[apify-deps]

Summary

Dependency sweep — security bumps (all within existing ranges, lockfile-only):

• pypdf 6.21.1 → 6.21.4 (high) — root uv.lock. Covers 10 separate advisories on the <6.21.2/<6.21.3/<6.21.4 lines.
• pyasn1 0.6.4 → 0.6.5 (high) — root uv.lock. Covers 4 separate advisories.
• nltk 3.10.3 → 3.10.4 (high) — root uv.lock.
• Twisted 26.4.0 → 26.10.0 (high/medium/low) — root uv.lock. Covers 8 separate advisories; a stable patched release now exists (previously only an rc was out).
• brotli 1.2.0 → 1.2.1 (critical) — root uv.lock and templates/python-uv/uv.lock.
• brotlicffi 1.2.0.2 → 1.2.1.0 (critical) — root uv.lock.
• dnspython 2.8.0 → 2.9.1 (high) — templates/python-uv/uv.lock, via apify/crawlee bumps.
• certifi — removed entirely from templates/python-uv/uv.lock: the newer apify/crawlee no longer pull it transitively, so no vulnerable copy remains (critical).
• filelock — removed entirely from templates/python-uv/uv.lock for the same reason (resolves 9 separate advisories across several severities).

Root uv.lock's broad uv lock --upgrade refresh was tried first but reverted: it also bumped ty 0.0.81→0.0.95, which introduces a new (unrelated) invalid-mutable-override diagnostic on the scrapy spider's parse override — narrowed to a targeted uv lock --upgrade-package for just the 6 vulnerable packages above so the root lockfile stays on ty 0.0.81 and CI stays green. templates/python-uv/uv.lock took the broad refresh cleanly (ruff format/check pass; no new ty errors — only pre-existing warnings).

No manifest (pyproject.toml) changes — lockfile-only on both projects. All 40 open alerts covered; none required dismissal or further flagging.

🤖 Generated with Claude Code