[apify-deps]

Summary

Dependency sweep — in-range freshening only this run (no alert could be safely auto-fixed; see flags
below):

• @rolldown/binding-* 1.2.15 → 1.2.16
• @oxc-project/types 0.155.0 → 0.156.0
• @types/estree 1.0.9 → 1.0.10
• qs 6.17.0 → 6.17.1
• tslib 2.8.1 → 2.9.1
• tinybench 6.2.2 → 6.2.3
• es-toolkit 1.53.0 → 1.53.1
• encodeurl 2.0.0 → 2.0.1

🚩 Flagged — needs review

• minimatch 10.2.6 → 11.0.1 (medium) — CAPPED by typedoc@0.28.20 (devDependency), which still
  declares ^10.2.5 even on its latest release; moving past 11.0.1 needs a new pnpm override or an
  upstream typedoc bump. Dev-tooling only (doc generation), no existing override to bump.
  (alert #137)
• rustls 0.23.45 → 0.23.46 (low) — we pin our own fork (apify/rustls branch impit-main, rev
  5ce04170) via [patch.crates-io] in Cargo.toml for the custom TLS-fingerprinting support this
  crate needs; upstream's 0.23.46 fix isn't merged into that branch yet. Fixing this means merging the
  upstream security patch into the apify/rustls fork (a change in that repo, out of scope for this
  sweep) and re-pinning the rev here once it lands.
  (alert #135)
• rustls 0.23.45 → 0.23.46 (low) — same fork-pin issue as above; additionally this one is about the
  Brotli certificate-decompression path, and our lockfile does compile rustls with the brotli/
  brotli-decompressor deps in the tree, so it's reachable, not dismissable. Same fix: merge upstream
  0.23.46 into apify/rustls's impit-main branch and bump the pinned rev.
  (alert #133)

🤖 Generated with Claude Code