[apify-deps]

Summary

Dependency sweep — in-range freshening (narrowed after CI; see note below), no alert's floor
was reachable without a new override (see Flagged below):

• filelock 4.2.9 → 4.2.10
• impit 0.15.1 → 0.15.2
• ty kept at 0.0.99 (0.0.100 renamed two ty: ignore[...] rule codes we reference in
  src/apify_client/_logging.py / tests/unit/test_pluggable_http_client.py, turning them into
  unresolved-ignore warnings that fail ty check; dropped to keep CI green)
• website/pnpm-lock.yaml broad refresh dropped entirely: it pulled in a newer @rspack/swc
  toolchain (via @docusaurus/faster) that resolves @apify/ui-library's bundled
  lodash/kebabCase import as strict ESM and fails with "Module not found" in the Docs check
  build. None of the three open alerts live in this freshening pass (they're all CAPPED, see
  Flagged below), so it wasn't worth a red build — reverted rather than chasing the resolver
  config.

✅ Dismissed (don't apply to our usage)

• minimatch (medium) — tolerable_risk: the reachable copy ([email protected], pinned to ~10.2.6, unchanged on its latest release) only parses the static glob patterns hardcoded in website/package.json's lint:md script. The advisory needs an attacker-controlled pattern string, not attacker-controlled file content; the worst case is a CI-only lint-job DoS (no code-exec/data access), and the PR workflow token is read-only. (alert #171)

🚩 Flagged — needs review

• decode-uri-component 0.4.1 → 0.5.1 (high) — CAPPED by [email protected], pulled in via @apify/[email protected] (already latest) → @apify/docs-search-modal → @apify/docs-theme. query-string's own latest major (10.0.0) drops this dependency entirely, but we don't control @apify/ui-library's dependency range — needs an upstream bump there, or a new pnpm override (risk: an 8.x→10.x jump in query-string's own API). Shipped in the docs-search bundle served to website visitors. (alert #168)
• decode-uri-component 0.4.1 → 0.5.0 (medium) — same root cause as Use old way of type-hinting for ApifyClientAsync.user #168, same consumer chain. (alert #158)

No Renovate PR currently tracks either flagged item.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.76%. Comparing base (eb8ded4) to head (5f9e73f).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1222   +/-   ##
=======================================
  Coverage   95.76%   95.76%           
=======================================
  Files          63       63           
  Lines        6676     6676           
=======================================
  Hits         6393     6393           
  Misses        283      283           

Flag	Coverage Δ
integration	91.25% <ø> (+0.58%)	⬆️
unit	91.07% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.