From b62ef0165d3d1a9065bb817d81d00f715aff2765 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 09:52:01 +0200 Subject: [PATCH 1/8] chore(deps): bump ip-address from 10.2.0 to 10.4.0 (#3954) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [ip-address](https://github.com/beaugunderson/ip-address) from 10.2.0 to 10.4.0.
Release notes

Sourced from ip-address's releases.

v10.4.0

What's Changed

Full Changelog: https://github.com/beaugunderson/ip-address/compare/v10.3.1...v10.4.0

v10.3.1

Full Changelog: https://github.com/beaugunderson/ip-address/compare/v10.3.0...v10.3.1

v10.3.0

Full Changelog: https://github.com/beaugunderson/ip-address/compare/v10.2.2...v10.3.0

v10.2.2

Full Changelog: https://github.com/beaugunderson/ip-address/compare/v10.2.1...v10.2.2

v10.2.1

Full Changelog: https://github.com/beaugunderson/ip-address/compare/v10.2.0...v10.2.1

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ip-address&package-manager=npm_and_yarn&previous-version=10.2.0&new-version=10.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apify/crawlee/network/alerts).
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index 3fb5a31111a5..bc3ddf764151 100644 --- a/yarn.lock +++ b/yarn.lock @@ -8271,9 +8271,9 @@ __metadata: linkType: hard "ip-address@npm:^10.1.1, ip-address@npm:^10.2.0": - version: 10.2.0 - resolution: "ip-address@npm:10.2.0" - checksum: 10c0/5a00aada6e922c9c69dfc800ed5d0fa3348675ebdeed0e1575f503f27ca385b5f534363c9af7ad1daf64c1f1409388cdd3cc2e9b9b0fe1c924a431378d55075a + version: 10.4.0 + resolution: "ip-address@npm:10.4.0" + checksum: 10c0/d7b0bd2624fd861afbae6e49036a9b56f9506eaff7ff38592b7b4492dd5c272b53f5356dc8cc019e318acf29a96c90a3d1af1df761960267d23efa96858270fa languageName: node linkType: hard From 5661333306116dd87ec80bcd11c96f20eeda5f0d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 10:04:26 +0200 Subject: [PATCH 2/8] chore(deps): bump undici from 6.27.0 to 6.28.0 (#3957) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [undici](https://github.com/nodejs/undici) from 6.27.0 to 6.28.0.
Release notes

Sourced from undici's releases.

v6.28.0

⚠️ Security fixes

  • GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.
  • GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.
  • GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: https://github.com/nodejs/undici/compare/v6.27.0...v6.28.0

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=undici&package-manager=npm_and_yarn&previous-version=6.27.0&new-version=6.28.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apify/crawlee/network/alerts).
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index bc3ddf764151..8c0b720cfaf5 100644 --- a/yarn.lock +++ b/yarn.lock @@ -13307,9 +13307,9 @@ __metadata: linkType: hard "undici@npm:^6.25.0": - version: 6.27.0 - resolution: "undici@npm:6.27.0" - checksum: 10c0/f88c3dae3957dbf9d93cb481440aced317bd3c4941b5914fea5efba516d51138988cdb5c76006f0bb1337e41d56c3443351055d492e73af2428521c37ba2a76f + version: 6.28.0 + resolution: "undici@npm:6.28.0" + checksum: 10c0/3029a70df06b38b5b2f30732932a1e92544c753cd82c8abdf0d35afad48e0ba91612e79fe3a442dbbb9434d6a9eba2b714d5ea28984c903dda2b5d5444f38354 languageName: node linkType: hard From 26e5e4aa1117392f90e600a0d7d29bab994856df Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 10:04:35 +0200 Subject: [PATCH 3/8] chore(deps): bump fast-uri from 3.1.4 to 3.1.5 (#3956) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.4 to 3.1.5.
Release notes

Sourced from fast-uri's releases.

v3.1.5

⚠️ Security Warning

Fix for https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7

Full Changelog: https://github.com/fastify/fast-uri/compare/v3.1.4...v3.1.5

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=fast-uri&package-manager=npm_and_yarn&previous-version=3.1.4&new-version=3.1.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apify/crawlee/network/alerts).
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index 8c0b720cfaf5..9259f17b277c 100644 --- a/yarn.lock +++ b/yarn.lock @@ -6832,9 +6832,9 @@ __metadata: linkType: hard "fast-uri@npm:^3.0.1": - version: 3.1.4 - resolution: "fast-uri@npm:3.1.4" - checksum: 10c0/f90948821ceb49980f64f89b8216ba498f5957f26035be813526a55b6145d26cbd63ef5618d5205a3292b31edc9c08589749350cd72bd86c7095eb434dceb757 + version: 3.1.5 + resolution: "fast-uri@npm:3.1.5" + checksum: 10c0/2bf60eb800dd610c65e17be436425dcb21c92aff3a87d442a8bccab0b7b071e88cf1a5d7d1ea946370b937e6fc0375c405c0296c10587e57de4f78be4646d1d0 languageName: node linkType: hard From 999a353c436b66d37a7c5b96fd946e872e958569 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 10:04:43 +0200 Subject: [PATCH 4/8] chore(deps): bump hono from 4.12.31 to 4.12.34 (#3955) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [hono](https://github.com/honojs/hono) from 4.12.31 to 4.12.34.
Release notes

Sourced from hono's releases.

v4.12.34

Security fixes

This release includes fixes for the following security issues:

memo() retains SSR output across requests, leading to cross-user data disclosure

Affects: hono/jsx (server-side rendering). Fixes memo() reusing a retained render result across requests when props compare equal, where a component reading request-scoped values from ambient context — useContext(), useRequestContext(), or getContext() — could serve HTML rendered for another user's request, disclosing account data or request-scoped secrets such as CSRF tokens. GHSA-f23p-vx2j-j53r

ReDoS in CORS middleware via Access-Control-Request-Headers

Affects: hono/cors. Fixes a whitespace-tolerant regular expression with quadratic backtracking used to parse the Access-Control-Request-Headers preflight header when allowHeaders is not configured (the default), where a single preflight request carrying a long whitespace run could consume seconds of CPU and stall request processing. GHSA-8j4g-w8fx-2239

Algorithmic complexity DoS in Language Middleware

Affects: hono/language. Fixes quadratic string processing in language-tag normalization, where a crafted language tag with a large number of hyphen-separated subtags — supplied via a query parameter, cookie, or Accept-Language header — could cause excessive CPU consumption and block the event loop. GHSA-54fx-42gc-7vw4

Proxy Helper does not remove response headers listed in the Connection header

Affects: hono/proxy. Fixes proxy() forwarding response headers that the origin's Connection header designates as connection-scoped, where headers intended only for the immediate peer — per RFC 9110 Section 7.6.1 — could be exposed to clients, disclosing connection-scoped or internal metadata. GHSA-79qm-7rj5-m7r9

Users who use hono/jsx for server-side rendering, hono/cors, hono/language, or hono/proxy are strongly encouraged to upgrade to this version.

v4.12.33

What's Changed

Full Changelog: https://github.com/honojs/hono/compare/v4.12.32...v4.12.33

v4.12.32

What's Changed

  • ci: enable reports for type & bundle size check in honojs/hono#5148
  • fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in honojs/hono#5142
  • fix(sse): emit empty id field to reset Last-Event-ID in honojs/hono#5138
  • test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in honojs/hono#5145
  • fix: use Object.create(null) when parsing query, headers, and params in honojs/hono#5161
  • fix(secure-headers): keep CSP callbacks scoped to their header in honojs/hono#5147

Full Changelog: https://github.com/honojs/hono/compare/v4.12.31...v4.12.32

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=hono&package-manager=npm_and_yarn&previous-version=4.12.31&new-version=4.12.34)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apify/crawlee/network/alerts).
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index 9259f17b277c..28fab9de9336 100644 --- a/yarn.lock +++ b/yarn.lock @@ -7777,9 +7777,9 @@ __metadata: linkType: hard "hono@npm:^4.11.4": - version: 4.12.31 - resolution: "hono@npm:4.12.31" - checksum: 10c0/f80be65cd657cc353b3e478d55424a373d11801b2a1ffc96d94def813c6d852e76bea4437f5df252b15caca98742040d26950bc9c865d8720b89a00a9eac5249 + version: 4.12.34 + resolution: "hono@npm:4.12.34" + checksum: 10c0/9d184cb95bc630622d3a8885706feb8e98170556650ce139f09e54c96b9429b3194a296ad4fb0791e7b642a21a03acbf592cb0d19d906ab5e8b78a13337d61bc languageName: node linkType: hard From 7f4df886cf8b3bd3207064aa69e1af1701781dbb Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 10:17:15 +0200 Subject: [PATCH 5/8] chore(deps): bump fast-uri from 3.1.4 to 3.1.5 in /website (#3958) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.4 to 3.1.5.
Release notes

Sourced from fast-uri's releases.

v3.1.5

⚠️ Security Warning

Fix for https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7

Full Changelog: https://github.com/fastify/fast-uri/compare/v3.1.4...v3.1.5

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=fast-uri&package-manager=npm_and_yarn&previous-version=3.1.4&new-version=3.1.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apify/crawlee/network/alerts).
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- website/yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/website/yarn.lock b/website/yarn.lock index 3fcbc94c6abf..a0c21ebf1276 100644 --- a/website/yarn.lock +++ b/website/yarn.lock @@ -9411,9 +9411,9 @@ __metadata: linkType: hard "fast-uri@npm:^3.0.1": - version: 3.1.4 - resolution: "fast-uri@npm:3.1.4" - checksum: 10c0/f90948821ceb49980f64f89b8216ba498f5957f26035be813526a55b6145d26cbd63ef5618d5205a3292b31edc9c08589749350cd72bd86c7095eb434dceb757 + version: 3.1.5 + resolution: "fast-uri@npm:3.1.5" + checksum: 10c0/2bf60eb800dd610c65e17be436425dcb21c92aff3a87d442a8bccab0b7b071e88cf1a5d7d1ea946370b937e6fc0375c405c0296c10587e57de4f78be4646d1d0 languageName: node linkType: hard From 7245307dfe52a307f318cc8a9cd261b4e45bb03e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 10:17:28 +0200 Subject: [PATCH 6/8] chore(deps): bump brace-expansion from 1.1.16 to 1.1.18 in /website (#3959) Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.16 to 1.1.18.
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=brace-expansion&package-manager=npm_and_yarn&previous-version=1.1.16&new-version=1.1.18)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apify/crawlee/network/alerts).
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- website/yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/website/yarn.lock b/website/yarn.lock index a0c21ebf1276..df57f355b734 100644 --- a/website/yarn.lock +++ b/website/yarn.lock @@ -6470,12 +6470,12 @@ __metadata: linkType: hard "brace-expansion@npm:^1.1.7": - version: 1.1.16 - resolution: "brace-expansion@npm:1.1.16" + version: 1.1.18 + resolution: "brace-expansion@npm:1.1.18" dependencies: balanced-match: "npm:^1.0.0" concat-map: "npm:0.0.1" - checksum: 10c0/b2a915bbedbf4e45840d1fb9a4d391bbf26a79475bd134714d3cee34f1f0edb0ce982738028843be5fbaf8039429f71fa487df8c915b6065ced542c83e58fae6 + checksum: 10c0/3432c18a9e2ebf94162d4effb62198bd0adea06a9f332b2c0188df5d5e30b1e51ea3c848b6608e47d0b857ebe1ea5b3888ed3326dd3c4f6f9645c94153cf9c14 languageName: node linkType: hard From 7dba89ea8fe73da9ca9bc11e2370f2fbd93345ec Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 10:33:16 +0200 Subject: [PATCH 7/8] chore(deps): bump brace-expansion from 1.1.16 to 1.1.18 in /docs (#3960) Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.16 to 1.1.18.
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=brace-expansion&package-manager=npm_and_yarn&previous-version=1.1.16&new-version=1.1.18)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apify/crawlee/network/alerts).
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- docs/yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/yarn.lock b/docs/yarn.lock index 922e466f496e..bcd982b16581 100644 --- a/docs/yarn.lock +++ b/docs/yarn.lock @@ -36,12 +36,12 @@ __metadata: linkType: hard "brace-expansion@npm:^1.1.7": - version: 1.1.16 - resolution: "brace-expansion@npm:1.1.16" + version: 1.1.18 + resolution: "brace-expansion@npm:1.1.18" dependencies: balanced-match: "npm:^1.0.0" concat-map: "npm:0.0.1" - checksum: 10c0/b2a915bbedbf4e45840d1fb9a4d391bbf26a79475bd134714d3cee34f1f0edb0ce982738028843be5fbaf8039429f71fa487df8c915b6065ced542c83e58fae6 + checksum: 10c0/3432c18a9e2ebf94162d4effb62198bd0adea06a9f332b2c0188df5d5e30b1e51ea3c848b6608e47d0b857ebe1ea5b3888ed3326dd3c4f6f9645c94153cf9c14 languageName: node linkType: hard From 5f1b0ab480f297100d2db70f646825b92f70f21a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Ad=C3=A1mek?= Date: Tue, 4 Aug 2026 12:04:46 +0200 Subject: [PATCH 8/8] fix(core): keep crawler enqueue limits when options carry explicit undefined (#3927) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up to #3924, same bug class one level down. `BasicCrawler`'s context-bound `enqueueLinks` built its call as `{ requestQueue, robotsTxtFile, respectRobotsTxtFile, onSkippedRequest, limit, ...options }`, so a user options object carrying an explicitly present `undefined` key silently discarded the computed value: ```ts await enqueueLinks({ urls, limit: config.limit }); // config.limit is not set ``` Neither `ow.optional.number` nor TypeScript (without `exactOptionalPropertyTypes`) rejects an explicit `undefined`, so the `calculateEnqueuedRequestLimit()` result was dropped — the queue kept growing past the remaining `maxRequestsPerCrawl` budget and the `enqueueLimit` skips were never reported to `onSkippedRequest`. `maxRequestsPerCrawl` is still enforced as a stop condition via `isMaxPagesExceeded()`, so the effect was queue bloat and missing reporting rather than an unbounded crawl. The same applied to `robotsTxtFile` and `respectRobotsTxtFile` (robots.txt filtering silently disabled at enqueue time), and to `requestQueue`, where the explicit `undefined` made `ow` throw instead. Unlike #3924 this isn't a pure reordering, so the semantics for each computed key: - **`limit`** — now `min(user limit, remaining maxRequestsPerCrawl budget)`. This is what `addRequests()` (`maxNewRequests` after the spread) and the per-crawler `*CrawlerEnqueueLinks` helpers have always done; this path was the outlier. A user limit larger than the remaining budget is now capped, which is a user-visible change. - **`onSkippedRequest`** — composed instead of replaced: the crawler's reporting (logging, crawler-level `onSkippedRequest`) runs, then the user's callback. Previously passing a callback to `enqueueLinks` silently disabled the crawler-level one. - **`requestQueue`, `robotsTxtFile`, `respectRobotsTxtFile`** — `??` fallbacks, so a defined user value still wins. The enqueue-limit log message now also distinguishes the two causes, instead of blaming the user's `limit` when the `maxRequestsPerCrawl` clamp is what bit. Not covered here: `JSDOMCrawler` and `LinkeDOMCrawler` never route `context.enqueueLinks` through this wrapper at all (they call the standalone `enqueueLinks()` directly, unlike `CheerioCrawler`/`BrowserCrawler` which forward the bound context function), so `crawlDepth` injection and `maxCrawlDepth` are inert there. Separate issue, separate fix. --- .../src/internals/basic-crawler.ts | 29 ++- .../src/internals/browser-crawler.ts | 4 +- .../src/internals/cheerio-crawler.ts | 4 +- .../core/src/enqueue_links/enqueue_links.ts | 9 +- test/core/crawlers/basic_crawler.test.ts | 209 ++++++++++++++++++ test/core/crawlers/cheerio_crawler.test.ts | 16 ++ 6 files changed, 258 insertions(+), 13 deletions(-) diff --git a/packages/basic-crawler/src/internals/basic-crawler.ts b/packages/basic-crawler/src/internals/basic-crawler.ts index 0b48a3080d95..76f8dbabde55 100644 --- a/packages/basic-crawler/src/internals/basic-crawler.ts +++ b/packages/basic-crawler/src/internals/basic-crawler.ts @@ -383,6 +383,9 @@ export interface BasicCrawlerOptions { return browserCrawlerEnqueueLinks({ - options: { ...enqueueOptions, limit: this.calculateEnqueuedRequestLimit(enqueueOptions?.limit) }, + // `contextEnqueueLinks` clamps `limit` by the remaining `maxRequestsPerCrawl` budget itself; + // pre-clamping it here would make the crawler log the internal limit as a user-provided one + options: enqueueOptions, page, requestQueue: await this.getRequestQueue(), robotsTxtFile: await this.getRobotsTxtFileForUrl(crawlingContext.request.url), diff --git a/packages/cheerio-crawler/src/internals/cheerio-crawler.ts b/packages/cheerio-crawler/src/internals/cheerio-crawler.ts index 3abab116763f..ab8bc4acfde5 100644 --- a/packages/cheerio-crawler/src/internals/cheerio-crawler.ts +++ b/packages/cheerio-crawler/src/internals/cheerio-crawler.ts @@ -197,7 +197,9 @@ export class CheerioCrawler extends HttpCrawler { body, enqueueLinks: async (enqueueOptions?: EnqueueLinksOptions) => { return cheerioCrawlerEnqueueLinks({ - options: { ...enqueueOptions, limit: this.calculateEnqueuedRequestLimit(enqueueOptions?.limit) }, + // `originalEnqueueLinks` clamps `limit` by the remaining `maxRequestsPerCrawl` budget itself; + // pre-clamping it here would make the crawler log the internal limit as a user-provided one + options: enqueueOptions, $, requestQueue: await this.getRequestQueue(), robotsTxtFile: await this.getRobotsTxtFileForUrl(crawlingContext.request.url), diff --git a/packages/core/src/enqueue_links/enqueue_links.ts b/packages/core/src/enqueue_links/enqueue_links.ts index c87a29428664..78290590874f 100644 --- a/packages/core/src/enqueue_links/enqueue_links.ts +++ b/packages/core/src/enqueue_links/enqueue_links.ts @@ -34,7 +34,11 @@ import { export { EnqueueStrategy }; export interface EnqueueLinksOptions extends RequestQueueOperationOptions { - /** Limit the amount of actually enqueued URLs to this number. Useful for testing across the entire crawling scope. */ + /** + * Limit the amount of actually enqueued URLs to this number. Useful for testing across the entire crawling scope. + * When called from a crawler context, the limit is further capped by what's left of the crawler's + * {@apilink BasicCrawlerOptions.maxRequestsPerCrawl|`maxRequestsPerCrawl`} budget. + */ limit?: number; /** An array of URLs to enqueue. */ @@ -197,6 +201,9 @@ export interface EnqueueLinksOptions extends RequestQueueOperationOptions { * 1. based on robots.txt file, * 2. because they don't match enqueueLinks filters, * 3. or because the maxRequestsPerCrawl limit has been reached + * + * When calling `enqueueLinks` through a crawler context, this callback runs in addition to (after) the + * crawler-level `onSkippedRequest`, it does not replace it. */ onSkippedRequest?: SkippedRequestCallback; } diff --git a/test/core/crawlers/basic_crawler.test.ts b/test/core/crawlers/basic_crawler.test.ts index d2324e6cc11a..676ab290918e 100644 --- a/test/core/crawlers/basic_crawler.test.ts +++ b/test/core/crawlers/basic_crawler.test.ts @@ -2127,6 +2127,215 @@ describe('BasicCrawler', () => { expect(visitedUrls).toContain('http://example.com/'); expect(visitedUrls).toContain('http://example.com/new'); }); + + test('enqueueLinks should respect maxRequestsPerCrawl when passed an explicitly undefined limit', async () => { + const requestQueue = await RequestQueue.open(); + const onSkippedRequest = vitest.fn(); + + const requestsToAdd = Array.from({ length: 6 }, (_, i) => `http://example.com/${i + 1}`); + + const crawler = new BasicCrawler({ + requestQueue, + maxRequestsPerCrawl: 5, + onSkippedRequest, + requestHandler: async (context) => { + if (context.request.label) { + return; + } + + crawler.stats.state.requestsFinished = 2; + + // e.g. `enqueueLinks({ urls, limit: config.limit })` where `config.limit` is not set + await context.enqueueLinks({ urls: requestsToAdd, limit: undefined, label: 'child' }); + }, + }); + + await crawler.run(['http://example.com']); + + // 2 requests already finished and 1 is in progress, so only 2 more fit into the limit + expect(requestQueue.getTotalCount()).toBe(3); + + const skippedUrls = onSkippedRequest.mock.calls + .map((call) => call[0]) + .filter(({ reason }) => reason === 'enqueueLimit') + .map(({ url }) => url) + .sort(); + + expect(skippedUrls).toEqual([ + 'http://example.com/3', + 'http://example.com/4', + 'http://example.com/5', + 'http://example.com/6', + ]); + }); + + test('enqueueLinks should clamp an explicit limit to the remaining maxRequestsPerCrawl budget', async () => { + const requestQueue = await RequestQueue.open(); + + const requestsToAdd = Array.from({ length: 6 }, (_, i) => `http://example.com/${i + 1}`); + + const crawler = new BasicCrawler({ + requestQueue, + maxRequestsPerCrawl: 5, + requestHandler: async (context) => { + if (context.request.label) { + return; + } + + crawler.stats.state.requestsFinished = 2; + + await context.enqueueLinks({ urls: requestsToAdd, limit: 4, label: 'child' }); + }, + }); + + const infoSpy = vitest.spyOn(crawler.log, 'info'); + + await crawler.run(['http://example.com']); + + // The user limit of 4 is higher than what's left of maxRequestsPerCrawl, so only 2 are enqueued + expect(requestQueue.getTotalCount()).toBe(3); + + // ...and the log message must not blame the user limit of 4 for it + expect(infoSpy).toHaveBeenCalledWith( + expect.stringContaining('due to the remaining maxRequestsPerCrawl budget of 2'), + ); + }); + + test('enqueueLinks should keep reporting skipped requests when the user passes onSkippedRequest', async () => { + const requestQueue = await RequestQueue.open(); + const crawlerOnSkippedRequest = vitest.fn(); + const userOnSkippedRequest = vitest.fn(); + + const requestsToAdd = Array.from({ length: 3 }, (_, i) => `http://example.com/${i + 1}`); + + const crawler = new BasicCrawler({ + requestQueue, + onSkippedRequest: crawlerOnSkippedRequest, + requestHandler: async (context) => { + if (context.request.label) { + return; + } + + await context.enqueueLinks({ + urls: requestsToAdd, + limit: 1, + label: 'child', + onSkippedRequest: userOnSkippedRequest, + }); + }, + }); + + await crawler.run(['http://example.com']); + + const skipped = [ + { url: 'http://example.com/2', reason: 'enqueueLimit' }, + { url: 'http://example.com/3', reason: 'enqueueLimit' }, + ]; + + for (const mock of [crawlerOnSkippedRequest, userOnSkippedRequest]) { + expect(mock.mock.calls.map((call) => call[0]).sort((a, b) => a.url.localeCompare(b.url))).toEqual( + skipped, + ); + } + }); + + test('enqueueLinks should keep the crawler robots.txt file when passed an explicitly undefined robotsTxtFile', async () => { + const requestQueue = await RequestQueue.open(); + + const crawler = new (class MockedRobotsTxtCrawler extends BasicCrawler { + override async getRobotsTxtFileForUrl(_: string) { + return RobotsTxtFile.from( + 'http://example.com/robots.txt', + `User-agent: * + Disallow: /no + `, + ); + } + })({ + requestQueue, + maxConcurrency: 1, + respectRobotsTxtFile: true, + requestHandler: async (context) => { + if (context.request.label) { + return; + } + + await context.enqueueLinks({ + urls: ['http://example.com/yes', 'http://example.com/no'], + robotsTxtFile: undefined, + label: 'child', + }); + }, + }); + + await crawler.run(['http://example.com/start']); + + // The disallowed URL should never make it into the queue + expect(requestQueue.getTotalCount()).toBe(2); + }); + + test('enqueueLinks should keep the crawler user-agent when passed an explicitly undefined respectRobotsTxtFile', async () => { + const requestQueue = await RequestQueue.open(); + const isAllowedSpy = vitest.fn((_url: string, _userAgent?: string) => true); + + const crawler = new (class MockedRobotsTxtCrawler extends BasicCrawler { + override async getRobotsTxtFileForUrl(_: string) { + return { isAllowed: isAllowedSpy } as unknown as RobotsTxtFile; + } + })({ + requestQueue, + maxConcurrency: 1, + respectRobotsTxtFile: { userAgent: 'MyCrawler' }, + requestHandler: async (context) => { + if (context.request.label) { + return; + } + + await context.enqueueLinks({ + urls: ['http://example.com/child'], + respectRobotsTxtFile: undefined, + label: 'child', + }); + }, + }); + + await crawler.run(['http://example.com/start']); + + expect(isAllowedSpy).toHaveBeenCalledWith('http://example.com/child', 'MyCrawler'); + // the crawler user-agent must not fall back to the `*` default + expect(isAllowedSpy.mock.calls.map(([, userAgent]) => userAgent)).not.toContain('*'); + }); + + test('enqueueLinks should use the request queue from the options, and the crawler one when it is undefined', async () => { + const requestQueue = await RequestQueue.open(); + const customQueue = await RequestQueue.open('custom-queue'); + + const crawler = new BasicCrawler({ + requestQueue, + requestHandler: async (context) => { + if (context.request.label) { + return; + } + + await context.enqueueLinks({ + urls: ['http://example.com/custom'], + requestQueue: customQueue, + label: 'child', + }); + + await context.enqueueLinks({ + urls: ['http://example.com/default'], + requestQueue: undefined, + label: 'child', + }); + }, + }); + + await crawler.run(['http://example.com/start']); + + expect(customQueue.getTotalCount()).toBe(1); + expect(requestQueue.getTotalCount()).toBe(2); + }); }); describe('addRequests input validation', () => { diff --git a/test/core/crawlers/cheerio_crawler.test.ts b/test/core/crawlers/cheerio_crawler.test.ts index 5696dbc3e1e9..234640a085f4 100644 --- a/test/core/crawlers/cheerio_crawler.test.ts +++ b/test/core/crawlers/cheerio_crawler.test.ts @@ -1411,6 +1411,22 @@ describe('CheerioCrawler', () => { expect(succeeded[0]).toEqual('Redirecting outside'); }); + test('enqueueLinks should not log an enqueueLinks limit when only maxRequestsPerCrawl clamps', async () => { + const crawler = new CheerioCrawler({ + maxRequestsPerCrawl: 1, + requestHandler: async ({ enqueueLinks }) => { + await enqueueLinks({ strategy: EnqueueStrategy.All }); + }, + }); + + const infoSpy = vitest.spyOn(crawler.log, 'info'); + + await crawler.run([`${serverAddress}/special/html-type`]); + + // The user passed no `limit`, so the skips must not be attributed to one + expect(infoSpy).not.toHaveBeenCalledWith(expect.stringContaining('Skipping URLs in the handler')); + }); + test('enqueueLinks should respect maxCrawlDepth', async () => { const succeeded: string[] = [];