apify-deps[bot]
6d77689eb6
## Summary Dependency sweep — security bumps + in-range freshening (all within existing ranges): - `@hono/node-server` → 1.19.17, `hono` → 4.13.3 (medium/low, multiple alerts) - `fast-uri` → 3.1.5 (high, multiple alerts) - `dompurify` → 3.4.13 (medium/low, multiple alerts) - `js-yaml` → 3.15.1 / 4.3.1 (high, multiple alerts) - `nx` → 22.7.8 (medium, multiple alerts) - `mermaid` → 11.16.1 (medium/low, multiple alerts) - `ip-address` → 10.5.0, via an in-range `express-rate-limit` 8.3.2 → 8.6.2 bump (high/medium, multiple alerts) - `undici` → 7.29.0 (medium/high/low, multiple alerts) - `postcss` → 8.5.26 (medium/high, multiple alerts) - `svgo` → 3.3.4 (high) - `markdown-it` → 14.3.0, `linkify-it` → 5.0.2 (medium/high, multiple alerts) - `body-parser` → 1.20.6 (low) - `axios` → 1.18.1 / 1.19.0 (medium/high, multiple alerts) - `protobufjs` → 7.6.5 (medium/high, multiple alerts) - `webpack-dev-server` → 5.2.6 (medium, multiple alerts) - `shell-quote` → 1.10.0 (critical/high) - `brace-expansion` → 1.1.18 / 2.1.4 (high, multiple alerts) - `websocket-driver` → 0.7.5 (critical/medium) - `sigstore` → 4.1.1, `@sigstore/core` → 3.2.1, `@sigstore/verify` → 3.1.1 (high/medium) - `http-proxy-middleware` → 2.0.10 (medium) - `joi` → 17.13.4 (medium) - `launch-editor` → 2.14.1 (medium) - `@babel/core` → 7.29.7 (low) - `ws` → 7.5.13 (high) - `turbo` → 2.9.14+ range bump (medium) - `qs` → 6.15.3 (medium, one occurrence — see flagged for the other) - `uuid` → 11.1.1 for the reachable 11.x line (medium) - plus opportunistic in-range minor freshening across the rest of `pnpm-lock.yaml` ## ✅ Dismissed (don't apply to our usage) - `uuid` (medium) — `not_used`: the only remaining pre-11.1.1 copies are `sockjs`'s `8.3.2` (webpack-dev-server, dev-only) and `@langchain/core`'s `10.0.0` (stagehand e2e devDependency), both of which only ever call `v4()`. The advisory is about missing bounds-checks in `v3()`/`v5()`/`v6()` when a caller supplies a custom output buffer — a path neither consumer exercises. The reachable 11.x copy is bumped to the patched `11.1.1` in this PR. ([alert #571](https://github.com/apify/crawlee/security/dependabot/571)) - `serialize-javascript` (medium) — `not_used`: pulled only by `copy-webpack-plugin` and `css-minimizer-webpack-plugin`, which are webpack plugins. The docs build uses Docusaurus's rspack bundler (`future.faster.rspackBundler: true`), so the webpack path never runs and the vulnerable serialize step isn't executed. ([alert #572](https://github.com/apify/crawlee/security/dependabot/572)) ## 🚩 Flagged — needs review - `vite` `8.0.8` → `8.0.16` (medium/high) — peer-only dependency of `vitest@4.1.4` (not a direct devDependency anywhere in the repo), so `pnpm update`/overrides can't move it in-range; reaching the patch means pinning `vite` as a direct devDependency, a manifest change outside this sweep's scope. ([alert #591](https://github.com/apify/crawlee/security/dependabot/591), [alert #593](https://github.com/apify/crawlee/security/dependabot/593)) - `esbuild` `0.27.7` → `0.28.1` (low) — pinned by `css-minimizer-webpack-plugin`'s docusaurus/webpack toolchain and by the same peer-pinned `vite@8.0.8` above; no existing override to bump. ([alert #588](https://github.com/apify/crawlee/security/dependabot/588)) - `qs` `6.14.2` → `6.15.2` (medium) — pinned by `express@4.22.1`'s exact `~6.14.0` range (used by the docs `webpack-dev-server` chain); needs a new `pnpm-workspace.yaml` override to force past `6.14.x`. ([alert #573](https://github.com/apify/crawlee/security/dependabot/573)) No open Renovate PR references any of `vite`, `esbuild`, or `qs` at the moment. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: apify-deps[bot] <4649591+apify-deps[bot]@users.noreply.github.com>
156 lines
6.3 KiB
JSON
156 lines
6.3 KiB
JSON
{
|
|
"name": "@crawlee/root",
|
|
"private": true,
|
|
"type": "module",
|
|
"description": "The scalable web crawling and scraping library for JavaScript/Node.js. Enables development of data extraction and web automation jobs (not only) with headless Chrome and Puppeteer.",
|
|
"keywords": [
|
|
"apify",
|
|
"headless",
|
|
"chrome",
|
|
"puppeteer",
|
|
"crawler",
|
|
"scraper"
|
|
],
|
|
"author": {
|
|
"name": "Apify",
|
|
"email": "support@apify.com",
|
|
"url": "https://apify.com"
|
|
},
|
|
"contributors": [
|
|
"Jan Curn <jan@apify.com>",
|
|
"Marek Trunkat <marek@apify.com>",
|
|
"Ondra Urban <ondra@apify.com>"
|
|
],
|
|
"license": "Apache-2.0",
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "git+https://github.com/apify/crawlee"
|
|
},
|
|
"bugs": {
|
|
"url": "https://github.com/apify/crawlee/issues"
|
|
},
|
|
"homepage": "https://crawlee.dev",
|
|
"scripts": {
|
|
"prepublishOnly": "turbo run copy --filter=./packages/*",
|
|
"clean": "turbo run clean --filter=./packages/* && rimraf .turbo packages/*/.turbo packages/*/*.tsbuildinfo",
|
|
"build": "turbo run build --filter=./packages/* && node ./scripts/typescript_fixes.mjs",
|
|
"ci:build": "turbo run build --filter=./packages/* --cache-dir=\".turbo\" && node ./scripts/typescript_fixes.mjs",
|
|
"test": "vitest run --silent",
|
|
"test:e2e": "node test/e2e/run.mjs",
|
|
"test:integration": "cross-env CRAWLEE_DIFFICULT_TESTS=1 vitest run --silent=true test/integration",
|
|
"test:integration:services:up": "docker network create crawlee-it 2>/dev/null; docker run -d --rm --name crawlee-it-browserless --network crawlee-it -p 3000:3000 -e CONCURRENT=4 ghcr.io/browserless/chromium && docker run -d --rm --name crawlee-it-httpbin --network crawlee-it --network-alias httpbin -p 8080:80 kennethreitz/httpbin",
|
|
"test:integration:services:down": "docker stop crawlee-it-browserless crawlee-it-httpbin; docker network rm crawlee-it 2>/dev/null; true",
|
|
"test:full": "cross-env CRAWLEE_DIFFICULT_TESTS=1 vitest run --silent",
|
|
"tsc-check-tests": "tsc --noEmit --project test/tsconfig.json",
|
|
"coverage": "vitest --coverage",
|
|
"publish:next": "lerna publish from-package --contents dist --dist-tag v4 --force-publish --yes",
|
|
"release:next": "pnpm build && pnpm publish:next",
|
|
"publish:rc": "lerna publish from-package --contents dist --dist-tag rc --force-publish --yes",
|
|
"publish:prod": "lerna publish from-package --contents dist --force-publish --yes",
|
|
"release:prod": "pnpm build && pnpm publish:prod",
|
|
"release:pin-versions": "turbo run copy -- -- --pin-versions",
|
|
"api:extract": "pnpm build && tsx scripts/api-extractor/run.ts",
|
|
"api:check": "tsx scripts/api-extractor/run.ts --verify",
|
|
"lint": "oxlint packages test docs --tsconfig=tsconfig.json --type-aware",
|
|
"lint:fix": "oxlint packages test docs --tsconfig=tsconfig.json --type-aware --fix",
|
|
"format": "oxfmt packages test docs --write",
|
|
"format:check": "oxfmt packages test docs --check",
|
|
"prepare": "husky"
|
|
},
|
|
"devDependencies": {
|
|
"@apify/log": "^2.5.18",
|
|
"@apify/oxlint-config": "^0.2.5",
|
|
"@apify/tsconfig": "^0.2.0",
|
|
"@commitlint/config-conventional": "^21.0.0",
|
|
"@crawlee/basic": "workspace:*",
|
|
"@crawlee/cheerio": "workspace:*",
|
|
"@crawlee/core": "workspace:*",
|
|
"@crawlee/http-client": "workspace:*",
|
|
"@crawlee/impit-client": "workspace:*",
|
|
"@crawlee/jsdom": "workspace:*",
|
|
"@crawlee/linkedom": "workspace:*",
|
|
"@crawlee/playwright": "workspace:*",
|
|
"@crawlee/puppeteer": "workspace:*",
|
|
"@crawlee/stagehand": "workspace:*",
|
|
"@crawlee/types": "workspace:*",
|
|
"@crawlee/utils": "workspace:*",
|
|
"@microsoft/api-extractor": "^7.58.9",
|
|
"@oxlint/plugins": "^1.62.0",
|
|
"@playwright/browser-chromium": "1.61.1",
|
|
"@playwright/browser-firefox": "1.61.1",
|
|
"@playwright/browser-webkit": "1.61.1",
|
|
"@types/content-type": "^1.1.8",
|
|
"@types/deep-equal": "^1.0.4",
|
|
"@types/domhandler": "^3.1.0",
|
|
"@types/express": "^5.0.1",
|
|
"@types/fs-extra": "^11.0.4",
|
|
"@types/inquirer": "^9.0.8",
|
|
"@types/is-ci": "^3.0.4",
|
|
"@types/lodash.isequal": "^4.5.8",
|
|
"@types/lodash.merge": "^4.6.9",
|
|
"@types/mime-types": "^2.1.4",
|
|
"@types/node": "^24.0.0",
|
|
"@types/proper-lockfile": "^4.1.4",
|
|
"@types/ps-tree": "^1.1.6",
|
|
"@types/rimraf": "^4.0.5",
|
|
"@types/sax": "^1.2.7",
|
|
"@types/semver": "^7.7.0",
|
|
"@types/stream-json": "^1.7.8",
|
|
"@types/whatwg-mimetype": "^3.0.2",
|
|
"@types/yargs": "^17.0.33",
|
|
"@vitest/coverage-v8": "^4.0.16",
|
|
"apify": "*",
|
|
"apify-node-curl-impersonate": "^1.0.23",
|
|
"basic-auth-parser": "^0.0.2",
|
|
"body-parser": "^2.3.0",
|
|
"camoufox-js": "^0.11.0",
|
|
"commitlint": "^21.0.0",
|
|
"crawlee": "workspace:*",
|
|
"cross-env": "^10.0.0",
|
|
"deep-equal": "^2.2.3",
|
|
"express": "^5.1.0",
|
|
"fs-extra": "^11.3.0",
|
|
"gen-esm-wrapper": "^1.1.3",
|
|
"globby": "^15.0.0",
|
|
"got": "^14.4.7",
|
|
"husky": "^9.1.7",
|
|
"iconv-lite": "^0.7.2",
|
|
"is-ci": "^4.1.0",
|
|
"lerna": "^9.0.0",
|
|
"lint-staged": "^17.0.0",
|
|
"nock": "^14.0.10",
|
|
"oxfmt": "^0.46.0",
|
|
"oxlint": "^1.62.0",
|
|
"oxlint-tsgolint": "^0.22.0",
|
|
"playwright": "1.61.1",
|
|
"portastic": "^1.0.1",
|
|
"proxy": "^2.2.0",
|
|
"puppeteer": "25.8.0",
|
|
"rimraf": "^6.0.1",
|
|
"tsx": "^4.19.4",
|
|
"turbo": "^2.10.11",
|
|
"typescript": "^6.0.0",
|
|
"vite-tsconfig-paths": "^5.1.4",
|
|
"vitest": "^4.1.0-beta.6",
|
|
"zod": "catalog:"
|
|
},
|
|
"lint-staged": {
|
|
"{packages,test,docs}/**/*.{js,ts,mjs,mts,cjs,cts}": [
|
|
"oxlint --fix --no-error-on-unmatched-pattern",
|
|
"oxfmt --write --no-error-on-unmatched-pattern"
|
|
]
|
|
},
|
|
"packageManager": "pnpm@11.22.0",
|
|
"devEngines": {
|
|
"packageManager": {
|
|
"name": "pnpm",
|
|
"version": "11.22.0",
|
|
"onFail": "error"
|
|
}
|
|
},
|
|
"volta": {
|
|
"node": "24.18.0",
|
|
"pnpm": "11.22.0"
|
|
}
|
|
}
|