[apify-deps]

Summary

Dependency sweep — in-range freshening (no FIX available for the open alerts; see below):

• impit-node devDependencies refreshed to newest in-range versions (@napi-rs/cli, @types/express, @types/node, express, proxy-chain, tough-cookie, typedoc, typedoc-plugin-mdn-links, typescript, vite, vitest) — lockfile + matching ^ range bumps, no majors crossed.

✅ Dismissed (don't apply to our usage)

• rustls (medium) — not_used: impit only uses rustls's built-in Resumption::in_memory_sessions() cache, never a custom ClientSessionStore; the advisory's Debug-secret-exposure only affects custom stores, and built-in cache diagnostics remain redacted. (alert #134)
• rustls (low) — not_used: impit's get_ech_mode() always builds EchGreaseConfig (ECH GREASE); EchMode::Enable/Real is never constructed anywhere in the codebase, and the advisory states GREASE ECH is not affected. (alert #136)

🚩 Flagged — needs review

• rustls 0.23.45 → 0.23.46 (low) — hybrid key-exchange downgrade via the per-name key-share prediction cache; impit enables session resumption (Resumption::in_memory_sessions(256)), so the precondition applies. The fix only exists in upstream rustls ≥0.23.46, but impit pins rustls = { git = "https://github.com/apify/rustls", rev = "..." } to a fork commit that hasn't merged it — this needs a source merge in the separate apify/rustls fork repo (out of scope for this impit-only sweep), then a rev bump here. No tracking PR found. (alert #135)
• rustls 0.23.45 → 0.23.46 (low) — Brotli certificate-decompression memory-exhaustion DoS; impit's rustls impit feature enables brotli, and impit is a TLS client, so a malicious server can trigger it. Same blocker as above (fix needs the fork merge); a local mitigation (stripping ClientConfig::cert_decompressors) would also change the TLS fingerprint impit intentionally mimics, so that behavior tradeoff needs a human call rather than a silent sweep change. No tracking PR found. (alert #133)

🤖 Generated with Claude Code