[apify-deps]

Summary

Dependency sweep — in-range freshening of website/pnpm-lock.yaml (react, oxlint, oxlint-tsgolint, unist-util-visit, @apify/ui-library, @apify/ui-icons, and assorted transitives). None of the currently-alerted packages could move within their consumers' declared ranges this run — see flags below.

✅ Dismissed (don't apply to our usage)

• serialize-javascript (high/medium/low) — not_used: only loaded by copy-webpack-plugin/css-minimizer-webpack-plugin (webpack path); the site builds with Docusaurus's rspack bundler (future.faster.rspackBundler), so it never runs. (alert #126, #154, #194)
• uuid (medium) — not_used: the vulnerable v3/v5/v6 path is only reached via sockjs←webpack-dev-server←@docusaurus/core, which backs docusaurus start; no CI workflow runs the dev server (only lint:md/lint:code and the manual release-docs build). (alert #153)
• minimatch (medium) — not_used: pulled in only via serve-handler←@docusaurus/core, which backs docusaurus serve (local static preview); no CI workflow invokes it. (alert #199)
• deepmerge (low) — tolerable_risk: no fix published upstream at all. Only merges our own SVGO build options via @svgr/webpack←@docusaurus/plugin-svgr, and that build step only runs in the manually-triggered release-docs workflow on the default branch — never on fork PRs. (alert #195)

🚩 Flagged — needs review

• decode-uri-component 0.4.1 → 0.5.1 (high + medium) — new override needed. Pinned two levels deep: @apify/ui-library@1.172.1 (latest published) pins query-string@^8.1.0, and every query-string 8.x release (through 8.2.0) pins decode-uri-component@^0.4.1; the fix only landed in query-string 9.5.0+, which is outside ui-library's declared range. Reachable in production (used by the live docs-search query-string parsing). No tracking PR found. (alert #197, #176)
• re2js 2.8.6 → 2.8.7 (high) — new override needed. markdownlint@0.42.0 (latest) pins an exact re2js@2.8.6 (not a range), so an in-range update can't move it. Reachable via CI's lint:md on PR-authored (incl. fork) markdown. No tracking PR found. (alert #196)
• tinypool 1.1.1 → 2.1.2 (critical ×2) — new override needed. @docusaurus/core@3.10.2 (latest 3.x) pins tinypool@^1.0.2; both patched versions (2.1.1, 2.1.2) are major-version jumps outside that range, and an override would need validating against a worker-pool API change. Only exercised during docusaurus build, which only runs in the manually-triggered release-docs workflow (not on fork PRs). No tracking PR found. (alert #192, #191)
• katex 0.16.47 → 0.18.2 (low) — new override needed. micromark-extension-math@3.1.0 declares katex@^0.16.0; the patch is a 0.18.x line, outside that pre-1.0 range. Reachable via CI's lint:md on PR-authored markdown with math syntax. No tracking PR found. (alert #193)

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.84%. Comparing base (17e2845) to head (fb8fca4).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1226      +/-   ##
==========================================
+ Coverage   93.81%   93.84%   +0.02%     
==========================================
  Files          54       54              
  Lines        3799     3799              
==========================================
+ Hits         3564     3565       +1     
+ Misses        235      234       -1     

Flag	Coverage Δ
e2e	31.48% <ø> (ø)
integration	51.40% <ø> (+0.02%)	⬆️
unit	90.99% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.