axe-core, vendored

axe.min.js is axe-core, Deque's accessibility rules engine, vendored so the WCAG gate runs from the checkout and not from the network.

version 4.10.3 file axe.min.js sha256 880970c081707360e64f34cea25ff91892f5bc95675b0776925b9709dd8a68bb source https://cdnjs.cloudflare.com/ajax/libs/axe-core/4.10.3/axe.min.js verified byte-identical to https://cdn.jsdelivr.net/npm/axe-core@4.10.3/axe.min.js licence MPL-2.0 (the header comment in the file is the notice)

This is test data

It is read by internal/axe, whose Scan (build tag browser) injects it into a headless Chromium and runs it over the page a drive is on: every example state as its own document in internal/gallery, and the fixtures the drives in check/ serve. Only this package embeds the engine. The root package embeds css/, js/, icons/, examples/, i18n/ and LICENSE, so nothing a Go program imports from Fiesta carries it, and two untagged tests hold that on every go test ./..., not only when a browser is around: TestTheShippedTreeCarriesNoAxe beside this file walks the embedded tree for the engine's banner and checks that the public packages never import this one, and TestVendoredAxeIsNotAShippedAsset in internal/build walks the release.

Upgrading

Fetch the new version from both CDNs above, check the two copies are identical, replace the file, and update the version and sha256 in this README. TestVendoredAxeIsThePinnedVersion reads both out of this file and fails if either stops describing what is on disk. Then run the scan: a new axe-core finds things the old one did not, and those findings are the point.

make browser.internal.gallery~1of2 browser.internal.gallery~2of2