chore(deps-dev): bump pa11y from 7.0.0 to 9.1.1 in /frontend

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps pa11y from 7.0.0 to 9.1.1.

Release notes

Sourced from pa11y's releases.

v9.1.1

• Fix several issues with loading custom runners, including errors when loading any custom runner on Windows. (#798)
• Update debug messages related to opening the page and navigating to the target URL. (#701)
• Update dependencies (no functional changes)

Full diff for pa11y@9.1.1

• 9.1.0...9.1.1

v9.1.0

Pa11y 9.1 includes updates and improvements to both htmlcs and axe runners, replacement of mockery with quibble in the test suite to resolve security issues, an upgrade to ESLint v9 with flat config, and various other updates.

Changes

• Update to the new @pa11y/html_codesniffer fork, which incorporates the latest unreleased updates from html_codesniffer and resolves several issues (#698).
• Incorporate several updates and improvements to the axe runner:
  • Update axe-core to 4.11 from 4.10, which includes fixes for numerous rules that may affect Pa11y results. See the axe-core release notes for complete details.
  • Update the axe runner with a user-specified option to control how issues requiring manual review are handled, which resolves several issues. Added CLI arg --level-cap-when-needs-review <level> (default: error), which caps the severity of any issue that axe reports as requiring manual review. This is not a breaking change as the default behavior remains unchanged. (#685)
• Replace mockery with quibble for mocking in the test suite, removing the deprecated mockery dependency and resolving critical vulnerability CVE-2022-37614 / GHSA-gmwp-3pwc-3j3g. (#772)
• Update to ESLint v9 and flat config using eslint-config-pa11y, refactored for ESLint and flat config changes. (#778)
• Add example JSON and JavaScript config files.
• Update other dependencies (no functional changes)

Full diff for pa11y@9.1.0

• 9.0.1...9.1.0

Version 9.0.1

What's Changed

• Upgrade dependencies
• AppArmor-related documentation updates (thanks @​d33bs)
• Requirements documentation updates (thanks @​WilliamCollishaw)
• Improve security posture

New Contributors

• @​dependabot[bot] made their first contribution in pa11y/pa11y#721
• @​d33bs made their first contribution in pa11y/pa11y#725
• @​WilliamCollishaw made their first contribution in pa11y/pa11y#730

Full Changelog: pa11y/pa11y@9.0.0...9.0.1

v9.0.0

Pa11y 9 requires a stable (even-numbered) Node.js version of 20 or above, updates to the latest version of Puppeteer (24) and Axe (4.10), updates several other dependencies, and includes some GitHub actions and documentation cleanup.

Changes in pa11y@9

• Breaking: Upgrade Node.js support: Pa11y 9 requires a stable (even-numbered) Node.js version of 20 or above
• Significant dependency changes (potentially impacting Pa11y results):
  • Upgrade puppeteer to 24 from 22. This updates the underlying Chrome version (to 135).

... (truncated)

Changelog

Sourced from pa11y's changelog.

9.1.1 (2026-02-26)

• Fix several issues with loading custom runners, including errors when loading any custom runner on Windows. (#798)
• Update debug messages related to opening the page and navigating to the target URL. (#701)
• Update dependencies (no functional changes)

Full diff for pa11y@9.1.1

• 9.1.0...9.1.1

9.1.0 (2026-02-03)

Pa11y 9.1 includes updates and improvements to both htmlcs and axe runners, replacement of mockery with quibble in the test suite to resolve security issues, an upgrade to ESLint v9 with flat config, and various other updates.

Changes

• Update to the new @pa11y/html_codesniffer fork, which incorporates the latest unreleased updates from html_codesniffer and resolves several issues (#698).
• Incorporate several updates and improvements to the axe runner:
  • Update axe-core to 4.11 from 4.10, which includes fixes for numerous rules that may affect Pa11y results. See the axe-core release notes for complete details.
  • Update the axe runner with a user-specified option to control how issues requiring manual review are handled, which resolves several issues. Added CLI arg --level-cap-when-needs-review <level> (default: error), which caps the severity of any issue that axe reports as requiring manual review. This is not a breaking change as the default behavior remains unchanged. (#685)
• Replace mockery with quibble for mocking in the test suite, removing the deprecated mockery dependency and resolving critical vulnerability CVE-2022-37614 / GHSA-gmwp-3pwc-3j3g. (#772)
• Update to ESLint v9 and flat config using eslint-config-pa11y, refactored for ESLint and flat config changes. (#778)
• Add example JSON and JavaScript config files.
• Update other dependencies (no functional changes)

Full diff for pa11y@9.1.0

• 9.0.1...9.1.0

9.0.1 (2025-09-25)

• Upgrade dependencies
• AppArmor-related documentation updates (thanks @​d33bs)
• Requirements documentation updates (thanks @​WilliamCollishaw)
• Improve security posture

9.0.0 (2025-05-07)

Pa11y 9 requires a stable (even-numbered) Node.js version of 20 or above, updates to the latest version of Puppeteer (24) and Axe (4.10), updates several other dependencies, and includes some GitHub actions and documentation cleanup.

Changes in pa11y@9

• Breaking: Upgrade Node.js support: Pa11y 9 requires a stable (even-numbered) Node.js version of 20 or above
• Significant dependency changes (potentially impacting Pa11y results):
  • Upgrade puppeteer to 24 from 22. This updates the underlying Chrome version (to 135).
  • Upgrade axe-core to 4.10 from 4.8. This includes rule fixes that may change results when using the axe runner. See axe-core releases for complete details.
• Other dependency changes:
  • Upgrade bfj to 9.1 from 8.0.
  • Upgrade commander to 13.1 from 12.0.
  • Upgrade envinfo to 7.14 from 7.11.

... (truncated)

Commits

• 45729ed Update documentation for v9.1.1 (#802)
• 1a063b7 Clean up several minor issues in setPage (#701)
• dee22e5 Forcefully bump deps for 9.1.1 (#800)
• 41d1319 Bump puppeteer from 24.37.3 to 24.37.5 (#799)
• 511bd36 Fix custom runner issues (#798)
• 293c4e9 Bump bfj from 9.1.2 to 9.1.3 (#795)
• 8c08327 Bump puppeteer from 24.36.0 to 24.37.3 (#794)
• 2055ee5 Release pa11y@9.1.0 (#789)
• c09fbe4 Bump commander from 14.0.2 to 14.0.3 (#788)
• cc6e17f Bump axe-core from 4.10.3 to 4.11.1 (#787)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for pa11y since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[hman38705]

Superseded by #799 (consolidated dependabot bumps — all version updates applied and merged).

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.