UPSTREAM FIX

magento2-39164: Accessibility: WAI-ARIA roles nesting wrong in menu

Community fix magento2-39164 merged into magento/magento2 on 2025-04-16, released in 2.4.9; applies cleanly to 33 releases from 2.4.6 to 2.4.8-p5.

Pull request title: Accessibility: WAI-ARIA roles nesting wrong in menu
Pull request: magento/magento2#39164
Issues: #35889 human, #39054 human
Author: @Serfe-com
Merged: 2025-04-16
Fixed in: 2.4.9
Reported on: 2.4.7-p1
Categories: —
Components: magento/magento2-base, magento/module-theme

Labels

Area: Other Developer Tools
Component: Developer
Priority: P2
Severity: —
Reported on (labels): 2.4.7-p1

Issue

Title and steps come from the upstream issue and pull request.

Description

<ul role="menu">
 <li>
  <a href="" role="menuitem">link</a>
 </li>
</ul>

Steps to reproduce

Navigate to storeview
analyze html code of menu for correct ARIA markup

Expected result

Menu should be structured according to ARIA schema the following way:

<ul role="menu">
 <li role="none">
  <a href="" role="menuitem">link</a>
 </li>
</ul>

Actual result

<ul role="menu">
 <li>
  <a href="" role="menuitem">link</a>
 </li>
</ul>

As the li tag has no role, the child element for the menu role is missing and the parent element for the menuitem role is missing.

Users who rely on accessibility tools might run into a deadend here.

Taken from the upstream issue.

Code match per tag

Each tag was checked with git apply --check against that tag's files. A clean match means the change applies; it is not a test result. Tags that already contain the fix are marked.

Line	Code match per tag	Tests
2.4.6	2.4.6 clean 2.4.6-p1 clean 2.4.6-p2 clean 2.4.6-p3 clean 2.4.6-p4 clean 2.4.6-p5 clean 2.4.6-p6 clean 2.4.6-p7 clean 2.4.6-p8 clean 2.4.6-p9 clean 2.4.6-p10 clean 2.4.6-p11 clean 2.4.6-p12 clean 2.4.6-p13 clean 2.4.6-p14 clean 2.4.6-p15 clean	2.4.6: no test data 2.4.6-p1: no test data 2.4.6-p2: no test data 2.4.6-p3: no test data 2.4.6-p4: no test data 2.4.6-p5: no test data 2.4.6-p6: no test data 2.4.6-p7: no test data 2.4.6-p8: no test data 2.4.6-p9: no test data 2.4.6-p10: no test data 2.4.6-p11: no test data 2.4.6-p12: no test data 2.4.6-p13: no test data 2.4.6-p14: no test data 2.4.6-p15: no test data
2.4.7	2.4.7 clean 2.4.7-p1 clean 2.4.7-p2 clean 2.4.7-p3 clean 2.4.7-p4 clean 2.4.7-p5 clean 2.4.7-p6 clean 2.4.7-p7 clean 2.4.7-p8 clean 2.4.7-p9 clean 2.4.7-p10 clean	2.4.7: no test data 2.4.7-p1: no test data 2.4.7-p2: no test data 2.4.7-p3: no test data 2.4.7-p4: no test data 2.4.7-p5: no test data 2.4.7-p6: no test data 2.4.7-p7: no test data 2.4.7-p8: no test data 2.4.7-p9: no test data 2.4.7-p10: no test data
2.4.8	2.4.8 clean 2.4.8-p1 clean 2.4.8-p2 clean 2.4.8-p3 clean 2.4.8-p4 clean 2.4.8-p5 clean	2.4.8: no test data 2.4.8-p1: no test data 2.4.8-p2: no test data 2.4.8-p3: no test data 2.4.8-p4: no test data 2.4.8-p5: no test data
2.4.9	2.4.9 conflictcontains the fix	2.4.9: no test data

Triage

Model @cf/cloudflare/clef. Probability this is a bug fix: 90.7%. Probability it is security relevant: 1.0%.

Show the model's answers and probabilities

Question	Answer	Probabilities	Confidence
Change kind	bugfix	bugfix 94.6%, refactor 2.4%, feature 1.2%, dependency 0.7%, tests_only 0.6%, docs_only 0.6%	87.5%
Area	frontend	frontend 95.0%, other 1.3%, framework 1.0%	88.8%
Reported version	2.4.7-p1	2.4.7-p1 43.8%, 2.4.4 9.4%, 2.4.7 4.8%	19.6%
Scope	0.95 of 2	1 50.7%, 0 27.1%, 2 22.2%	6.9%
Risk	0.64 of 2	1 59.8%, 0 37.9%, 2 2.3%	25.2%
Worth backporting	1.26 of 2	2 47.9%, 1 29.9%, 0 22.1%	5.3%

Download

For cweagans/composer-patches, choose a version below and download the bundle. Copy its magento2-39164/ folder into patches/composer/, merge composer.patches.json into composer.json, then run composer install. Test files are always removed; paths are relative to each package root, using the default -p1 level.

Bundle README (what the ZIP ships)

# magento2-39164

Community fix merged upstream into magento/magento2, adapted by magento.watch.
This is not a patch published by Adobe.

Pull request: https://github.com/magento/magento2/pull/39164
Issue: https://github.com/magento/magento2/issues/35889
Issue: https://github.com/magento/magento2/issues/39054
Author: @Serfe-com
Source commit: 1d66940e34d99d90547deaa636fdaa05bbfeb0c1
Modifications: test files and documentation removed, paths rewritten relative to each Composer package.
Licence: OSL-3.0 / AFL-3.0, as the original Magento Open Source code.
Maintainer: Łukasz Bajsarowicz (@lbajsarowicz)

Licence: Magento Open Source code under OSL-3.0 and AFL-3.0. The bundle carries the original author, source commit and the list of modifications.