Drop the accessibility tooling that never ran #225

Merged

robbertbos merged 1 commit from chore/drop-unused-axe-tooling into main 2026-08-05 20:08:50 +00:00

Conversation 0 Commits 1 Files changed 3 +7 -1702

robbertbos commented 2026-08-05 18:06:05 +00:00

Owner

Copy link

@axe-core/cli, jest-axe and @types/jest-axe are declared in frontend/package.json but nothing imports or invokes them - no source file, no npm script, no CI step. Verified by grep over frontend/src, frontend/tests, the scripts block and .forgejo/workflows/: zero hits.

A safety net that exists only in the dependency list is worse than having none, because it reads as covered.

What removing them buys

	Before (main)	After
Packages in the lockfile	636	502
High-severity npm audit findings	6	2

@axe-core/cli pulled in chromedriver, which pulled in adm-zip - that chain accounted for four of the six findings. What remains is brace-expansion and undici, both transitive under other dev tooling.

Not an argument against accessibility testing

Issue #223 tracks a real WCAG 2.4.1 level A failure (no skip link, so keyboard users cannot bypass TopNav). Automated checking is worth having - but it should be wired into an npm script and a CI job deliberately, not left as three dependencies that look like they run.

Verification

vue-tsc typecheck, eslint (0 errors), vitest 651 passed in 89 files, vite build, Playwright e2e 64 passed / 3 skipped, pre-commit run --all-files.

`@axe-core/cli`, `jest-axe` and `@types/jest-axe` are declared in `frontend/package.json` but nothing imports or invokes them - no source file, no npm script, no CI step. Verified by grep over `frontend/src`, `frontend/tests`, the `scripts` block and `.forgejo/workflows/`: zero hits. A safety net that exists only in the dependency list is worse than having none, because it reads as covered. ## What removing them buys | | Before (main) | After | |---|---|---| | Packages in the lockfile | 636 | 502 | | High-severity `npm audit` findings | 6 | 2 | `@axe-core/cli` pulled in `chromedriver`, which pulled in `adm-zip` - that chain accounted for four of the six findings. What remains is `brace-expansion` and `undici`, both transitive under other dev tooling. ## Not an argument against accessibility testing Issue #223 tracks a real WCAG 2.4.1 level A failure (no skip link, so keyboard users cannot bypass `TopNav`). Automated checking is worth having - but it should be wired into an npm script and a CI job deliberately, not left as three dependencies that look like they run. ## Verification `vue-tsc` typecheck, eslint (0 errors), vitest 651 passed in 89 files, `vite build`, Playwright e2e 64 passed / 3 skipped, `pre-commit run --all-files`.

robbertbos added 1 commit 2026-08-05 18:06:05 +00:00

Drop the accessibility tooling that never ran ... 1f198dc855

@axe-core/cli, jest-axe and @types/jest-axe are declared in frontend/package.json
but nothing imports or invokes them: no source file, no npm script, no CI step.
A safety net that exists only in the dependency list is worse than none, because
it reads as covered.

Removing them takes 134 packages out of the tree and four of the six
high-severity npm audit findings with them: @axe-core/cli pulled in chromedriver,
which pulled in adm-zip. What remains is brace-expansion and undici.

Automated accessibility checking is still wanted - issue #223 tracks a real
WCAG 2.4.1 failure. When it is set up it should be wired into a script and CI
deliberately, rather than left as a dependency that looks like it runs.

robbertbos merged commit 1f198dc855 into main 2026-08-05 20:08:50 +00:00

robbertbos deleted branch chore/drop-unused-axe-tooling 2026-08-05 20:08:50 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

bug

Something is not working

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

help wanted

Need some help

  

invalid

Something is wrong

  

nldd ds

  

question

More information is needed

  

wontfix

This won't be fixed

No labels

bug

duplicate

enhancement

help wanted

invalid

nldd ds

question

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

robbertbos/waggle!225

No description provided.