build(deps-dev): bump the npm-dependencies group across 1 directory with 2 updates

[dependabot]

Bumps the npm-dependencies group with 2 updates in the / directory: axe-core and wrangler.

Updates axe-core from 4.13.0 to 4.14.0

Release notes

Sourced from axe-core's releases.

Release 4.14.0

This release enables a new rule, and introduces new violations in some existing rules. These can cause the issue totals to go up from a previous version. Similarly we've included various bug fixes to false positives which may see the issue count go down as well. This release focused on various performance improvements which should speed runs up 20% - 40% on most pages. On especially large pages we've measured a 15x performance improvement.

Features

• add EN 301 549 v4 tags to target-size (#5361) (8200d2b), closes #5311
• i18n: add Azerbaijani locale (#5385) (02e5fd4)
• label-content-name-mismatch: Enable rule by default (#5421) (c0d6163), references #5227

Bug Fixes

• aria-allowed-attr: report case-sensitive aria attributes with non-lowercase values (#5418) (1e33c6c), closes #5280, references #5224
• aria-hidden-focus: suggest removing aria-hidden in the fail messages (#5397) (aa4a0a1), references #4552 #5357 #4552
• aria-prohibited-attr: quote the element name in no-role messages (#5391) (24736a4), references #3730 #5357 #3730
• aria-required-children: allow caption in table, grid and treegrid (#5412) (ed987a2), references #5265
• aria-required-children: explain presentational children that cannot be ignored (#5407) (35a38d8), references #4833 #5357 #4833
• avoid-inline-spacing: test the text that gets the spacing from the element (#5411) (96e3e06), references #4232 #4232
• checks: add incomplete messages to checks that can return undefined (#5388) (6f1a6fe), references #5375 #5375
• checks: make listitem failure messages actionable (#5357) (6dd1be2)
• color-contrast: handle "none" and exponents in color strings (#5422) (cf5ed89), references #5313 #4136 #4007 #4269
• color-contrast: treat empty low-contrast text inputs as incomplete (#5359) (47029de), closes #4260, references #2130 #2130
• commons/dom: treat dialog as non-modal when elementsFromPoint is unsupported (#5202) (757b44a), references #4997
• commons/text/visibleVirtual: sanitize visible text once, not at every level (#5368) (2d47182), closes #5207, references #5207 act-rules/act-rules.github.io#2443
• core: use the fallback message when a check has no incomplete message (#5367) (4887c3a), closes #5344, references #5355
• label-content-name-mismatch: add support for cjk word splitting (#5437) (d53cb0a)
• label-content-name-mismatch: compare visible label to name by word (#5345) (4e3fcf5), references #5203 act-rules/act-rules.github.io#2443 #5207 #5308 #5203 #5346 #5207 #5207 #5302 #4311 #5203 #5302 #5302 #5344 #5203
• label-content-name-mismatch: ignore parenthesised content (#5360) (388132d), references act-rules/act-rules.github.io#2443 #5308 #5207 #5207 #5207
• label-content-name-mismatch: mark value-text roles incomplete (#5355) (5258f44), closes #4561, references #4561 #5344 #5345
• label-content-name-mismatch: normalize CJK and full-width text before comparing (#5419) (52dd387), references #5420 #5340 #5345 #5400 #5355 #5308 #5400
• no-focusable-content: say how to fix in the default fail message (#5392) (b84b76b), references #3267 #5357 #3194 #5357 #3267
• p-as-heading: ignore paragraphs with heading roles (#5348) (cbc33b9), references #5283
• process-message: separate array values with a comma and a space (#5393) (6ba9ee4), references #3344 #3344
• reporter: make addReporter isDefault set the default reporter (#5395) (eb854ed), references #4058 #4058
• scrollable-region-focusable: negative tabindex content needs review instead of failing outright (#5364) (72e8624)
• target-size: ignore overlapping links with the same destination (#5428) (2ba0812), references #5406 #4224
• Update de.json (#5353) (4d306cb)
• utils: resolve @​import url against the stylesheet that contains it (#5269) (e618fb6), closes #5268

Changelog

Sourced from axe-core's changelog.

4.14.0 (2026-10-05)

Features

• add EN 301 549 v4 tags to target-size (#5361) (8200d2b), closes #5311
• i18n: add Azerbaijani locale (#5385) (02e5fd4)
• label-content-name-mismatch: Enable rule by default (#5421) (c0d6163), references #5227

Bug Fixes

• aria-allowed-attr: report case-sensitive aria attributes with non-lowercase values (#5418) (1e33c6c), closes #5280, references #5224
• aria-hidden-focus: suggest removing aria-hidden in the fail messages (#5397) (aa4a0a1), references #4552 #5357 #4552
• aria-prohibited-attr: quote the element name in no-role messages (#5391) (24736a4), references #3730 #5357 #3730
• aria-required-children: allow caption in table, grid and treegrid (#5412) (ed987a2), references #5265
• aria-required-children: explain presentational children that cannot be ignored (#5407) (35a38d8), references #4833 #5357 #4833
• avoid-inline-spacing: test the text that gets the spacing from the element (#5411) (96e3e06), references #4232 #4232
• checks: add incomplete messages to checks that can return undefined (#5388) (6f1a6fe), references #5375 #5375
• checks: make listitem failure messages actionable (#5357) (6dd1be2)
• color-contrast: handle "none" and exponents in color strings (#5422) (cf5ed89), references #5313 #4136 #4007 #4269
• color-contrast: treat empty low-contrast text inputs as incomplete (#5359) (47029de), closes #4260, references #2130 #2130
• commons/dom: treat dialog as non-modal when elementsFromPoint is unsupported (#5202) (757b44a), references #4997
• commons/text/visibleVirtual: sanitize visible text once, not at every level (#5368) (2d47182), closes #5207, references #5207 act-rules/act-rules.github.io#2443
• core: use the fallback message when a check has no incomplete message (#5367) (4887c3a), closes #5344, references #5355
• label-content-name-mismatch: add support for cjk word splitting (#5437) (d53cb0a)
• label-content-name-mismatch: compare visible label to name by word (#5345) (4e3fcf5), references #5203 act-rules/act-rules.github.io#2443 #5207 #5308 #5203 #5346 #5207 #5207 #5302 #4311 #5203 #5302 #5302 #5344 #5203
• label-content-name-mismatch: ignore parenthesised content (#5360) (388132d), references act-rules/act-rules.github.io#2443 #5308 #5207 #5207 #5207
• label-content-name-mismatch: mark value-text roles incomplete (#5355) (5258f44), closes #4561, references #4561 #5344 #5345
• label-content-name-mismatch: normalize CJK and full-width text before comparing (#5419) (52dd387), references #5420 #5340 #5345 #5400 #5355 #5308 #5400
• no-focusable-content: say how to fix in the default fail message (#5392) (b84b76b), references #3267 #5357 #3194 #5357 #3267
• p-as-heading: ignore paragraphs with heading roles (#5348) (cbc33b9), references #5283
• process-message: separate array values with a comma and a space (#5393) (6ba9ee4), references #3344 #3344
• reporter: make addReporter isDefault set the default reporter (#5395) (eb854ed), references #4058 #4058
• scrollable-region-focusable: negative tabindex content needs review instead of failing outright (#5364) (72e8624)
• target-size: ignore overlapping links with the same destination (#5428) (2ba0812), references #5406 #4224
• Update de.json (#5353) (4d306cb)
• utils: resolve @​import url against the stylesheet that contains it (#5269) (e618fb6), closes #5268

Commits

• e797173 chore(release): v4.14.0 (#5438)
• 6976881 chore(release): 4.14.0
• d53cb0a fix(label-content-name-mismatch): add support for cjk word splitting (#5437)
• 35a38d8 fix(aria-required-children): explain presentational children that cannot be i...
• 2ba0812 fix(target-size): ignore overlapping links with the same destination (#5428)
• 1e33c6c fix(aria-allowed-attr): report case-sensitive aria attributes with non-lowerc...
• f59642e chore: bump mocha from 11.8.0 to 12.0.2 (#5426)
• 6efcb6e chore: bump emoji-regex from 10.6.0 to 11.0.0 (#5427)
• 2da49a3 chore: bump the npm-low-risk group across 1 directory with 7 updates (#5425)
• aa4a0a1 fix(aria-hidden-focus): suggest removing aria-hidden in the fail messages (#5...
• Additional commits viewable in compare view

Updates wrangler from 4.147.0 to 4.148.0

Release notes

Sourced from wrangler's releases.

wrangler@4.148.0

Minor Changes

• #16051 b4e1299 Thanks @​devteamaegis! - Add --source-namespace and --source-repo-name to wrangler queues subscription create for the artifacts.repo source

  The Event Subscriptions API requires source.namespace and source.repo_name for artifacts.repo subscriptions, but Wrangler had no way to pass them, so --source artifacts.repo always failed with a validation error. Both flags are now required for this source, and wrangler queues subscription get shows the subscription's resource as <namespace>/<repo-name>.

• #15998 b75421f Thanks @​dario-piotrowicz! - Add assets.base_path support to Workers Assets

  Serve an asset directory from a public URL prefix without changing its on-disk layout:

  {
    "assets": {
      "directory": "./public",
      "base_path": "/docs"
    }
  }

  Wrangler, preview, Miniflare, and generated build configuration preserve the explicitly selected value, while the Asset Worker normalizes it and strips the prefix only for asset lookup. Requests passed to a user Worker, request-facing headers, and redirects retain the public path. Relative pathname inputs are interpreted as root-relative prefixes, URL-shaped values are rejected, and omitting the option preserves existing root-path behavior.

  Authored _headers and _redirects rules continue to match full public paths. In particular, both the source and destination of an authored 200 asset rewrite must include the configured public prefix; Asset Worker-generated redirects are prefixed automatically.

• #16005 4d308f6 Thanks @​oOPa! - Add a --experimental-mode instant option to wrangler kv namespace create

  This lets entitled accounts create Workers KV Instant namespaces while the feature is in private beta.

• #16030 aa2f9b7 Thanks @​edmundhung! - Add email-protected Quick Tunnels to wrangler dev

  Pass one or more --tunnel-allowed-mail flags to require email authentication when exposing a local development server through a Quick Tunnel. Each value can be an exact email address or a domain pattern.

• #15283 2dde890 Thanks @​shubhxho! - Support deleting secrets with wrangler versions secret bulk

  Set a secret's value to null in JSON input to remove it from the new Worker version. Bulk output now distinguishes between created and deleted secrets, so retrying wrangler secret bulk with wrangler versions secret bulk preserves requested deletions. Deploy the new version with wrangler versions deploy to apply the changes to production traffic.

Patch Changes

• #15534 2b1a0ca Thanks @​vahidshaik1901! - Improve guidance for conflicting Wrangler configuration files

  When user and generated deploy configurations are found under different base paths, Wrangler now identifies the expected deploy configuration location, suggests how to resolve the conflict, and links to the relevant documentation.

• #16014 c492d63 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261001.1	^5.20261005.1
  workerd	1.20261001.1	1.20261005.1

... (truncated)

Commits

• 540f084 Version Packages (#16034)
• 42c7219 [wrangler] Fix r2 object put and r2 bulk put storing a different key in local...
• 2dde890 [wrangler] Clarify secret version errors and support versions bulk deletions ...
• b4e1299 [wrangler] Add --source-namespace and --source-repo-name for artifacts.repo q...
• 2c23c83 [wrangler] Retry K2 E2E produce requests through workers.dev propagation (#16...
• 14f0339 [wrangler] Include default module rules in generated types (#15573)
• 26e03e2 [wrangler] Print temporary account notices to stderr (#16068)
• aa2f9b7 [wrangler][vite-plugin] Support protected Quick Tunnels (#16030)
• 4d308f6 [wrangler] Add Workers KV Instant mode to namespace create command (#16005)
• f8cdcb9 [miniflare] Manage Flagship flags in Local Explorer (#15330)
• Additional commits viewable in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: wpmoo-org/ui/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 49d3df0f-9f34-4f26-96c0-d773dea51a1d

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}