[apify-deps]

Summary

Dependency sweep — in-range freshening of the docs website/ pnpm workspace. No security patch
could be applied in-range this run; all 3 open alerts are capped by a transitive consumer already
at its own latest version (flagged below).

• website/: broad pnpm refresh — markdownlint ^0.42.0 → ^0.42.1, oxlint ^1.91.0 → ^1.93.0,
  oxlint-tsgolint ^7.0.2005 → ^7.0.2006, plus the Algolia/oxlint-binding transitive set moved to
  their newest in-range versions.
• @apify/ui-library kept at 1.176.0 (the refresh would have moved it to 1.176.1, its "latest",
  but that version breaks the docs build — Module not found: Can't resolve 'lodash/kebabCase' in
  @apify/ui-library/dist/utils, confirmed in this PR's own CI. A fix is already in flight upstream
  as a prerelease, 1.176.2-fixuilibrarykebabcaseesm-ec9658.44). Unrelated to the alerts below.
• The root uv.lock refresh was dropped from this PR: it bumped ty 0.0.99 → 0.0.100 (dev-tooling
  only, not alert-related), which renamed the unresolved-attribute lint rule to
  missing-attribute and broke every existing # ty: ignore[unresolved-attribute] comment in the
  test suite (confirmed red in this PR's own CI). Since no open alert needs a Python-side fix, that
  freshening wasn't worth a red build and was reverted; uv.lock is unchanged in this PR.

🚩 Flagged — needs review

• minimatch 9.0.9 (medium) — CAPPED by [email protected] (declares ^9.0.5), itself the newest
  version allowed by @apify/[email protected]'s ^0.26.11 range (that plugin
  is already on its own latest, 5.1.16). Even typedoc's own latest (0.28.20) still only reaches
  minimatch ^10.2.5 — short of the 11.0.1 floor — so this needs a plugin update that adopts a newer
  typedoc major, not just an in-range bump. Fix requires an upstream/plugin change. (alert #200)
• minimatch 10.2.6 (medium) — CAPPED by [email protected] (declares ~10.2.6), which is
  already our locked latest — no newer markdownlint-cli release exists yet to pick up a patched
  minimatch. Needs an upstream markdownlint-cli release or a new override. (alert #200)
• decode-uri-component 0.4.1 (high + medium) — CAPPED by [email protected] (declares ^0.4.1),
  the newest version allowed by @apify/[email protected]'s own ^8.1.0 dependency on
  query-string. query-string only bumped decode-uri-component to ^0.5.0 starting with its
  9.x major, which is outside ui-library's declared range — needs ui-library to adopt query-string
  9.x, or a new override. (alert #197, alert #176)
• ty 0.0.99 → 0.0.100 (dev-tooling, not a security alert) — in-range but reverted: breaks
  # ty: ignore[unresolved-attribute] comments across the test suite (rule renamed to
  missing-attribute in 0.0.100). Needs a source change (updating every ty: ignore comment) to
  take safely — left for a follow-up, not bundled into this sweep.

No matching Renovate PR found for any of the above.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.93%. Comparing base (9811f1a) to head (805dec1).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1247   +/-   ##
=======================================
  Coverage   93.93%   93.93%           
=======================================
  Files          54       54           
  Lines        3828     3828           
=======================================
  Hits         3596     3596           
  Misses        232      232           

Flag	Coverage Δ
e2e	31.24% <ø> (ø)
integration	51.01% <ø> (ø)
unit	91.14% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.