[apify-deps]

Summary

Dependency sweep — security bumps + in-range freshening (in range):

• apify-client ^2.25.0 → ^2.26.0
• semver ~7.8.5 → ~7.8.6
• rimraf ~6.1.3 → ~6.1.4 (root and website/)
• tsdown ^0.23.4 → ^0.23.5
• vitest ^5.0.5 → ^5.1.0
• plus deep transitive/peer refresh across pnpm-lock.yaml (no manifest changes beyond the above)

⏸ Held back (new override, CI-gated)

• @apify/ui-library — the refresh resolved this to 1.176.1, which broke the website build
  (Module not found: Can't resolve 'lodash/kebabCase' in check.yaml's Docs build job) even
  though it declares the same lodash range as 1.176.0. Added a pnpm-workspace.yaml override
  pinning it back to the last known-good 1.176.0 so the rest of the freshening could stay green;
  not a security fix, just a revert of an opportunistic bump CI rejected. Safe to drop once a newer
  @apify/ui-library release fixes the build.

✅ Dismissed (don't apply to our usage)

• basic-ftp (high) — not_used: get-uri's FTP handler (and thus basic-ftp's vulnerable Client.list()) only runs for ftp:///pac+ftp:// proxy URLs. apify-client's ProxyAgent and Apify Proxy are HTTP(S)/SOCKS only; apify-cli never constructs an ftp-scheme proxy URL. (alert #286)
• tinypool (critical) — not_used: @docusaurus/core's ssgExecutor.js calls pool.run(task) with no options argument — GHSA-85c8 only triggers when the caller passes an options object to run(). Upstream closed the combined CVE issue as a build-only dep with no real threat (meta/docusaurus#12584). (alert #287)
• tinypool (critical) — tolerable_risk: this one (GHSA-5gmw, prototype-polluted execArgv/env) doesn't depend on the run() call site, but tinypool here only powers docusaurus's static-site generation, triggered solely by our docs workflow on push to master (no PR/fork-content exposure — see pr_preview.yaml/docs.yaml). Exploiting it also requires an unrelated Object.prototype pollution primitive already present elsewhere in the tree. Same upstream closure as above: meta/docusaurus#12584. (alert #288)

🚩 Flagged — needs review

• minimatch 9.0.9/10.2.6 → 11.0.1 (medium) — CAPPED by two separate consumers: @crawlee/[email protected] declares ^9.0.0 (its latest, 3.18.2, is unchanged — needs an upstream crawlee bump or a new override); [email protected] (via [email protected], our latest-available archiver) declares ^10.2.2 — the fix is readdir-glob 3→4 (major), but [email protected] (npm's latest) still pins readdir-glob: ^3.0.0, so that needs an upstream archiver bump or a new override, not an in-range move. (alert #301)
• decode-uri-component 0.4.1 → 0.5.1 (high) — CAPPED by [email protected] declaring ^0.4.1 (only reachable via @apify/docs-search-modal → @apify/docs-theme, bundled client-side into the docs website search UI — not safely dismissible, since a crafted shareable search URL could reach it in a visitor's browser). query-string's latest, 10.0.0, drops the dependency entirely, but that's a major jump our own code doesn't control directly (transitive via @apify/ui-library) — needs an upstream bump of @apify/docs-search-modal/@apify/ui-library or a new override. (alert #296)
• decode-uri-component 0.4.1 → 0.5.0 (medium) — same root cause and same fix as the alert above. (alert #281)

No related Renovate PRs were found for any of the above (minimatch, decode-uri-component, query-string, readdir-glob, crawlee).

🤖 Generated with Claude Code