Implement ARIA change: no longer supported attributes (`aria-expanded`) on role `listbox`

[spectranaut]

Product

axe-core

Feature Description

This change will land in the editors draft soon -- dropping support of aria-expanded on role listbox: https://github.com/w3c/aria/pull/1862

This means the following HTML is no longer valid:

<div role="listbox" aria-label="foo" aria-expanded="true">
</div>

I see that non-global, not supported attributes hit the rule for the HTML: <div id="test" aria-expanded="true"></div>, it seems like the same role should be hit in the scenario above:

  Violation of "aria-allowed-attr" with 1 occurrences!
    Ensures an element's role supports its ARIA attributes. Correct invalid elements at:
     - #test
    For details, see: https://dequeuniversity.com/rules/axe/4.9/aria-allowed-attr

[WilcoFiers]

Hey @spectranaut. Thanks for raising that. I've left a comment in the PR requesting this be deprecated instead. I'm reluctant to start failing axe-core over this. People have been adding aria-expanded to listboxes for years. It doesn't hurt to have it there. It actually helps a little with validation, since if aria-expanded=true tells us whether the aria-controls IDREF should be visible.

I think if this goes into the spec we could look at making this part of a best practice.