[apify-deps]

Summary

Dependency sweep — in-range freshening (no open alert could be fixed in-range this run; all 6
are capped by a transitive consumer with no existing override — see Flagged below):

• @apify/input_schema ^4.0.4 → ^4.0.8
• @apify/utilities ^3.0.1 → ^3.1.0
• @crawlee/memory-storage ^3.18.1 → ^3.18.2
• @crawlee/types ^3.18.1 → ^3.18.2
• @inquirer/checkbox ^5.2.7 → ^5.2.8
• @inquirer/core ^12.0.3 → ^12.0.6
• @inquirer/input ^5.1.6 → ^5.1.9
• @inquirer/password ^5.2.2 → ^5.2.5
• @inquirer/select ^5.2.5 → ^5.2.8
• @napi-rs/keyring ^2.1.0 → ^2.1.2
• @types/bun ^1.4.2 → ^1.4.4
• @types/node ^26.0.0 → ^26.6.6
• axios ^1.20.0 → ^1.21.0
• chalk ~6.0.0 → ~6.0.1
• execa ^10.0.1 → ^10.2.1
• handlebars ~4.7.9 → ~4.7.10
• ignore ^7.0.9 → ^7.0.14
• lint-staged ^17.5.1 → ^17.6.0
• mime ~4.1.0 → ~4.1.2
• string-width ^8.2.2 → ^8.3.0
• tsdown ^0.23.0 → ^0.23.4
• tsx ^4.23.13 → ^4.23.15
• vitest ^5.0.0 → ^5.0.5
• wrap-ansi ^10.0.1 → ^10.0.2
• website: prettier ^3.9.6 → ^3.9.10
• website: react ^19.3.0 → ^19.3.1
• website: react-dom ^19.3.0 → ^19.3.1
• website: unist-util-visit ^5.1.0 → ^5.2.0

Plus the rest of the lockfile re-resolving to newest in-range deep transitives/peers (no manifest
change) across pnpm-lock.yaml.

🚩 Flagged — needs review

• minimatch 9.0.9 / 10.2.6 / 3.1.5 → 11.0.1 (medium) — CAPPED by four consumers, none with an
  existing override: @crawlee/core@3.18.2 declares ^9.0.0 (its latest, 3.18.2, still does);
  glob@13.0.6 (via rimraf) declares ^10.2.2 (bumping glob itself to 14.0.4 would clear
  that one copy, but needs a new override since glob isn't a direct dep); readdir-glob@3.0.0
  declares ^10.2.2 (its latest still does); serve-handler@6.1.7 pins 3.1.5 exactly (its
  latest, 6.1.8, still does). No single bump clears all four copies. (alert #301)
• decode-uri-component 0.4.1 → 0.5.1 (high) — CAPPED by query-string@8.2.0 declaring ^0.4.1
  (its latest, 10.0.0, drops the dependency entirely rather than bumping it); only reachable via
  @apify/docs-theme → @apify/docs-search-modal → @apify/ui-library in the docs website, no
  existing override to bump. (alert #296)
• decode-uri-component 0.4.1 → 0.5.0 (medium) — same root cause/consumer as feat: Use .actor/actor.json file (#292) #296 above.
  (alert #281)
• tinypool 1.1.1 → 2.1.2 (critical) — CAPPED by @docusaurus/core@3.10.2 declaring ^1.0.2
  (its latest, 3.10.2, still does); docs-website build tooling only, no existing override to bump.
  (alert #287)
• tinypool 1.1.1 → 2.1.1 (critical) — same root cause/consumer as Update push command to work with actor.json #287 above.
  (alert #288)
• basic-ftp 5.3.1 → 6.2.1 (high) — CAPPED by get-uri@6.0.5 (via pac-proxy-agent →
  proxy-agent → apify-client) declaring ^5.0.2 (its latest, 8.0.1, still requires ^5.3.1),
  reachable at runtime through apify-client's proxy support; no existing override to bump.
  (alert #286)

No matching Renovate PR found for any of the above (find_related_pr.sh returned nothing).

🤖 Generated with Claude Code