[apify-deps]

Summary

Dependency sweep — security bumps + in-range freshening:

• follow-redirects 1.16.0 → 1.16.2 (high)
• postcss-selector-parser → 7.1.7 (high)
• fast-uri → 3.1.9 (high/medium/low, several ranges)
• @vitest/mocker → 4.1.12 (medium)
• smol-toml → 1.9.0 (medium/high)
• source-map-js → 1.2.2 (high)
• nx 23.1.x/23.2.x → 23.3.1 (high/medium)
• axios → 1.21.0 (high/medium, several ranges)
• ip-address → 10.7.6 (medium)
• brace-expansion → 2.1.7 / 5.0.12 (medium)
• adm-zip → 0.6.1 (high/medium)
• general in-range minor/patch freshening across the workspace (crawlee 3.18.0 → 3.18.2, apify-client, lerna, tsx, typescript, vitest, lint-staged, …)

🧹 Pruned overrides (no longer needed)

• vite — no-op: vite-tsconfig-paths/vitest already resolve 8.3.6 without forcing it.
• postcss — no-op: resolves to 8.5.32 via vite without forcing it.
• tar — no-op: [email protected] (already on the major this override was added for) now pulls 7.5.22 on its own.
• Kept js-yaml: removing it still splits into two copies (4.3.2 via cosmiconfig/commitlint, 5.4.2 via lerna) — neither vulnerable, but the override still does real unifying work, so it's not a no-op.

🚩 Flagged — needs review

• minimatch 9.0.9/10.2.5/10.2.6 → 11.0.1 (medium) — CAPPED by multiple consumers whose latest release still declares a pre-floor range: @crawlee/[email protected] (^9.0.0), @crawlee/[email protected] (^10.0.1), @npmcli/[email protected], @npmcli/[email protected], @nx/[email protected], @tufjs/[email protected], [email protected], [email protected] (all ^10.0.3/10.2.6), [email protected] (10.2.5) — needs an override or an upstream bump from each. (alert #405)
• undici 7.29.0 → 7.30.1 (high/medium/low, 18 alerts: #402 #401 #399 #397 #395 #393 #391 #389 #340 #339 #337 #335 #334 #333 #332 #331 #330 #329) — CAPPED by [email protected], which pins undici to exactly 7.29.0. Fix needs nx 23.3.1 → 24.0.5 (semver-major) — not attempted in-range.
• stream-json 1.9.1 → 3.6.0 (medium, #372 #371 #321) — CAPPED by @crawlee/[email protected] (^1.9.1), the deliberate Crawlee v4-beta pin used only by sitemap-scraper (see the overrides: comment in pnpm-workspace.yaml). The only in-range fix is dropping back to @crawlee/[email protected] (~3.7.0), which would undo that intentional beta adoption — needs a human call, not a mechanical bump. → tracked by chore(deps): update sitemap crawlee v4 beta stack #354

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML; Path: .coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 19be5d38-3d33-4592-89f6-1635a233a788

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts