chore(deps): dependency sweep - #4107
Open
apify-deps[bot] wants to merge 2 commits into
Open
Conversation
![apify-deps[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
Broad in-range freshening across the pnpm workspace (patch/minor bumps only, ranges unchanged) plus dropping the top-level `minimatch: ^9.0.0` override in pnpm-workspace.yaml: it was capping @crawlee/core's own `^10.0.1` dependency down to 9.x even though core's declared range already wants v10. The lerna-scoped override (`lerna>minimatch: ^3.1.4`) still handles lerna's v3-only bundled code, so this is untouched.
The broad in-range freshening picked up oxlint 1.62.0 -> 1.81.0 (and @oxlint/plugins, @apify/oxlint-config in lockstep) since it's still within the declared ^1.62.0 caret range, but the newer oxlint enables stricter lint rules that flag pre-existing code patterns across many files, turning a green Lint CI check red without any real behavior change here. Master's Lint is green on the old version, so per the dependency-sweep runbook: narrow the refresh rather than ship red CI. Exact-pinning oxlint/@oxlint/plugins/@apify/oxlint-config back to their prior locked versions until that rule fallout is addressed separately.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Dependency sweep — in-range freshening (no security bumps landed via this PR — see below):
pnpm update -racross the workspace: patch/minor bumps only (e.g.@apify/*packages,tar→7.5.22,puppeteer/playwrightpatch lines,zodcatalog^4.4.3→^4.5.4, etc).oxlint/@oxlint/plugins/@apify/oxlint-configmoved to their latest in-range versions initially, but the neweroxlintenables stricter rules that flag pre-existing code patterns (no functional change here) — reverted to their prior exact versions (oxlint/@oxlint/plugins1.62.0,@apify/oxlint-config0.2.5) to keep Lint green, per the sweep runbook's "narrow rather than ship red CI" guidance. That rule fallout can be addressed as its own follow-up whenever the team wants to take the newer oxlint.🧹 Pruned overrides (no longer needed)
minimatch(top-level^9.0.0) — stale: it was capping@crawlee/core's own direct dependency (declared^10.0.1) down to 9.x. Dropped;@crawlee/corenow resolves its ownminimatchto^10.2.6as declared. The lerna-scopedlerna>minimatch: ^3.1.4override (needed for lerna 9.x's v3-only bundled code) is untouched and still does its job.✅ Dismissed (don't apply to our usage)
stream-json(medium, GHSA-528h-pc64-c93x) — not_used: the advisory is specific to thepick/ignore/filter/replacepath filters (O(D²) on nesting depth). Crawlee's only usage (packages/core/src/serialization.ts) is theStreamArraystreamer, which the advisory itself lists as not affected (asm.depth, O(1)). No filter API is used anywhere in the repo. Patched3.5.0is also a major bump outside the declared^1.9.1range, so a version bump isn't an option here anyway — this is a clean not-applicable dismissal. (alert #692)🤖 Generated with Claude Code