chore(deps): security bumps + in-range freshening (#4052)

## Summary
Dependency sweep — security bumps + in-range freshening (all within
existing ranges):
- `@hono/node-server` → 1.19.17, `hono` → 4.13.3 (medium/low, multiple
alerts)
- `fast-uri` → 3.1.5 (high, multiple alerts)
- `dompurify` → 3.4.13 (medium/low, multiple alerts)
- `js-yaml` → 3.15.1 / 4.3.1 (high, multiple alerts)
- `nx` → 22.7.8 (medium, multiple alerts)
- `mermaid` → 11.16.1 (medium/low, multiple alerts)
- `ip-address` → 10.5.0, via an in-range `express-rate-limit` 8.3.2 →
8.6.2 bump (high/medium, multiple alerts)
- `undici` → 7.29.0 (medium/high/low, multiple alerts)
- `postcss` → 8.5.26 (medium/high, multiple alerts)
- `svgo` → 3.3.4 (high)
- `markdown-it` → 14.3.0, `linkify-it` → 5.0.2 (medium/high, multiple
alerts)
- `body-parser` → 1.20.6 (low)
- `axios` → 1.18.1 / 1.19.0 (medium/high, multiple alerts)
- `protobufjs` → 7.6.5 (medium/high, multiple alerts)
- `webpack-dev-server` → 5.2.6 (medium, multiple alerts)
- `shell-quote` → 1.10.0 (critical/high)
- `brace-expansion` → 1.1.18 / 2.1.4 (high, multiple alerts)
- `websocket-driver` → 0.7.5 (critical/medium)
- `sigstore` → 4.1.1, `@sigstore/core` → 3.2.1, `@sigstore/verify` →
3.1.1 (high/medium)
- `http-proxy-middleware` → 2.0.10 (medium)
- `joi` → 17.13.4 (medium)
- `launch-editor` → 2.14.1 (medium)
- `@babel/core` → 7.29.7 (low)
- `ws` → 7.5.13 (high)
- `turbo` → 2.9.14+ range bump (medium)
- `qs` → 6.15.3 (medium, one occurrence — see flagged for the other)
- `uuid` → 11.1.1 for the reachable 11.x line (medium)
- plus opportunistic in-range minor freshening across the rest of
`pnpm-lock.yaml`

## ✅ Dismissed (don't apply to our usage)
- `uuid` (medium) — `not_used`: the only remaining pre-11.1.1 copies are
`sockjs`'s `8.3.2` (webpack-dev-server, dev-only) and
`@langchain/core`'s `10.0.0` (stagehand e2e devDependency), both of
which only ever call `v4()`. The advisory is about missing bounds-checks
in `v3()`/`v5()`/`v6()` when a caller supplies a custom output buffer —
a path neither consumer exercises. The reachable 11.x copy is bumped to
the patched `11.1.1` in this PR. ([alert
#571](https://github.com/apify/crawlee/security/dependabot/571))
- `serialize-javascript` (medium) — `not_used`: pulled only by
`copy-webpack-plugin` and `css-minimizer-webpack-plugin`, which are
webpack plugins. The docs build uses Docusaurus's rspack bundler
(`future.faster.rspackBundler: true`), so the webpack path never runs
and the vulnerable serialize step isn't executed. ([alert
#572](https://github.com/apify/crawlee/security/dependabot/572))

## 🚩 Flagged — needs review
- `vite` `8.0.8` → `8.0.16` (medium/high) — peer-only dependency of
`vitest@4.1.4` (not a direct devDependency anywhere in the repo), so
`pnpm update`/overrides can't move it in-range; reaching the patch means
pinning `vite` as a direct devDependency, a manifest change outside this
sweep's scope. ([alert
#591](https://github.com/apify/crawlee/security/dependabot/591), [alert
#593](https://github.com/apify/crawlee/security/dependabot/593))
- `esbuild` `0.27.7` → `0.28.1` (low) — pinned by
`css-minimizer-webpack-plugin`'s docusaurus/webpack toolchain and by the
same peer-pinned `vite@8.0.8` above; no existing override to bump.
([alert #588](https://github.com/apify/crawlee/security/dependabot/588))
- `qs` `6.14.2` → `6.15.2` (medium) — pinned by `express@4.22.1`'s exact
`~6.14.0` range (used by the docs `webpack-dev-server` chain); needs a
new `pnpm-workspace.yaml` override to force past `6.14.x`. ([alert
#573](https://github.com/apify/crawlee/security/dependabot/573))

No open Renovate PR references any of `vite`, `esbuild`, or `qs` at the
moment.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: apify-deps[bot] <4649591+apify-deps[bot]@users.noreply.github.com>

package.json

@@ -102,7 +102,7 @@
         "apify": "*",
         "apify-node-curl-impersonate": "^1.0.23",
         "basic-auth-parser": "^0.0.2",
-        "body-parser": "^2.2.0",
+        "body-parser": "^2.3.0",
         "camoufox-js": "^0.11.0",
         "commitlint": "^21.0.0",
         "crawlee": "workspace:*",
@@ -128,7 +128,7 @@
         "puppeteer": "25.8.0",
         "rimraf": "^6.0.1",
         "tsx": "^4.19.4",
-        "turbo": "^2.5.3",
+        "turbo": "^2.10.11",
         "typescript": "^6.0.0",
         "vite-tsconfig-paths": "^5.1.4",
         "vitest": "^4.1.0-beta.6",

website/package.json

@@ -48,7 +48,7 @@
         "@giscus/react": "^3.0.0",
         "@mdx-js/react": "^3.0.1",
         "@signalwire/docusaurus-plugin-llms-txt": "^1.2.1",
-        "axios": "^1.16.0",
+        "axios": "^1.19.0",
         "buffer": "^6.0.3",
         "clsx": "^2.0.0",
         "crypto-browserify": "^3.12.0",