Accessibility engine for automated Web UI testing
Installations
npm install axe-core
Score
99
Supply Chain
100
Quality
98.3
Maintenance
100
Vulnerability
80.9
License
Releases
Contributors
Developer
Developer Guide
Module System
CommonJS
Min. Node Version
>=4
Typescript Support
No
Node Version
18.18.2
NPM Version
9.8.1
Statistics
6,027 Stars
5,176 Commits
784 Forks
173 Watching
69 Branches
230 Contributors
Updated on 27 Nov 2024
Bundle Size
556.25 kB
Minified
147.61 kB
Minified + Gzipped
Languages
JavaScript (89.11%)
HTML (10.52%)
TypeScript (0.29%)
CSS (0.05%)
Shell (0.04%)
Total Downloads
Cumulative downloads
Total Downloads
2,414,298,894
Last day
-8.2%
3,171,027
Compared to previous day
Last week
1.9%
18,263,595
Compared to previous week
Last month
5.9%
77,323,067
Compared to previous month
Last year
21.7%
833,853,463
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dev Dependencies
69
axe-core
Axe is an accessibility testing engine for websites and other HTML-based user interfaces. It's fast, secure, lightweight, and was built to seamlessly integrate with any existing test environment so you can automate accessibility testing alongside your regular functional testing.
Sign up for axe news to get the latest on axe features, future releases, and events.
The Accessibility Rules
Axe-core has different types of rules, for WCAG 2.0, 2.1, 2.2 on level A, AA and AAA as well as a number of best practices that help you identify common accessibility practices like ensuring every page has an h1
heading, and to help you avoid "gotchas" in ARIA like where an ARIA attribute you used will get ignored. The complete list of rules, grouped WCAG level and best practice, can found in doc/rule-descriptions.md.
With axe-core, you can find on average 57% of WCAG issues automatically. Additionally, axe-core will return elements as "incomplete" where axe-core could not be certain, and manual review is needed.
To catch bugs earlier in the development cycle we recommend using the axe-linter vscode extension. To improve test coverage even further we recommend the intelligent guided tests in the axe Extension.
Getting started
First download the package:
1npm install axe-core --save-dev
Now include the javascript file in each of your iframes in your fixtures or test systems:
1<script src="node_modules/axe-core/axe.min.js"></script>
Now insert calls at each point in your tests where a new piece of UI becomes visible or exposed:
1axe 2 .run() 3 .then(results => { 4 if (results.violations.length) { 5 throw new Error('Accessibility issues found'); 6 } 7 }) 8 .catch(err => { 9 console.error('Something bad happened:', err.message); 10 });
Philosophy
The web can only become an accessible, inclusive space if developers are empowered to take responsibility for accessibility testing and accessible coding practices.
Automated accessibility testing is a huge timesaver, it doesn't require special expertise, and it allows teams to focus expert resources on the accessibility issues that really need them. Unfortunately, most accessibility tools are meant to be run on sites and applications that have reached the end of the development process and often don't give clear or consistent results, causing frustration and delays just when you thought your product was ready to ship.
Axe was built to reflect how web development actually works. It works with all modern browsers, tools, and testing environments a dev team might use. With axe, accessibility testing can be performed as part of your unit testing, integration testing, browser testing, and any other functional testing your team already performs on a day-to-day basis. Building accessibility testing into the early development process saves time, resources, and all kinds of frustration.
About axe - our Manifesto
- Axe is open source.
- It returns zero false positives (bugs notwithstanding).
- It's designed to work on all modern browsers and with whatever tools, frameworks, libraries and environments you use today.
- It's actively supported by Deque Systems, a major accessibility vendor.
- It integrates with your existing functional/acceptance automated tests.
- It automatically determines which rules to run based on the evaluation context.
- Axe supports in-memory fixtures, static fixtures, integration tests and iframes of infinite depth.
- Axe is highly configurable.
Supported Browsers
The axe-core API fully supports the following browsers:
- Microsoft Edge v40 and above
- Google Chrome v42 and above
- Mozilla Firefox v38 and above
- Apple Safari v7 and above
- Internet Explorer v11 (DEPRECATED)
Support means that we will fix bugs and attempt to test each browser regularly. Only Chrome and Firefox are currently tested on every pull request.
There is limited support for JSDOM. We will attempt to make all rules compatible with JSDOM but where this is not possible, we recommend turning those rules off. Currently the color-contrast
rule is known not to work with JSDOM.
We can only support environments where features are either natively supported or polyfilled correctly. We do not support the deprecated v0 Shadow DOM implementation.
Contents of the API Package
The axe-core API package consists of:
axe.js
- the JavaScript file that should be included in your web site under test (API)axe.min.js
- a minified version of the above file
Localization
Axe can be built using your local language. To do so, a localization file must be added to the ./locales
directory. This file must be named in the following manner: <langcode>.json
. To build axe using this locale, instead of the default, run axe with the --lang
flag, like so:
grunt build --lang=nl
or equivalently:
npm run build -- --lang=nl
This will create a new build for axe, called axe.<lang>.js
and axe.<lang>.min.js
. If you want to build all localized versions, simply pass in --all-lang
instead. If you want to build multiple localized versions (but not all of them), you can pass in a comma-separated list of languages to the --lang
flag, like --lang=nl,ja
.
To create a new translation for axe, start by running grunt translate --lang=<langcode>
. This will create a json file in the ./locales
directory, with the default English text in it for you to translate. Alternatively, you could copy ./locales/_template.json
. We welcome any localization for axe-core. For details on how to contribute, see the Contributing section below. For details on the message syntax, see Check Message Template.
To update an existing translation file, re-run grunt translate --lang=<langcode>
. This will add new messages used in English and remove messages which were not used in English.
Additionally, locale can be applied at runtime by passing a locale
object to axe.configure()
. The locale object must be of the same shape as existing locales in the ./locales
directory. For example:
1axe.configure({ 2 locale: { 3 lang: 'de', 4 rules: { 5 accesskeys: { 6 help: 'Der Wert des accesskey-Attributes muss einzigartig sein.' 7 } 8 // ... 9 }, 10 checks: { 11 abstractrole: { 12 fail: 'Abstrakte ARIA-Rollen dürfen nicht direkt verwendet werden.' 13 }, 14 'aria-errormessage': { 15 // Note: doT (https://github.com/olado/dot) templates are supported here. 16 fail: 'Der Wert der aria-errormessage ${data.values}` muss eine Technik verwenden, um die Message anzukündigen (z. B., aria-live, aria-describedby, role=alert, etc.).' 17 } 18 // ... 19 } 20 } 21});
Supported Locales
Axe-core supports the following locales. Do note that since locales are contributed by our community, they are not guaranteed to include all translations needed in a release.
- Basque
- Danish
- Dutch
- French
- German
- Hebrew
- Japanese
- Korean
- Norwegian (Bokmål)
- Polish
- Portuguese (Brazilian)
- Spanish
- Greek
- Italian
- Simplified Chinese
- Traditional Chinese
Updates & Security
Axe-core has a new minor release every 3 to 5 months, which usually introduces new rules and features. We recommend scheduling time to upgrade to these versions. Security updates will be made available for minor version lines up to 18 months old.
- See release and support for details on the frequency of releases, long-term support and recommendations on upgrading axe-core.
- See backward compatibility for details on the types of changes different releases may introduce.
Deque Trademarks Policy
DEQUE, DEQUELABS, AXE®, and AXE-CORE® are trademarks of Deque Systems, Inc. Use of the Deque trademarks must be in accordance with Deque's trademark policy.
Supported ARIA Roles and Attributes.
Refer axe-core ARIA support for a complete list of ARIA supported roles and attributes by axe.
Contributing
Read the Proposing Axe-core Rules guide
Read the documentation on the architecture
Read the documentation on contributing
Projects using axe-core
List of projects using axe-core
Acknowledgements
Thanks to Marat Dulin for his css-selector-parser implementation which is included for shadow DOM support. Another thank you to the Slick Parser implementers for their contribution, we have used some of their algorithms in our shadow DOM support code. Thanks to Lea Verou and Chris Lilley for their colorjs.io library which we have used for converting between color formats.
Licenses
Axe-core is distributed under the Mozilla Public License, version 2.0. It comes bundled with several dependencies which are distributed under their own terms. (See LICENSE-3RD-PARTY.txt)
No vulnerabilities found.
Reason
30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Reason
all changesets reviewed
Reason
security policy file detected
Details
- Info: security policy file detected: SECURITY.md:1
- Info: Found linked content: SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1
- Info: Found text in security policy: SECURITY.md:1
Reason
no dangerous workflow patterns detected
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: Mozilla Public License 2.0: LICENSE:0
Reason
no binaries found in the repo
Reason
dependency not pinned by hash detected -- score normalized to 5
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/format.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/dequelabs/axe-core/format.yml/develop?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/format.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/dequelabs/axe-core/format.yml/develop?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/dequelabs/axe-core/release.yml/develop?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/dequelabs/axe-core/release.yml/develop?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/semantic-pr-title.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/dequelabs/axe-core/semantic-pr-title.yml/develop?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/sync-master-develop.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/dequelabs/axe-core/sync-master-develop.yml/develop?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/dequelabs/axe-core/test.yml/develop?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/dequelabs/axe-core/test.yml/develop?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/dequelabs/axe-core/test.yml/develop?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/dequelabs/axe-core/test.yml/develop?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/dequelabs/axe-core/test.yml/develop?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/dequelabs/axe-core/test.yml/develop?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/dequelabs/axe-core/test.yml/develop?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:53: update your workflow using https://app.stepsecurity.io/secureworkflow/dequelabs/axe-core/test.yml/develop?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update-generated-files.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/dequelabs/axe-core/update-generated-files.yaml/develop?enable=pin
- Warn: npmCommand not pinned by hash: .circleci/verify-release.sh:13
- Info: 0 out of 13 GitHub-owned GitHubAction dependencies pinned
- Info: 3 out of 5 third-party GitHubAction dependencies pinned
- Info: 5 out of 6 npmCommand dependencies pinned
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/format.yml:1
- Warn: no topLevel permission defined: .github/workflows/label-extension-linter-issues.yml:1
- Warn: no topLevel permission defined: .github/workflows/release.yml:1
- Warn: no topLevel permission defined: .github/workflows/semantic-pr-title.yml:1
- Warn: no topLevel permission defined: .github/workflows/sync-master-develop.yml:1
- Warn: no topLevel permission defined: .github/workflows/test.yml:1
- Warn: no topLevel permission defined: .github/workflows/update-generated-files.yaml:1
- Info: no jobLevel write permissions found
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 30 are checked with a SAST tool
Reason
10 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-8hc4-vh64-cxmj
- Warn: Project is vulnerable to: GHSA-qwcr-r2fm-qrc7
- Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-cxjh-pqwp-8mfp
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
- Warn: Project is vulnerable to: GHSA-fhg7-m89q-25r3
- Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
Score
5.9
/10
Last Scanned on 2024-11-25
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More