Vendor axe-core, drop the Skypack CDN dependency

configuration

@@ -35,6 +35,7 @@ export BOOTSWATCH=5.3.1
 
 # javascript HTML dependencies
 export ANCHOR_JS=5.0.0
+export AXE_JS=4.10.3
 export POPPER_JS=2.11.7
 export CLIPBOARD_JS=2.0.11
 export TIPPY_JS=6.3.7

news/changelog-1.10.md

@@ -11,13 +11,15 @@ All changes included in 1.10:
 ## Dependencies
 
 - ([#14291](https://github.com/quarto-dev/quarto-cli/issues/14291)): Update `deno` to v2.7.14 (fixes silent crash on Windows builds older than 16299).
+- Bundle `axe-core` 4.10.3 (used by the `axe` HTML accessibility option), previously loaded at runtime from the Skypack CDN.
 
 ## Accessibility
 
 - ([#14468](https://github.com/quarto-dev/quarto-cli/issues/14468)): The `axe` accessibility report UI (HTML overlay, revealjs report slide, dashboard offcanvas) now uses its own theme-independent colors instead of inheriting from `brand` or theme. Keeps the report readable regardless of page styling, and stops `axe` from clobbering brand colors set via `_brand.yml`.
 - ([#14602](https://github.com/quarto-dev/quarto-cli/pull/14602), [#14632](https://github.com/quarto-dev/quarto-cli/pull/14632)): Fix ORCID profile link having no accessible name for screen readers in HTML, Reveal.js, and ipynb title-block author metadata. (author: @mcanouil for #14602)
 - ([#14604](https://github.com/quarto-dev/quarto-cli/issues/14604)): The `axe` accessibility report UI now shows each violation's WCAG conformance level (e.g. `WCAG 2.0 AA (1.4.3)`) or `Best Practice`, derived from the violation's axe-core tags.
 - ([#14655](https://github.com/quarto-dev/quarto-cli/issues/14655)): Add accessible names to code line-number links so screen readers and accessibility audits no longer report them as empty links.
+- ([#14677](https://github.com/quarto-dev/quarto-cli/pull/14677)): The `axe` option now uses a copy of axe-core bundled with Quarto instead of loading it from the Skypack CDN in the reader's browser. Accessibility checking now works offline, and viewing a rendered document no longer triggers a request to `cdn.skypack.dev`. The axe-core version is unchanged (4.10.3), so scan results are identical.
 
 ## Formats
 

package/src/common/update-html-dependencies.ts

@@ -78,6 +78,12 @@ export async function updateHtmlDependencies(config: Configuration) {
   );
   cleanSourceMap(anchorJs);
 
+  // Axe (LICENSE files must ship alongside the MPL-2.0 axe.min.js)
+  const axeDir = join(formatDir, "axe");
+  for (const file of ["axe.min.js", "LICENSE", "LICENSE-3RD-PARTY.txt"]) {
+    await updateUnpkgDependency("AXE_JS", "axe-core", file, join(axeDir, file));
+  }
+
   // Poppper
   const popperJs = join(formatDir, "popper", "popper.min.js");
   await updateUnpkgDependency(

src/format/html/format-html-axe.ts

@@ -22,6 +22,10 @@ function axeHtmlDependency(options: unknown): FormatDependency {
       encodeBase64(JSON.stringify(options))
     }</script>`,
     scripts: [{
+      // Classic script, so it executes before the deferred module below.
+      name: "axe.min.js",
+      path: formatResourcePath("html", join("axe", "axe.min.js")),
+    }, {
       name: "axe-check.js",
       path: formatResourcePath("html", join("axe", "axe-check.js")),
       attribs: { type: "module" },