[apify-deps]

Summary

Dependency sweep — in-range freshening (no security alert could be resolved in-range this run; see 🚩 below):

• apify-client ^2.25.0 → ^2.26.0
• broad pnpm update -r lockfile refresh (transitive/peer patch+minor bumps: vite 8.3.6→8.3.7, ws 8.22.1→8.22.2, axios 1.21.0→1.21.1, follow-redirects 1.16.2→1.16.3, js-yaml 5.4.2→5.5.0, fingerprint-generator/header-generator/generative-bayesian-network/fingerprint-injector 2.1.89→2.1.90, stream-chain 4.4.1→4.4.2, lilconfig 3.1.4→3.1.5, rolldown 1.2.16→1.2.18, postcss-selector-parser 7.1.7→7.2.0, ansi-regex 6.5.0→6.6.0, cssesc/argparse churn)

🧹 Overrides audited (kept — still doing their job)

• [email protected]>@crawlee/core|types|utils pin to 4.0.0-beta.25 — still mirrors the Sitemap Extractor's own direct pin (packages/actor-scraper/sitemap-scraper/package.json); not stale.
• js-yaml: ^5.0.0 — still needed: [email protected] (via commitlint) declares js-yaml: ^4.1.0 on its own and would resolve back to a 4.x line without this override.

🚩 Flagged — needs review

• undici 7.29.0 → 7.30.1 (high/medium/low across 11 advisories) — CAPPED by [email protected], which pins undici to the exact version 7.29.0; fix requires bumping nx 23.3.1 → 24.0.6 (semver-major, pulled in transitively via [email protected] → @nx/[email protected], not a direct dep we can bump in isolation). No tracking Renovate PR currently open. (alert #331, #332, #333, #334, #339, #340, #393, #397, #399, #401, #402)
• minimatch 9.0.9/10.2.5/10.2.6 → 11.0.1 (medium) — CAPPED by multiple independent consumers in the nx/lerna/npm-tooling graph: @crawlee/[email protected] declares ^9.0.0 (its latest 3.x line); [email protected], @nx/[email protected] and [email protected] each pin minimatch to exactly 10.2.5/10.2.6 internally; @npmcli/arborist, @npmcli/map-workspaces, @tufjs/models, ignore-walk only reach 10.2.6 within their own declared ranges; [email protected] (declares ^10.2.2) could individually be bumped to 14.0.4 (declares ^11.0.5) but that alone wouldn't clear the other pinned copies. No single in-range action resolves this — needs the nx/lerna majors above. No tracking Renovate PR currently open. (alert #405)
• stream-json 1.9.1 → 3.5.0/3.6.0 (medium) — CAPPED by @crawlee/[email protected], exact-pinned by the Sitemap Extractor's intentional crawlee v4-beta stack (packages/actor-scraper/sitemap-scraper/package.json + the matching pnpm-workspace.yaml override). A patched stream-json (^3.8.0) ships from @crawlee/[email protected] onward (now even 4.0.0-rc.1), but moving off beta.25 means advancing that whole pinned pre-release stack ~255 beta revisions — a deliberate, reviewed migration, not an in-range resolve. → tracked by chore(deps): update sitemap crawlee v4 beta stack #354. (alert #321, #371, #372)

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML; Path: .coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8cfd5e57-e40e-45bc-8df3-e8eb4f1215a0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts