chore(deps): update sitemap crawlee v4 beta stack by renovate[bot] · Pull Request #354 · apify/actor-scraper

renovate · 2026-08-08T18:33:31Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@crawlee/core (source)	`4.0.0-beta.25` → `4.0.0-rc.1`
@crawlee/http (source)	`4.0.0-beta.25` → `4.0.0-rc.1`
@crawlee/impit-client (source)	`4.0.0-beta.29` → `4.0.0-rc.1`
@crawlee/types (source)	`4.0.0-beta.25` → `4.0.0-rc.1`
@crawlee/utils (source)	`4.0.0-beta.25` → `4.0.0-rc.1`
apify (source)	`4.0.0-beta.12` → `4.0.0-rc.0`
[email protected]>@crawlee/core (source)	`4.0.0-beta.25` → `4.0.0-rc.1`
[email protected]>@crawlee/types (source)	`4.0.0-beta.25` → `4.0.0-rc.1`
[email protected]>@crawlee/utils (source)	`4.0.0-beta.25` → `4.0.0-rc.1`

Release Notes

apify/crawlee (@crawlee/core)

`v4.0.0-rc.1`

Compare Source

Breaking since rc.0

@crawlee/jsdom and @crawlee/linkedom moved out of the monorepo (#4119)
Crawler-only code moved from @crawlee/core to @crawlee/basic, more internals made private (#4117, #4036, #4060)
Input handling moved to the Apify SDK, requires apify >= 4.0.0-beta.40 (#4155)
The request queue is no longer emptied between run() calls (#4056)
Statistics renames, IRequestManager / IBrowserPool contract updates (#4109, #4061, #4161)

New

DomCrawler with a pluggable DOM parser (#4104)
OpenTelemetry instrumentation via @crawlee/otel (#3361)
skipRequest and afterCommit context helpers (#4158, #4110), initialConcurrency option (#4067), extractMicrodata helper (#3233)

Fixes

HTTP redirect handling for credentials, cookies and request bodies (#4137, #4154, #4136), Cloudflare challenge detection (#4170), a robots.txt 404 now means allow-all (#4171), and more.

Upgrading guide: https://crawlee.dev/js/docs/next/upgrading/upgrading-to-v4

Full Changelog: apify/crawlee@v4.0.0-rc.0...v4.0.0-rc.1

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- "every weekday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

## Summary Dependency sweep — security bumps + in-range freshening: - `follow-redirects` 1.16.0 → 1.16.2 (high) - `postcss-selector-parser` → 7.1.7 (high) - `fast-uri` → 3.1.9 (high/medium/low, several ranges) - `@vitest/mocker` → 4.1.12 (medium) - `smol-toml` → 1.9.0 (medium/high) - `source-map-js` → 1.2.2 (high) - `nx` 23.1.x/23.2.x → 23.3.1 (high/medium) - `axios` → 1.21.0 (high/medium, several ranges) - `ip-address` → 10.7.6 (medium) - `brace-expansion` → 2.1.7 / 5.0.12 (medium) - `adm-zip` → 0.6.1 (high/medium) - general in-range minor/patch freshening across the workspace (crawlee 3.18.0 → 3.18.2, apify-client, lerna, tsx, typescript, vitest, lint-staged, …) ## 🧹 Pruned overrides (no longer needed) - `vite` — no-op: `vite-tsconfig-paths`/`vitest` already resolve `8.3.6` without forcing it. - `postcss` — no-op: resolves to `8.5.32` via `vite` without forcing it. - `tar` — no-op: `[email protected]` (already on the major this override was added for) now pulls `7.5.22` on its own. - Kept `js-yaml`: removing it still splits into two copies (`4.3.2` via `cosmiconfig`/commitlint, `5.4.2` via `lerna`) — neither vulnerable, but the override still does real unifying work, so it's not a no-op. ## 🚩 Flagged — needs review - `minimatch` `9.0.9`/`10.2.5`/`10.2.6` → `11.0.1` (medium) — CAPPED by multiple consumers whose latest release still declares a pre-floor range: `@crawlee/[email protected]` (`^9.0.0`), `@crawlee/[email protected]` (`^10.0.1`), `@npmcli/[email protected]`, `@npmcli/[email protected]`, `@nx/[email protected]`, `@tufjs/[email protected]`, `[email protected]`, `[email protected]` (all `^10.0.3`/`10.2.6`), `[email protected]` (`10.2.5`) — needs an override or an upstream bump from each. ([alert #405](https://github.com/apify/actor-scraper/security/dependabot/405)) - `undici` `7.29.0` → `7.30.1` (high/medium/low, 18 alerts: [#402](https://github.com/apify/actor-scraper/security/dependabot/402) [#401](https://github.com/apify/actor-scraper/security/dependabot/401) [#399](https://github.com/apify/actor-scraper/security/dependabot/399) [#397](https://github.com/apify/actor-scraper/security/dependabot/397) [#395](https://github.com/apify/actor-scraper/security/dependabot/395) [#393](https://github.com/apify/actor-scraper/security/dependabot/393) [#391](https://github.com/apify/actor-scraper/security/dependabot/391) [#389](https://github.com/apify/actor-scraper/security/dependabot/389) [#340](https://github.com/apify/actor-scraper/security/dependabot/340) [#339](https://github.com/apify/actor-scraper/security/dependabot/339) [#337](https://github.com/apify/actor-scraper/security/dependabot/337) [#335](https://github.com/apify/actor-scraper/security/dependabot/335) [#334](https://github.com/apify/actor-scraper/security/dependabot/334) [#333](https://github.com/apify/actor-scraper/security/dependabot/333) [#332](https://github.com/apify/actor-scraper/security/dependabot/332) [#331](https://github.com/apify/actor-scraper/security/dependabot/331) [#330](https://github.com/apify/actor-scraper/security/dependabot/330) [#329](https://github.com/apify/actor-scraper/security/dependabot/329)) — CAPPED by `[email protected]`, which pins `undici` to exactly `7.29.0`. Fix needs `nx` `23.3.1` → `24.0.5` (semver-major) — not attempted in-range. - `stream-json` `1.9.1` → `3.6.0` (medium, [#372](https://github.com/apify/actor-scraper/security/dependabot/372) [#371](https://github.com/apify/actor-scraper/security/dependabot/371) [#321](https://github.com/apify/actor-scraper/security/dependabot/321)) — CAPPED by `@crawlee/[email protected]` (`^1.9.1`), the deliberate Crawlee v4-beta pin used only by `sitemap-scraper` (see the `overrides:` comment in `pnpm-workspace.yaml`). The only in-range fix is dropping back to `@crawlee/[email protected]` (`~3.7.0`), which would undo that intentional beta adoption — needs a human call, not a mechanical bump. → tracked by #354 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: apify-deps[bot] <4649591+apify-deps[bot]@users.noreply.github.com>

renovate Bot force-pushed the renovate/sitemap-crawlee-v4-beta-stack branch 7 times, most recently from 88ab44c to 90e956c Compare August 13, 2026 15:17

renovate Bot force-pushed the renovate/sitemap-crawlee-v4-beta-stack branch 5 times, most recently from 2bb336b to 5a782f6 Compare August 28, 2026 12:19

renovate Bot force-pushed the renovate/sitemap-crawlee-v4-beta-stack branch 9 times, most recently from 45624a9 to 67d46d4 Compare September 7, 2026 19:57

renovate Bot force-pushed the renovate/sitemap-crawlee-v4-beta-stack branch 5 times, most recently from 76067c7 to e5aaf42 Compare September 15, 2026 10:25

renovate Bot force-pushed the renovate/sitemap-crawlee-v4-beta-stack branch 4 times, most recently from b327e87 to ed0daa5 Compare September 21, 2026 16:52

renovate Bot force-pushed the renovate/sitemap-crawlee-v4-beta-stack branch 11 times, most recently from 34d7cdb to 766a290 Compare October 13, 2026 13:30

renovate Bot force-pushed the renovate/sitemap-crawlee-v4-beta-stack branch from 766a290 to 4d495b5 Compare October 16, 2026 10:51

renovate Bot force-pushed the renovate/sitemap-crawlee-v4-beta-stack branch 7 times, most recently from c8ebb78 to 3b7c975 Compare November 2, 2026 13:50

renovate Bot force-pushed the renovate/sitemap-crawlee-v4-beta-stack branch 2 times, most recently from 2542d2b to 8688d2a Compare November 7, 2026 03:09

apify-deps Bot mentioned this pull request Nov 9, 2026

chore(deps): security + in-range lockfile refresh #392

Merged

renovate Bot force-pushed the renovate/sitemap-crawlee-v4-beta-stack branch from 8688d2a to a0c1bb0 Compare November 9, 2026 13:58

renovate Bot force-pushed the renovate/sitemap-crawlee-v4-beta-stack branch 2 times, most recently from 9794bc8 to 84a5437 Compare November 9, 2026 15:55

chore(deps): update sitemap crawlee v4 beta stack

5d23682

renovate Bot enabled auto-merge (squash) November 10, 2026 13:50

renovate Bot force-pushed the renovate/sitemap-crawlee-v4-beta-stack branch from 84a5437 to 5d23682 Compare November 10, 2026 13:50

apify-deps Bot mentioned this pull request Nov 11, 2026

chore(deps): security + in-range lockfile refresh #398

Open

Navigation Menu

Repository navigation

chore(deps): update sitemap crawlee v4 beta stack - #354

chore(deps): update sitemap crawlee v4 beta stack#354
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/sitemap-crawlee-v4-beta-stack

renovate Bot commented Aug 8, 2026 •

edited

Loading

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Aug 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Breaking since rc.0

New

Fixes

Configuration

Uh oh!

Reviewers

renovate Bot commented Aug 8, 2026 •

edited

Loading