chore(deps): bump axe-core from 4.11.1 to 4.11.3

[dependabot]

Bumps axe-core from 4.11.1 to 4.11.3.

Release notes

Sourced from axe-core's releases.

Release 4.11.3

This release addresses a few false positives, which may reduce the number of issues on terget-size and aria-allowed-attr.

Bug Fixes

• aria-allowed-attr: restrict br and wbr elements to aria-hidden only (#4974) (1d80163)
• target-size: ignore position: fixed elements that are offscreen when page is scrolled (#5066) (5906273), closes #5065

Release 4.11.2

This release addresses a number of false positives, including ones related to target size. It adds new affordances for ARIA, and adds a clarification around the scrollable regions rule.

Bug Fixes

• aria-valid-attr-value: handle multiple aria-errormessage IDs (#4973) (9322148)
• aria: prevent getOwnedVirtual from returning duplicate nodes (#4987) (99d1e77), closes #4840
• DqElement: avoid calling constructors with cloneNode (#5013) (88bc57f)
• existing-rule: aria-busy now shows an error message for a use with unallowed children (#5017) (dded75a)
• scrollable-region-focusable: clarify the issue is in safari (#4995) (2567afd), closes WebKit#190870 WebKit#277290
• scrollable-region-focusable: do not fail scroll areas when all content is visible without scrolling (#4993) (240f8b5)
• target-size: determine offset using clientRects if target is display:inline (#5012) (69d81c1)
• target-size: ignore widgets that are inline with other inline elements (#5000) (cf8a3c0)

Changelog

Sourced from axe-core's changelog.

4.11.3 (2026-04-13)

Bug Fixes

• aria-allowed-attr: restrict br and wbr elements to aria-hidden only (#4974) (1d80163)
• target-size: ignore position: fixed elements that are offscreen when page is scrolled (#5066) (5906273), closes #5065

4.11.2 (2026-03-30)

Bug Fixes

• aria-valid-attr-value: handle multiple aria-errormessage IDs (#4973) (9322148)
• aria: prevent getOwnedVirtual from returning duplicate nodes (#4987) (99d1e77), closes #4840
• DqElement: avoid calling constructors with cloneNode (#5013) (88bc57f)
• existing-rule: aria-busy now shows an error message for a use with unallowed children (#5017) (dded75a)
• scrollable-region-focusable: clarify the issue is in safari (#4995) (2567afd), closes WebKit#190870 WebKit#277290
• scrollable-region-focusable: do not fail scroll areas when all content is visible without scrolling (#4993) (240f8b5)
• target-size: determine offset using clientRects if target is display:inline (#5012) (69d81c1)
• target-size: ignore widgets that are inline with other inline elements (#5000) (cf8a3c0)

Commits

• c71e3dd chore(release): v4.11.3 (#5070)
• 3ab66ba chore(release): 4.11.3
• 5906273 fix(target-size): ignore position: fixed elements that are offscreen when pag...
• d5a5705 refactor(frame-messenger): Guard against inherited properties as topics and c...
• 1d80163 fix(aria-allowed-attr): restrict br and wbr elements to aria-hidden only (#4974)
• baa580b chore: bump the npm-low-risk group with 8 updates (#5053)
• 0463a3f chore: bump actions/upload-artifact from 6.0.0 to 7.0.0 (#5054)
• 7e06043 chore: bump actions/download-artifact from 7.0.0 to 8.0.1 (#5056)
• 41093da chore(release): v4.11.2 (#5049)
• 66c26aa chore(release): 4.11.2
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[xiaojiou176]

Freshly re-reviewed after rebasing onto the new mainline. This dependency-only change looks good to land once the required checks finish.

[xiaojiou176]

Freshly re-reviewed after the maintained lock refresh. Looks good to land once the updated checks finish.

[xiaojiou176]

Freshly re-reviewed after the shared lxml/security blocker landed on main and after the maintained lock refresh. Good to merge once the updated checks finish.

[xiaojiou176]

Superseded by #187, which replays the same maintained axe-core lock refresh on top of the latest mainline without the post-merge lock conflicts that made this Dependabot branch dirty.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.