Command palette listbox and combobox ARIA is invalid when open

[bpmore]

Bug description

The command palette (Cmd/Ctrl+K) gets the hard parts right — role="dialog", focus moved inside, the rest of the page inert, Escape closes — but the combobox and listbox inside it are not valid ARIA. Four Level A violations fire the moment it opens.

axe-core on the open palette:

Rule	Impact	Detail
aria-required-children	critical	role="listbox" contains a <footer>
aria-required-attr	critical	role="combobox" has no usable aria-controls
aria-input-field-name	serious	the listbox has no accessible name
scrollable-region-focusable	serious	the results viewport scrolls but cannot take focus

Offending elements:

<input role="combobox" aria-expanded="true" aria-controls="" aria-autocomplete="list"
       placeholder="Search or jump to...">

<div role="listbox" aria-orientation="vertical" aria-multiselectable="false"
     id="reka-combobox-content-…" tabindex="-1">

<div class="max-h-[360px] min-h-[360px] overflow-y-auto" data-reka-combobox-viewport role="presentation">

The dialog also has no aria-modal="true":

https://github.com/statamic/cms/blob/v6.31.0/resources/js/components/command-palette/CommandPalette.vue#L302

Because the palette is the primary keyboard navigation affordance in the CP, this is the one place where broken ARIA hurts keyboard-first users most.

WCAG 2.1 SC 4.1.2 Name, Role, Value (Level A). The scrollable region is SC 2.1.1 Keyboard.

How to reproduce

1. composer create-project statamic/statamic, log in
2. Press Cmd+K (or Ctrl+K)
3. Run axe-core against the page with the palette open, or inspect the elements above

Suggested fix

• Move the <footer> outside ComboboxContent so the role="listbox" element only contains option/group children, and give the listbox an accessible name.
• The aria-required-attr failure is the empty aria-controls reported in aria-controls is emitted as an empty string on comboboxes, popovers and date pickers #15400, not a separate defect. Fixing that fixes this too.
• Add aria-modal="true" to the dialog.
• Put tabindex="0" on the scrollable results viewport so keyboard users can scroll it.

Related: the empty aria-controls here is the same defect reported separately for comboboxes and popovers.

Environment

Environment
Laravel Version: 13.30.1
PHP Version: 8.4.23
Composer Version: 2.10.2
Environment: local
Debug Mode: ENABLED
Maintenance Mode: OFF
Timezone: UTC
Locale: en

Cache
Config: NOT CACHED
Events: NOT CACHED
Routes: NOT CACHED
Views: CACHED

Drivers
Broadcasting: log
Cache: file
Database: sqlite
Logs: stack / single
Mail: log
Queue: sync
Session: file

Storage
public/storage: NOT LINKED

Statamic
Addons: 0
License Key: Not set
Sites: 1
Stache Watcher: Enabled (auto)
Static Caching: Disabled
Version: 6.31.0 PRO

Installation

Fresh statamic/statamic site via CLI

Additional details

Found during a WCAG 2.1 AA audit of a vanilla composer create-project statamic/statamic install with no addons and no custom code. Tested with axe-core 4.x on Chromium 153 at 1440x1000, plus manual keyboard traversal. Source references point at v6.31.0.

---

Correction (see comment below): I originally described the aria-required-children failure as an empty listbox and aria-required-attr as an unnamed missing attribute. Both were imprecise; the table and suggested fixes above have been updated with axe's actual output.

[bpmore]

Correction: I re-ran axe against the open palette and captured the actual failureSummary text for each violation. Two of my descriptions above were imprecise, and one of them changes what needs fixing. I've updated the issue body to match.

1. aria-required-children — I said "no option children". It's actually a <footer> inside the listbox.

Fix any of the following: Element has children which are not allowed: footer

The <footer> with the keyboard-hint row is rendered inside ComboboxContent, which is the element carrying role="listbox":

https://github.com/statamic/cms/blob/v6.31.0/resources/js/components/command-palette/CommandPalette.vue#L331
https://github.com/statamic/cms/blob/v6.31.0/resources/js/components/command-palette/CommandPalette.vue#L374

So the fix is to move the footer outside ComboboxContent rather than to change how the listbox is applied. This one is Statamic's markup, not reka-ui's.

2. aria-required-attr — I said "missing a required attribute" without naming it. It is aria-controls.

Fix any of the following: Required ARIA attribute not present: aria-controls

<input role="combobox" aria-expanded="true" aria-controls="" aria-autocomplete="list" placeholder="Search or jump to...">

The attribute is present but empty, which axe treats as absent. That makes this the same root cause as #15400, which I traced to reka-ui initialising contentId: "". Not a separate defect — fixing #15400 clears this one.

The other two violations stand as reported:

aria-input-field-name       listbox has no aria-label / aria-labelledby / title
scrollable-region-focusable viewport should have focusable content or be focusable

Net: of the four, one is Statamic's markup (the footer), one is the listbox name, one is the scroll viewport, and one is really #15400.