Update to Pa11y v7 and other dependency updates

[aarongoldenthal]

This PR updates pa11y to 7.0.0, and all other dependencies to the latest supported, applicable versions (not the pure ESM only updates). It also updates the Node versions in the package and GitHub actions.

Dependencies

• Update async from 2.6.4 to 3.2.5, requiring a minor code change.
• Update cheerio from 1.0.0-rc.10 to 1.0.0-rc.12.
• Update commander from 6.2.1 to 11.1.0 (to match pa11y 7.0.0, not the latest), requiring a minor code change.
• Update globby from 6.1.0 to 11.1.0 (all subsequent versions through 14.0.0 are pure ESM only, but it appears security fixes for 11.x are still being made).
  • Note that 8.0.0 moved to the fast-glob package, which does not have an equivalent nonull capability, so updates were needed. With these changes, a mix of glob and non-glob arguments will only return the glob results (or the non-glob if no results). For example, pa11y-ci **/*.html google.com will only return the glob results (not google.com). All arguments are passed to globby to ensure cases like pa11y-ci **/*.html !foo.html return the correct results.
  • Other packages were investigated, but another viable package with nonull was not found. Even glob, which was the previous engine for globby, has removed it.
  • Package globule does appear to have that option, but hasn't had a commit in a year, so it seemed unmaintained.
  • Also looked at is-glob to check each arg, split the collection, run globby on the globs, and add back the non-globs. One, seems unnecessarily complex. Two, files (like index.html) are considered not globs, so if they matched a glob would produce a duplicate (so, would need to filter out duplicates adding more complexity).
  • This seemed like a reasonable compromise, but if this capability is important, could revert the upgrade. In that case, should probably also add tests to specifically cover that case.
• Update kleur from 4.1.4 to 4.1.5.
• Update node-fetch to from 2.6.0 to 2.7.0 (all versions after 2.7.0 are pure ESM only).
  • Node's fetch API is not stable until Node 21 (per the docs). This is only used to fetch sitemaps, but I held off since the LTS releases are still not stable.
• Update pa11y from 6.2.3 to 7.0.0.
• Update puppeteer from 9.1.1 to ^20.9.0 (to match pa11y 7.0.0, not the latest, and includes minor updates)
  • Note that puppeteer now outputs to stderr a warning about headless: true soon using new as the default. Several tests used the console output, which is a combination of both stdout and stderr, so they were updated to check stdout only.
  • After this update, was seeing some ERROR: The process "xxxx" not found. messages in stderr, so changed process.exit() calls to setting process.exitCode to allow a graceful exit here.

Dev Dependencies

• Update eslint from 7.27.0 to 8.56.0.
• Update mocha from 8.4.0 to 10.3.0.
• Update sinon from 11.1.0 to 17.0.1.

Other changes

• Update engines:node to >=18 (matching pa11y 7.0.0).
• Update actions to latest Node versions (matching pa11y 7.0.0) and unpinned Ubuntu version.
• Added keywords to package.json to help with discoverability (was empty, now matches pa11y).
• Refreshed lockfile to update all transitive dependencies.

Notes

• protocolify was not updated since all updates are pure ESM only.
• proclaim and some of its dependencies are deprecated, but it seemed like broader test updates would make more sense as part of the effort to move pa11y-ci functionality into pa11y, which already moved to jest.
• The MacOS actions have had intermittent and inconsistent test failures, but thought that might be easier to isolate by someone running locally on a Mac. I also appear to not have permissions to rerun in the parent repo, although in my fork rerunning produced a successful run.

Will close (once released) #198

[aarongoldenthal]

Thanks @danyalaytekin. I remembered you had looked at a similar flaky test on Mac issues before, but couldn't remember exactly where that was.

I reverted globby back to 6.1.0 to avoid the behavioral change, but I left the description so those details weren't lost. I don't know of a driver other than trying to update where possible to keep current.