[apify-deps]

Summary

Dependency sweep — in-range freshening (no security alert could be closed this run; all 5
are capped below their patched floor — see Flagged):

• website/pnpm-lock.yaml refreshed to newest in-range versions (Docusaurus site deps).
• markdownlint ^0.42.0 → ^0.42.1, oxlint ^1.91.0 → ^1.92.0, oxlint-tsgolint ^7.0.2005 → ^7.0.2006 (website devDependencies, in-range).
• uv.lock refresh attempted but dropped: it bumped the ty type-checker 0.0.95 → 0.0.99, which renamed a diagnostic rule and broke the type-check job across all Python versions. No Python security alert rides on it, so the freshening wasn't worth a red build.

🚩 Flagged — needs review

• minimatch 9.0.9 / 10.2.6 → 11.0.1 (medium) — CAPPED: pinned by [email protected] (declares ^9.0.5, latest 0.28.20 still declares ^10.2.5) and [email protected] (declares ~10.2.6, its latest still does). No existing override to bump; a new one is a human call. (alert #200)
• decode-uri-component 0.4.1 → 0.5.1 (high) — CAPPED by [email protected] (declares ^0.4.1; its latest 10.0.0 drops the dep entirely, a major migration), itself a dep of @apify/ui-library via @apify/docs-theme's search modal — ships in the production docs bundle. No existing override. (alert #197)
• tinypool 1.1.1 → 2.1.1 (critical) — CAPPED by @docusaurus/[email protected] (declares ^1.0.2; its latest, 3.10.2, still does). Prototype-pollution gadget to RCE, but requires a separate pollution primitive elsewhere in the tree to trigger; build-time only (not in the shipped site). No existing override. (alert #192)
• tinypool 1.1.1 → 2.1.2 (critical) — same root cause/consumer as above, second advisory. (alert #191)
• decode-uri-component 0.4.1 → 0.5.0 (medium) — same consumer/copy as alert chore: undo databind hack #197 above. (alert #176)

No related Renovate PR found for any of the above (find_related_pr.sh returned no matches).

🤖 Generated with Claude Code

[apify-deps]

🔄 sweep update: dropped the uv.lock broad refresh (ty 0.0.99 broke type-check); kept the website pnpm freshening. 0 fixed, 0 dismissed, 5 flagged (all CAPPED, no existing override).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.87%. Comparing base (347d7b2) to head (06fe065).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1240      +/-   ##
==========================================
+ Coverage   93.84%   93.87%   +0.02%     
==========================================
  Files          54       54              
  Lines        3801     3801              
==========================================
+ Hits         3567     3568       +1     
+ Misses        234      233       -1     

Flag	Coverage Δ
e2e	31.46% <ø> (ø)
integration	51.40% <ø> (+0.02%)	⬆️
unit	91.02% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[vdusek]

Superseded by #1241 (lock file maintenance), which already brought the same lockfile versions to master. Closing.

✍️ Drafted by Claude Code