chore(deps): dependency sweep - #1018
Merged
Merged
Conversation
![apify-deps[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
In-range lockfile refresh (pnpm update -r) plus dropping the now-redundant @puppeteer/browsers override, since puppeteer@25.9.0 already pins @puppeteer/browsers@3.2.1 directly.
B4nan
approved these changes
Sep 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Dependency sweep — in-range freshening (all within existing ranges):
pnpm update -rrefresh across root +websiteworkspace (patch/minor bumps only; direct dep ranges bumped where the update is a direct dep, e.g.axios ^1.16.0 → ^1.20.0,puppeteer ^25.0.0 → ^25.9.0).🧹 Pruned overrides (no longer needed)
@puppeteer/browsers— the override forced v3 back when our directpuppeteerdep was still on v24 (which pulled in@puppeteer/browsersv2). Now thatpuppeteeris^25.9.0, it already depends on@puppeteer/browsers@3.2.1directly — the override is a no-op (confirmed: removing it resolves to the same3.2.1).🚩 Flagged — needs review
decode-uri-component(medium) — alert #299: no in-range fix. Pinned byquery-string@8.2.0(declaresdecode-uri-component: ^0.4.1), which is pulled in by@apify/ui-library@1.164.3(still declaringquery-string: ^8.1.0even in its latest release) via the docs website's@apify/docs-search-modal→@apify/docs-theme.query-stringonly bumped its owndecode-uri-componentdependency to^0.5.0starting at9.5.0— a major bump outside@apify/ui-library's declared range, so it can't land via a refresh. Fixing this needs either a newdecode-uri-componentoverride (untested againstquery-string@8.2.0's actual usage) or waiting on@apify/ui-libraryto bump itsquery-stringdep — no existing override to extend. No related Renovate PR found. Vulnerable path is a client-side CPU-exhaustion DoS in the docs website's search UI, browser-only (CWE-400/1176) — not not_used enough to dismiss outright without confidently verifying@apify/docs-search-modal's exact usage.🤖 Generated with Claude Code