus management to a modal (trap + return), make a data table sortable by keyboard, add skip link |
52+
| **L** | Structural changes affecting multiple components or a shared layout. May require new components, hooks, or utility functions. | Redesign a drag-and-drop interface to have a keyboard alternative, retrofit focus management across all route changes, build an accessible combobox to replace a custom dropdown |
5353
| **XL** | Architectural changes. Affects the application's structure, routing, state management, or component library. Usually a multi-day effort. | Replace a custom component system with an accessible component library, restructure page layouts for correct landmark hierarchy across all routes, implement a comprehensive form error handling system |
5454

5555
### Factors that increase effort
@@ -74,12 +74,12 @@ When estimating a set of issues (e.g., a full audit report), also provide:
7474
### Summary table
7575

7676
| Effort | Count | Examples |
77-
|--------|-------|---------|
78-
| XS | n | ... |
79-
| S | n | ... |
80-
| M | n | ... |
81-
| L | n | ... |
82-
| XL | n | ... |
77+
| ------ | ----- | -------- |
78+
| XS | n | ... |
79+
| S | n | ... |
80+
| M | n | ... |
81+
| L | n | ... |
82+
| XL | n | ... |
8383

8484
### Dependency graph
8585

@@ -101,18 +101,18 @@ Highlight issues that are XS or S effort with Critical or Serious severity. Thes
101101
### Individual Estimates
102102

103103
| Issue | WCAG | Severity | Scope | Effort | Rationale |
104-
|-------|------|----------|-------|--------|-----------|
105-
| ... | ... | ... | ... | ... | ... |
104+
| ----- | ---- | -------- | ----- | ------ | --------- |
105+
| ... | ... | ... | ... | ... | ... |
106106

107107
### Summary
108108

109109
| Effort | Count |
110-
|--------|-------|
111-
| XS | n |
112-
| S | n |
113-
| M | n |
114-
| L | n |
115-
| XL | n |
110+
| ------ | ----- |
111+
| XS | n |
112+
| S | n |
113+
| M | n |
114+
| L | n |
115+
| XL | n |
116116

117117
### Dependencies
118118

‎.agents/skills/predicting-accessibility-risks/SKILL.md‎

Lines changed: 15 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -22,16 +22,17 @@ Before assessing risks, understand what is being proposed:
2222

2323
For each risk identified, produce:
2424

25-
| Field | Description |
26-
|-------|-------------|
27-
| **Risk** | One-sentence description of what could go wrong |
28-
| **Affected users** | Which disability groups are affected and how (screen reader users, keyboard-only users, low vision, cognitive, motor) |
29-
| **WCAG criteria** | The success criteria at stake (e.g., 2.1.1 Keyboard, 1.3.1 Info and Relationships) |
30-
| **Likelihood** | How likely is this to occur without explicit attention? High (almost certain without mitigation), Medium (depends on implementation choices), Low (only if a specific mistake is made) |
31-
| **Cost to fix later** | How expensive is this to retrofit if caught after implementation? High (requires architectural changes), Medium (requires rework of multiple components), Low (localised fix) |
32-
| **Mitigation** | Specific, actionable recommendation to avoid the risk |
25+
| Field | Description |
26+
| --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
27+
| **Risk** | One-sentence description of what could go wrong |
28+
| **Affected users** | Which disability groups are affected and how (screen reader users, keyboard-only users, low vision, cognitive, motor) |
29+
| **WCAG criteria** | The success criteria at stake (e.g., 2.1.1 Keyboard, 1.3.1 Info and Relationships) |
30+
| **Likelihood** | How likely is this to occur without explicit attention? High (almost certain without mitigation), Medium (depends on implementation choices), Low (only if a specific mistake is made) |
31+
| **Cost to fix later** | How expensive is this to retrofit if caught after implementation? High (requires architectural changes), Medium (requires rework of multiple components), Low (localised fix) |
32+
| **Mitigation** | Specific, actionable recommendation to avoid the risk |
3333

3434
Focus on risks that meet at least one of these criteria:
35+
3536
- High cost to fix later (structural or architectural)
3637
- High likelihood (the default implementation path would miss it)
3738
- Affects a fundamental interaction (navigation, form submission, content access)
@@ -110,20 +111,20 @@ These are common risk areas, not exhaustive checklists. Use them as prompts to i
110111
### High Risk
111112

112113
| Risk | Affected users | WCAG | Likelihood | Fix cost | Mitigation |
113-
|------|---------------|------|------------|----------|------------|
114-
| ... | ... | ... | ... | ... | ... |
114+
| ---- | -------------- | ---- | ---------- | -------- | ---------- |
115+
| ... | ... | ... | ... | ... | ... |
115116

116117
### Medium Risk
117118

118119
| Risk | Affected users | WCAG | Likelihood | Fix cost | Mitigation |
119-
|------|---------------|------|------------|----------|------------|
120-
| ... | ... | ... | ... | ... | ... |
120+
| ---- | -------------- | ---- | ---------- | -------- | ---------- |
121+
| ... | ... | ... | ... | ... | ... |
121122

122123
### Low Risk
123124

124125
| Risk | Affected users | WCAG | Likelihood | Fix cost | Mitigation |
125-
|------|---------------|------|------------|----------|------------|
126-
| ... | ... | ... | ... | ... | ... |
126+
| ---- | -------------- | ---- | ---------- | -------- | ---------- |
127+
| ... | ... | ... | ... | ... | ... |
127128

128129
### Recommendations
129130

‎.agents/skills/prioritising-accessibility-fixes/SKILL.md‎

Lines changed: 30 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -26,12 +26,12 @@ If effort estimates are missing, read the affected code and estimate before prio
2626

2727
If issues arrive without effort estimates and `estimating-accessibility-effort` is not available, use this scale:
2828

29-
| Size | Typical scope |
30-
|------|--------------|
31-
| **XS** | Single attribute or property change, one file |
32-
| **S** | Localised change within one component, a few attributes |
33-
| **M** | Changes to one component plus its consumers, or 2-5 files |
34-
| **L** | Structural changes affecting multiple components or a shared layout |
29+
| Size | Typical scope |
30+
| ------ | ------------------------------------------------------------------------------- |
31+
| **XS** | Single attribute or property change, one file |
32+
| **S** | Localised change within one component, a few attributes |
33+
| **M** | Changes to one component plus its consumers, or 2-5 files |
34+
| **L** | Structural changes affecting multiple components or a shared layout |
3535
| **XL** | Architectural changes affecting routing, state management, or component library |
3636

3737
## Scoring model
@@ -40,31 +40,31 @@ Each issue is scored on three dimensions. The priority score determines the reme
4040

4141
### Severity (WCAG compliance level)
4242

43-
| Rating | Definition | Score |
44-
|--------|-----------|-------|
45-
| Critical | WCAG Level A violation. The feature is unusable for some disability group. | 3 |
46-
| Serious | WCAG Level AA violation. The feature is degraded but partially usable. | 2 |
47-
| Moderate | Best practice or WCAG AAA. Usability improvement, not a compliance failure. | 1 |
43+
| Rating | Definition | Score |
44+
| -------- | --------------------------------------------------------------------------- | ----- |
45+
| Critical | WCAG Level A violation. The feature is unusable for some disability group. | 3 |
46+
| Serious | WCAG Level AA violation. The feature is degraded but partially usable. | 2 |
47+
| Moderate | Best practice or WCAG AAA. Usability improvement, not a compliance failure. | 1 |
4848

4949
### User impact
5050

5151
User impact measures how many people are affected and how severely their experience is degraded. This is distinct from WCAG severity — a Serious (AA) issue that affects every keyboard user on every page has higher user impact than a Critical (A) issue on a rarely visited admin screen.
5252

53-
| Rating | Definition | Score |
54-
|--------|-----------|-------|
55-
| High | Affects a core user flow (navigation, auth, primary actions) or affects users across many pages. Multiple disability groups impacted. | 3 |
56-
| Medium | Affects a secondary flow or a specific page. One disability group primarily impacted. | 2 |
57-
| Low | Affects an edge case, a rarely used feature, or a minor inconvenience rather than a barrier. | 1 |
53+
| Rating | Definition | Score |
54+
| ------ | ------------------------------------------------------------------------------------------------------------------------------------- | ----- |
55+
| High | Affects a core user flow (navigation, auth, primary actions) or affects users across many pages. Multiple disability groups impacted. | 3 |
56+
| Medium | Affects a secondary flow or a specific page. One disability group primarily impacted. | 2 |
57+
| Low | Affects an edge case, a rarely used feature, or a minor inconvenience rather than a barrier. | 1 |
5858

5959
### Effort (inverse — lower effort scores higher)
6060

6161
Lower effort means faster delivery of accessibility improvement. All else being equal, fix the easy things first.
6262

63-
| Rating | Effort sizes | Score |
64-
|--------|-------------|-------|
65-
| Low effort | XS, S | 3 |
66-
| Medium effort | M | 2 |
67-
| High effort | L, XL | 1 |
63+
| Rating | Effort sizes | Score |
64+
| ------------- | ------------ | ----- |
65+
| Low effort | XS, S | 3 |
66+
| Medium effort | M | 2 |
67+
| High effort | L, XL | 1 |
6868

6969
### Priority score
7070

@@ -121,21 +121,21 @@ Present batches as grouped items with a combined effort estimate and a note on w
121121

122122
### Tier 1 - Fix Immediately
123123

124-
| # | Issue | WCAG | Severity | Impact | Effort | Score |
125-
|---|-------|------|----------|--------|--------|-------|
126-
| 1 | ... | ... | ... | ... | ... | ... |
124+
| # | Issue | WCAG | Severity | Impact | Effort | Score |
125+
| --- | ----- | ---- | -------- | ------ | ------ | ----- |
126+
| 1 | ... | ... | ... | ... | ... | ... |
127127

128128
### Tier 2 - Plan for Next Sprint
129129

130-
| # | Issue | WCAG | Severity | Impact | Effort | Score |
131-
|---|-------|------|----------|--------|--------|-------|
132-
| 1 | ... | ... | ... | ... | ... | ... |
130+
| # | Issue | WCAG | Severity | Impact | Effort | Score |
131+
| --- | ----- | ---- | -------- | ------ | ------ | ----- |
132+
| 1 | ... | ... | ... | ... | ... | ... |
133133

134134
### Tier 3 - Schedule When Capacity Allows
135135

136-
| # | Issue | WCAG | Severity | Impact | Effort | Score |
137-
|---|-------|------|----------|--------|--------|-------|
138-
| 1 | ... | ... | ... | ... | ... | ... |
136+
| # | Issue | WCAG | Severity | Impact | Effort | Score |
137+
| --- | ----- | ---- | -------- | ------ | ------ | ----- |
138+
| 1 | ... | ... | ... | ... | ... | ... |
139139

140140
### Batches
141141

‎.agents/skills/writing-accessibility-tests/SKILL.md‎

Lines changed: 34 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,11 @@ export const test = base.extend<A11yFixtures>({
9898
makeAxeBuilder: async ({ page }, use) => {
9999
await use(() =>
100100
new AxeBuilder({ page }).withTags([
101-
'wcag2a', 'wcag2aa', 'wcag21a', 'wcag21aa', 'wcag22aa',
101+
'wcag2a',
102+
'wcag2aa',
103+
'wcag21a',
104+
'wcag21aa',
105+
'wcag22aa',
102106
])
103107
);
104108
},
@@ -120,7 +124,9 @@ Tests then use:
120124
```typescript
121125
import { test } from './fixtures/base';
122126

123-
test('page has no accessibility violations', async ({ expectNoAxeViolations }) => {
127+
test('page has no accessibility violations', async ({
128+
expectNoAxeViolations,
129+
}) => {
124130
await expectNoAxeViolations();
125131
});
126132
```
@@ -180,9 +186,9 @@ await page.waitForSelector('#event-list');
180186
### Accessible names
181187

182188
```typescript
183-
await expect(
184-
page.getByRole('textbox', { name: 'Email' })
185-
).toHaveAccessibleName('Email');
189+
await expect(page.getByRole('textbox', { name: 'Email' })).toHaveAccessibleName(
190+
'Email'
191+
);
186192

187193
await expect(
188194
page.getByRole('button', { name: 'Save profile' })
@@ -233,8 +239,14 @@ expect(h1Count).toBe(1);
233239
### Live regions
234240

235241
```typescript
236-
await expect(page.locator('.filter-count')).toHaveAttribute('aria-live', 'polite');
237-
await expect(page.locator('.filter-count')).toHaveAttribute('aria-atomic', 'true');
242+
await expect(page.locator('.filter-count')).toHaveAttribute(
243+
'aria-live',
244+
'polite'
245+
);
246+
await expect(page.locator('.filter-count')).toHaveAttribute(
247+
'aria-atomic',
248+
'true'
249+
);
238250
```
239251

240252
### Dialog accessibility
@@ -306,9 +318,14 @@ axe cannot evaluate contrast for elements styled with CSS custom property chains
306318

307319
```typescript
308320
const fgColor = await element.evaluate((el) => getComputedStyle(el).color);
309-
const bgColor = await container.evaluate((el) => getComputedStyle(el).backgroundColor);
321+
const bgColor = await container.evaluate(
322+
(el) => getComputedStyle(el).backgroundColor
323+
);
310324
const ratio = contrastRatio(fgColor, bgColor);
311-
expect(ratio, `Contrast ratio is ${ratio.toFixed(2)}:1, expected at least 4.5:1`).toBeGreaterThanOrEqual(4.5);
325+
expect(
326+
ratio,
327+
`Contrast ratio is ${ratio.toFixed(2)}:1, expected at least 4.5:1`
328+
).toBeGreaterThanOrEqual(4.5);
312329
```
313330

314331
## Shadow DOM patterns
@@ -320,10 +337,16 @@ Playwright's `toHaveAccessibleName()` cannot pierce shadow DOM. For web componen
320337
await expect(page.locator('#my-button')).toContainText('Button Label');
321338

322339
// Icon-only button — check the icon's label attribute
323-
await expect(page.locator('#my-button icon-element')).toHaveAttribute('label', /.+/);
340+
await expect(page.locator('#my-button icon-element')).toHaveAttribute(
341+
'label',
342+
/.+/
343+
);
324344

325345
// Dialog/drawer — check the label attribute on the host
326-
await expect(page.locator('#my-dialog')).toHaveAttribute('label', 'Dialog Name');
346+
await expect(page.locator('#my-dialog')).toHaveAttribute(
347+
'label',
348+
'Dialog Name'
349+
);
327350

328351
// Switch/select — check label attribute
329352
await expect(page.locator('#my-switch')).toHaveAttribute('label', /.+/);

‎.gitignore‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,4 +68,4 @@ dist
6868
.netlify
6969

7070
# Ignore Playwright test run metadata
71-
.test-results/.last-run.json
71+
test-results/

0 commit comments

Comments
 (0)