[apify-deps]

Summary

Dependency sweep — security bumps + in-range freshening (all within existing ranges):

• @apify/ui-library 1.171.1 → 1.172.1, @apify/ui-icons 1.57.0 → 1.59.0, react/react-dom 19.3.0 → 19.3.1, oxlint 1.87.0 → 1.90.0, and other small transitive patch bumps (semver, electron-to-chromium, http2-wrapper, baseline-browser-mapping) — opportunistic in-range freshening only, no alerts resolved by this part.

✅ Dismissed (don't apply to our usage)

• minimatch (medium) — the ReDoS needs an attacker-controlled glob pattern (not the matched path); all 3 copies here (serve-handler's docusaurus serve, typedoc config, rimraf/markdownlint-cli globs) only ever match patterns we author ourselves. (alert #170)
• re2js (high) — markdownlint never passes the opt-in RE2JS.LOOKBEHINDS flag; the quadratic-time DoS only triggers when that flag is enabled. (alert #167)
• katex (low) — markdownlint only imports micromark-extension-math's math tokenizer for lint-time parsing, never the mathHtml compiler; katex.renderToString is never called, so the prototype-pollution-bypass path can't be exercised. (alert #164)
• deepmerge (low, no fix) — declared-but-unused dependency of @svgr/plugin-svgo@8.1.0; its dist/index.js never require('deepmerge'). (alert #166)
• uuid (medium) — sockjs (via webpack-dev-server, local docusaurus start only — no CI job runs it) calls uuidv4() with no args; the vuln needs a caller-supplied buf argument. (alert #137)
• serialize-javascript (low/medium/high, 3 alerts) — only reached via copy-webpack-plugin + css-minimizer-webpack-plugin under @docusaurus/bundler; this site sets future.faster.rspackBundler: true, so webpack and webpack-only plugins never run. (alert #165, #138, #112)

🚩 Flagged — needs review

• tinypool 1.1.1 → 2.1.2+ (critical ×2, prototype-pollution gadget → RCE) — genuinely present in 1.1.1 (verified the same vulnerable this.options = {...kDefaultOptions, ...options} → execArgv/env pattern as the advisory PoC). Pinned by @docusaurus/core@3.10.2's declared tinypool: ^1.0.2, which fully excludes the patched 2.x line — needs a new major-line override. No CI job in this repo actually runs docusaurus build to validate such an override is safe, so it needs manual testing. (oxfmt's own tinypool@2.2.0 copy is already patched.) (alert #163, #162)
• decode-uri-component 0.4.1 → 0.5.1 (high + medium, ReDoS) — shipped in the production docs bundle via query-string@8.2.0 → @apify/ui-library → @apify/docs-search-modal/@apify/docs-theme (client-side URL-query decoding). query-string@8.2.0 pins decode-uri-component: ^0.4.1; no existing override. Needs either an upstream @apify/ui-library bump (its latest, 1.172.1, still depends on query-string@^8.1.0) or a new override — a 0.x line jump treated as major here. (alert #168, #158)

No open Renovate PR found tracking either of the above.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.67%. Comparing base (37ffcee) to head (79ec37c).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1196   +/-   ##
=======================================
  Coverage   95.67%   95.67%           
=======================================
  Files          61       61           
  Lines        6473     6473           
=======================================
  Hits         6193     6193           
  Misses        280      280           

Flag	Coverage Δ
integration	91.08% <ø> (-0.31%)	⬇️
unit	90.37% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.