[apify-deps]

Summary

Dependency sweep — security bumps + in-range freshening (in range):

• re2js → 2.9.1 (high) — reached its patched floor (2.8.7) via the lockfile refresh, fixing alert #338
• @apify/ui-icons ^1.61.0 → ^1.61.1, @apify/ui-library ^1.175.0 → ^1.176.0, @stoplight/spectral-cli ^6.17.0 → ^6.17.1, @redocly/cli ^2.75.0 → ^2.76.0 (direct ranges moved by the in-range refresh)
• plus the broad transitive/peer freshening across pnpm-lock.yaml (deep transitives and auto-installed peers moved to their newest in-range versions)

🚩 Flagged — needs review

• minimatch 3.1.5/5.1.9/10.2.6 → 11.0.1 (medium) — CAPPED by multiple consumers' declared ranges: @redocly/openapi-core@1.34.24 declares 5.1.9, @stoplight/spectral-core@1.24.1 declares ^3.1.4, markdownlint-cli@0.50.0 declares ~10.2.6, serve-handler@6.1.8 declares 3.1.5 — each needs a new override or an upstream range bump (none exist yet); glob@7.2.3 also caps a copy and could be fixed by bumping it to 14.0.4, but glob@7.2.3 is itself a deep transitive of @rollup/plugin-commonjs (via @stoplight/spectral-ruleset-bundler) and shelljs (via postman-code-generators), not a direct dep we can bump ourselves. No tracking PR found. (alert #336)
• decode-uri-component 0.4.1 → 0.5.1 (high) / → 0.5.0 (medium) — CAPPED by query-string@8.2.0 declaring ^0.4.1 (its latest, 10.0.0, still declares nothing patched); query-string is a transitive dep of @apify/ui-library/@apify/docs-search-modal, used client-side for the docs search box — needs a new override or an upstream bump of query-string. No tracking PR found. (alert #331, alert #274)
• tinypool 1.1.1 → 2.1.1 / → 2.1.2 (critical, prototype-pollution-to-RCE gadgets) — CAPPED by @docusaurus/core@3.10.2 declaring ^1.0.2 (its latest release still declares the same range) — needs an upstream Docusaurus bump or a new override; no existing override to extend. No tracking PR found. (alert #301, alert #300)
• @faker-js/faker 5.5.3 → 10.5.0 (high, helpers.fake arbitrary code execution) — CAPPED by postman-collection@5.3.1 declaring an exact 5.5.3 (its latest, 5.3.1, still declares the same) — needs an upstream bump or a new override. No tracking PR found. (alert #275)

🤖 Generated with Claude Code

[apify-service-account]

🗑️ Preview for this PR was deleted.