Skip to content

chore(deps): dependency sweep — website lockfile freshening - #1113

Open
apify-deps[bot] wants to merge 1 commit into
masterfrom
chore/deps-sweep
Open

chore(deps): dependency sweep — website lockfile freshening#1113
apify-deps[bot] wants to merge 1 commit into
masterfrom
chore/deps-sweep

Conversation

@apify-deps

@apify-deps apify-deps Bot commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

Summary

Dependency sweep — in-range lockfile freshening (within existing ranges):

  • website/pnpm-lock.yaml re-resolved to newest in-range versions (pnpm update -r --lockfile-only); oxlint ^1.80.0^1.81.0 (in-range devDependency bump).

✅ Dismissed (don't apply to our usage)

  • qs (medium) — tolerable_risk: pulled in only via webpack-dev-serverexpressbody-parser, exercised solely by docusaurus start (local interactive dev server). No CI/build/release workflow in this repo runs start (build/release use docusaurus build), so no PR-authored/CI content ever reaches it; exploiting either qs DoS also needs direct network access to a developer's local dev server. (alert #177, alert #178)

🚩 Flagged — needs review

  • decode-uri-component 0.4.10.5.0 (medium) — new override needed. Pulled in by query-string@8.2.0 (declared range ^0.4.1, excludes the 0.5.0 patch) via @apify/ui-library (currently 1.164.8, still on query-string ^8.1.0 in its latest release). Fixing in-range requires @apify/ui-library to ship on query-string@9.5.0+ (where the range becomes ^0.5.0) — that's a major bump of a transitive dep we don't control, not a safe unilateral override, and @apify/docs-theme/@apify/ui-library are runtime (prod) dependencies of the live docs site's search modal, so this is a real user-input path, not dev-only. No tracking Renovate PR found. (alert #176)

🤖 Generated with Claude Code

Re-resolve website/pnpm-lock.yaml to the newest in-range versions (pnpm
update -r --lockfile-only). No declared ranges changed except an
in-range devDependency bump (oxlint ^1.80.0 -> ^1.81.0).
@apify-deps apify-deps Bot added the adhoc Ad-hoc unplanned task added during the sprint. label Sep 7, 2026
@apify-deps
apify-deps Bot requested a review from B4nan September 7, 2026 01:19
@codecov

codecov Bot commented Sep 7, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.75%. Comparing base (d778ba3) to head (4707167).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #1113      +/-   ##
==========================================
+ Coverage   92.69%   92.75%   +0.05%     
==========================================
  Files          53       53              
  Lines        3519     3519              
==========================================
+ Hits         3262     3264       +2     
+ Misses        257      255       -2     
Flag Coverage Δ
e2e 32.73% <ø> (ø)
integration 53.33% <ø> (ø)
unit 89.34% <ø> (+0.05%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

adhoc Ad-hoc unplanned task added during the sprint.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants