[apify-deps]

Summary

Dependency sweep — in-range freshening only (no in-range security fix was reachable for any open
alert this run):

• impit-node: pnpm update -r freshening — vitest 5.0.5 → 5.1.0, @napi-rs/cli 3.10.9 → 3.10.12,
  @napi-rs/lzma 1.5.1 → 1.5.3, @napi-rs/tar 1.1.1 → 1.1.3, @napi-rs/wasm-tools 1.1.0 → 1.1.2,
  ip-address 10.7.5 → 10.7.6, semver 7.8.5 → 7.8.6, and matching @emnapi/*/@vitest/* peers
  (deep transitives, no manifest range change beyond the two direct devDependencies above).
• The root Cargo.lock (cargo workspace) has no toolchain available on this runner for a broad
  cargo update; none of its open alerts had an in-range fix available anyway (see Flagged below).

🚩 Flagged — needs review

• rustls 0.23.45 → 0.23.46 (low, GHSA-w44r-93j7-qv28) — this repo vendors rustls via
  [patch.crates-io] pinned to a specific commit of our own fork (apify/rustls impit-main,
  needed for the custom TLS-fingerprinting impit feature), not the crates.io release. The pinned
  commit (2026-10-15) predates upstream's 0.23.46 security fix (2026-10-27); the fork's impit-main
  branch hasn't merged that release yet, so there is no existing fork commit to bump to. impit enables
  session resumption (impit/src/tls/mod.rs), so this ServerHello key-share-prediction issue is
  reachable, not just theoretical. Fixing it requires merging upstream v0.23.46 into
  apify/rustls's impit-main first (out of scope for this repo-only sweep) and then bumping the
  pinned rev here. (alert #135)
• rustls 0.23.45 → 0.23.46 (low, GHSA-h2v8-394m-p7vv) — same forked-dependency
  situation as above. The vendored rustls is built with its brotli/brotli-decompressor cert-
  decompression dependencies compiled in, and impit is an HTTP client that connects to arbitrary
  external servers, so the attacker-controlled-allocation path is reachable. Same remediation path as
  Response.text() returns String objects instead of primitive strings #135: needs apify/rustls's impit-main updated to merge v0.23.46 first.
  (alert #133)
• minimatch 10.2.6 → 11.0.1 (medium, GHSA-g3hv-75wg-m249) — transitive dev dependency of
  typedoc (used only by impit-node's pnpm run docs / docs.yaml CI job). typedoc's latest
  (0.28.20) still declares minimatch: ^10.2.5, capping it below the patched floor in-range
  (CAPPED) — reaching 11.0.1 needs a new pnpm-workspace.yaml override, which this sweep
  doesn't add unilaterally. Note on reachability: the glob-DoS needs an attacker-controlled pattern,
  and docs.yaml runs on pull_request and builds docs from the PR's own tsconfig.docs.json, so a
  malicious fork PR could in principle supply such a pattern — but the blast radius is limited to a
  CI build-job CPU/memory DoS (no code-exec, no data access). Pinned by [email protected].
  (alert #137)

No open Renovate PR was found tracking any of the three packages above.

🤖 Generated with Claude Code