From a2ebf3e407176b8dd5fce1ea3ac9f9eedc5c0b7e Mon Sep 17 00:00:00 2001
From: Ruben van der Linde <ruben@conduction.nl>
Date: Thu, 6 Aug 2026 15:06:46 +0200
Subject: [PATCH] =?UTF-8?q?chore(deps):=20axe-core=20is=20a=20testing=20li?=
 =?UTF-8?q?brary=20=E2=80=94=20move=20it=20to=20devDependencies?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

axe-core sat in `dependencies`, declaring an accessibility *testing*
library as an application runtime dependency.

Measured: nothing under src/ imports axe-core, and the built bundle never
contained it (webpack only emits what the import graph reaches). What put
it in every app manifest is a bogus peerDependency on
`axe-core: ^4.10.0` declared by @conduction/nextcloud-vue, which does not
import it either. Real accessibility scanning uses @axe-core/playwright,
and the hydra WCAG gate injects axe from cdnjs — neither needs this entry.

Not a bundle-size fix; the bundle is unchanged. It stops a test dependency
being declared as production surface (SBOM, `npm ci --omit=dev`, advisory
triage). devDependencies still satisfy nc-vue's peer.

Verified: npm ci + production build both exit 0.
---
 package-lock.json | 3 ++-
 package.json      | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index e027dace..3249d64a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -22,7 +22,6 @@
 				"@vue/compat": "^3.5.13",
 				"@vueuse/core": "^14.4.0",
 				"apexcharts": "^4.7.0",
-				"axe-core": "^4.12.1",
 				"dexie": "^4.4.4",
 				"dompurify": "^3.4.12",
 				"gridstack": "^12.6.0",
@@ -53,6 +52,7 @@
 				"@vue/compiler-sfc": "^3.5.13",
 				"@vue/eslint-config-typescript": "^13.0.0",
 				"@vue/test-utils": "^2.4.6",
+				"axe-core": "^4.12.1",
 				"commander": "^12.1.0",
 				"css-loader": "~7.1.1",
 				"eslint": "^8.56.0",
@@ -5604,6 +5604,7 @@
 			"version": "4.12.1",
 			"resolved": "https://registry.npmjs.org/axe-core/-/axe-core-4.12.1.tgz",
 			"integrity": "sha512-s7iGf5GaVMxEG0ENN9x+xTr7GFZCb1ZP/1uATUpCEK2X78nDB3RwbtFCo9pGAf9ru+VwoQ464DkaLEeRM08wJA==",
+			"dev": true,
 			"license": "MPL-2.0",
 			"engines": {
 				"node": ">=4"
diff --git a/package.json b/package.json
index d69c9992..142ce187 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,6 @@
 		"@vue/compat": "^3.5.13",
 		"@vueuse/core": "^14.4.0",
 		"apexcharts": "^4.7.0",
-		"axe-core": "^4.12.1",
 		"dexie": "^4.4.4",
 		"dompurify": "^3.4.12",
 		"gridstack": "^12.6.0",
@@ -82,6 +81,7 @@
 		"@vue/compiler-sfc": "^3.5.13",
 		"@vue/eslint-config-typescript": "^13.0.0",
 		"@vue/test-utils": "^2.4.6",
+		"axe-core": "^4.12.1",
 		"commander": "^12.1.0",
 		"css-loader": "~7.1.1",
 		"eslint": "^8.56.0",