Release pa11y@8

[danyalaytekin]

Note

1. pa11y-bot will release pa11y@8.0.0 from main once this is merged and the draft GitHub Release published
2. Full diff since 7.0.0

Components

• Update puppeteer to ^22 (and other dependency updates) #689
  • which resolved Version 7.0.0 requires an unsupported version of puppeteer #688
• Use native AbortSignal in place of p-timeout #694
• Return to Mocha #695

Changes in this PR

• Update version guards in reporters/* and runners/*
• Add CHANGELOG.md entry
• Add MIGRATION.md entry
• Update README.md
• Create draft release

The stale next dist tag was also deleted in:

• Check projects' published npm dist tags for staleness and remove as necessary org#27

To run this version locally

npx pa11y/pa11y#version-8 https://example.com

Package comparison

npm pack for proposed release

danyal, pa11y (version-8) > npm pack
npm notice 
npm notice 📦  pa11y@8.0.0
npm notice === Tarball Contents === 
npm notice 7.7kB  LICENSE                  
npm notice 30.6kB README.md                
npm notice 8.9kB  bin/pa11y.js             
npm notice 9.2kB  lib/action.js            
npm notice 3.4kB  lib/option.js            
npm notice 14.0kB lib/pa11y.js             
npm notice 1.1kB  lib/reporter.js          
npm notice 2.6kB  lib/reporters/cli.js     
npm notice 710B   lib/reporters/csv.js     
npm notice 1.3kB  lib/reporters/html.js    
npm notice 659B   lib/reporters/json.js    
npm notice 1.9kB  lib/reporters/report.html
npm notice 658B   lib/reporters/tsv.js     
npm notice 7.1kB  lib/runner.js            
npm notice 5.5kB  lib/runners/axe.js       
npm notice 2.8kB  lib/runners/htmlcs.js    
npm notice 2.0kB  package.json             
npm notice === Tarball Details === 
npm notice name:          pa11y                                   
npm notice version:       8.0.0                                   
npm notice filename:      pa11y-8.0.0.tgz                         
npm notice package size:  28.7 kB                                 
npm notice unpacked size: 100.0 kB                                
...
npm notice total files:   17                                      
npm notice 
pa11y-8.0.0.tgz
  

npm pack for pa11y@7.0.0

danyal, pa11y (version-7) > npm pack
npm notice 
npm notice 📦  pa11y@7.0.0
npm notice === Tarball Contents === 
npm notice 7.7kB  LICENSE                  
npm notice 30.4kB README.md                
npm notice 8.9kB  bin/pa11y.js             
npm notice 9.2kB  lib/action.js            
npm notice 3.4kB  lib/option.js            
npm notice 14.2kB lib/pa11y.js             
npm notice 1.1kB  lib/reporter.js          
npm notice 2.6kB  lib/reporters/cli.js     
npm notice 710B   lib/reporters/csv.js     
npm notice 1.3kB  lib/reporters/html.js    
npm notice 659B   lib/reporters/json.js    
npm notice 1.9kB  lib/reporters/report.html
npm notice 658B   lib/reporters/tsv.js     
npm notice 7.1kB  lib/runner.js            
npm notice 5.5kB  lib/runners/axe.js       
npm notice 2.8kB  lib/runners/htmlcs.js    
npm notice 1.8kB  package.json             
npm notice === Tarball Details === 
npm notice name:          pa11y                                   
npm notice version:       7.0.0                                   
npm notice filename:      pa11y-7.0.0.tgz                         
npm notice package size:  28.7 kB                                 
npm notice unpacked size: 99.8 kB                
...
npm notice total files:   17                                      
npm notice 
pa11y-7.0.0.tgz

Note about Mockery

The return of the test dependency Mockery brings with it a security alert, which it would be good to remove in 8.x. This is less important than it might otherwise be, because mockery isn't included when installing pa11y globally or as a dependency; the same package was also used by pa11y@6.0.0 so we can confirm this with:

$ npm install -g pa11y@6.0.0

(... no security alert)
added 79 packages in 11s

Mockery is also present in our other projects. Down the line, we could:

1. replace it with e.g. testdouble
2. patch it using e.g. CVE-2022-37614 - resolve prototype pollution vuln mfncooper/mockery#81
3. rework the project so we can choose to inject real dependencies or fakes

[josebolos]

Excellent job. Thank you all! 🚀