[apify-deps]

Summary

Dependency sweep — security bumps + in-range freshening (all within existing ranges):

• vitest / @vitest/coverage-v8 5.0.3 → 5.0.5
• lerna 10.1.0 → 10.1.1
• zod 4.6.5 → 4.6.7
• marked 18.1.0 → 18.1.1
• plus transitive lockfile bumps (undici 8.11.2 → 8.12.2 on the node-gyp/pacote line, undici 7.29.0 → 7.30.1 on the cheerio line, ip-address, obug, postcss, rolldown)

🚩 Flagged — needs review

• undici 7.29.0 → 7.29.1+ (medium/low/high, 6 alerts) — pinned by nx@23.3.0 (the latest nx release) to an exact "7.29.0" with no range, via lerna's @nx/devkit dependency. It can't move in-range, and there's no existing override to bump — fixing it needs a new pnpm-workspace.yaml override, which this unattended sweep doesn't add on its own. No newer nx release exists yet to pick up a patched undici, and no Renovate PR is currently tracking it.

  • alert #205 (medium, CVE-2026-18149 — DoS via orphaned RetryHandler response body)
  • alert #204 (low, CVE-2026-18540 — downstream response splitting via retry interceptor)
  • alert #201 (medium, CVE-2026-84933 — cross-user cookie disclosure via Set-Cookie caching in shared caches)
  • alert #200 (low, CVE-2026-84947 — response truncation via oversized chunked responses in the dump interceptor)
  • alert #199 (high, CVE-2026-84961 — TLS certificate validation bypass via dropped connect options in BalancedPool)
  • alert #198 (low, CVE-2026-85008 — caching and replay of unsafe HTTP method responses)

  All six are the same underlying consumer (nx's own bundled HTTP client, used for its build/dev tooling — not exercised via attacker-controlled input in our usage, but a human should confirm before adding an override pin that reaches into nx internals).

🤖 Generated with Claude Code

[apify-deps]

Closing — repo now has lockfileRefresh: false, so the opportunistic freshening in this PR's diff (vitest/lerna/zod/marked bumps) is out of scope for the sweep.

The 6 flagged undici alerts (pinned exact by nx@23.3.0 via lerna/@nx/devkit, no in-range fix, no existing override) were re-investigated: nx's own http-client.js only dispatches through undici when an HTTP(S)_PROXY env var is set, which this repo's CI never sets, and no nx.json/Nx Cloud config exists — so nx's bundled undici is dead code in our usage (lerna changed/lerna run only use @nx/devkit for local graph calculation, never nx's CLI/cloud HTTP paths). Dismissed all 6 as not_used.

No code changes remain to apply (0 open alerts, existing esbuild override in pnpm-workspace.yaml still verified necessary) — closing this PR rather than carrying a stale freshening diff.

🤖 Generated with Claude Code