Skip to content

chore: add new apify package version - #2868

Open
jakcinmarina wants to merge 1 commit into
langgenius:mainfrom
apify:chore/update-apify-version
Open

chore: add new apify package version#2868
jakcinmarina wants to merge 1 commit into
langgenius:mainfrom
apify:chore/update-apify-version

Conversation

@jakcinmarina

Copy link
Copy Markdown
Contributor

Plugin Submission

Plugin information

Submission type

  • New plugin
  • Version update

What changed

This release migrates the plugin to apify-client v3. Actor run results are now
serialized from the client's typed models, so they may include additional fields
with null values where the API omits them, while existing fields keep the same
names and values.

Risk level

  • Low risk
  • Medium risk
  • High risk

The capabilities behind the Medium rating (user-provided URLs, starting runs in
the user's Apify account) have been present since 1.0.0 and are unchanged in
this release.

Required checks

  • I have read and followed the Marketplace submission requirements.
  • I have read and comply with the Plugin Developer Agreement.
  • I tested this plugin on Dify Community Edition and Dify Cloud, or documented any limitation below.
  • The package contains only files needed at runtime.
  • The package does not contain secrets, local credentials, .env files, .git directories, virtual environments, caches, logs, or IDE files.
  • The package does not contain executables or bundled binaries, or I explained why they are required below.
  • The plugin README includes setup steps, usage instructions, required APIs or credentials, connection requirements, and the source repository link.
  • The plugin includes PRIVACY.md or a hosted privacy policy, and manifest.yaml references it.
  • All user-facing text is primarily in English, with any localized README files following the i18n guidance.

Security and privacy notes

  • Arbitrary URL fetching: "Scrape Single URL" scrapes a user-provided URL via the
    apify/website-content-crawler Actor.
  • User-controlled execution on a third-party platform: "Run Actor" and "Run Actor
    Task" run a user-specified Apify Actor with user-supplied input, on Apify's
    infrastructure under the user's own Apify account.
  • Write actions: starting a run creates runs, datasets, and key-value stores in the
    user's Apify account.

Local validation

flake8 .

  • no issues

dify plugin package . -o apify.difypkg
plugin packaged successfully (118 KB)

Installed the packaged .difypkg into a Dify Cloud instance (previously running 1.0.3)
and verified the plugin loads, all tools appear, and credential validation works with
both a valid and an invalid API token.

Reviewer notes

  • None of the items below are new in this release. The packaging ignore rules
    (.difyignore), the README, and the dependency list are unchanged from 1.0.3.
  • Package contents: .difyignore does not exclude .ruff_cache/ (13 lint cache
    files), and the package also carries a few repo files not needed at runtime
    (CLAUDE.md, CONTRIBUTING.md, pyproject.toml, .flake8, .env.example, all
    present since earlier releases). No secrets or user data, no runtime effect. We
    will tighten the ignore rules in the next release.
  • README: does not yet link the source repository
    (https://github.com/apify/apify-dify-integration). Also the case in 1.0.3. We will
    add it in the next release.
  • Dependencies: requests and werkzeug are unbounded in requirements.txt (added
    in ci: replace base url with prod env #23, unchanged here). Both are already bounded transitive dependencies of
    dify_plugin (requests~=2.32.3, Werkzeug~=3.0.3), so effective versions are
    constrained by the runtime.
  • The only functional change in this release is the apify-client v3 migration
    described above. No bundled binaries. minimum_dify_version is 1.11.4.

@github-actions github-actions Bot added the risk: medium Medium-risk Marketplace submission label Aug 11, 2026

Copy link
Copy Markdown
Member

Hi @jakcinmarina — here is the current CI summary for commit 1fe74e8.

❌ Blocking errors

  • The secret scanner flags assignments at tools/client.py:21,25 and provider/apify.py:83,112,118,128,161,178,184,196. Please remove real secrets or adjust the code so credential values are not treated as embedded/propagated secrets.
  • manifest.yaml is missing the required repo and contact fields.
  • README.md must include the source repository URL.
  • Dependency policy failures:
    • requests and werkzeug have no version constraints in both requirements.txt and pyproject.toml.
    • dify_plugin>=0.4.2,<0.5.0 must be updated to dify_plugin>=0.9.0 or newer in both files.
    • Dev dependencies flake8 and ruff have no version constraints.

⚠️ Warnings / review items

  • Review possible secret-field constants at provider/apify.py:19,22.
  • State whether the version update contains breaking changes in “What changed” or “Reviewer notes.”
  • Disclose/review network requests at provider/apify.py:110,175 and browser automation at tools/scrape_single_url.py:33.
  • Python-safety review: credential-like values may be exposed at tools/client.py:29,31 and provider/apify.py:135,202.
  • The financial-activity scanner flagged the README's competitor-pricing example as “payment processing”; please clarify if this is a false positive.
  • Workflow infrastructure warning (not caused by this PR): checkout/setup-python still target deprecated Node.js 20 and are being forced onto Node.js 24.

Open the failed pre-check-plugin job

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

risk: medium Medium-risk Marketplace submission

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants