[pull] main from firecrawl:main

apps/api/audit-ci.jsonc

@@ -2,13 +2,17 @@
     "$schema": "https://github.com/IBM/audit-ci/raw/main/docs/schema.json",
     "low": true,
     "allowlist": [
-        // GHSA-v2v4-37r5-5v8g / GHSA-mwp4-54f8-5fhr (ip-address):
-        // geoip-country still depends on ip-address 6.x; the non-affected
-        // line is a multi-major jump outside the upstream range.
+        // GHSA-v2v4-37r5-5v8g / GHSA-mwp4-54f8-5fhr / GHSA-rpw4-54j3-4h4q (ip-address):
+        // geoip-country@5.x requires ip-address@^6.4.0; ip-address 6.4.0 is the
+        // latest 6.x release (no patch exists in the 6.x line). A cross-major
+        // override to 10.x would break geoip-country's API surface. Our SSRF
+        // protection is handled by ipaddr.js, not ip-address, so the isLinkLocal()
+        // inaccuracy in ip-address is not reachable through security-sensitive paths.
         // Do not override across majors without compatibility approval.
         // Owner: team-engineering-reviewers. Tracking: create internal ticket.
-        // Expires: 2026-10-08.
+        // Expires: 2026-12-29.
         "GHSA-v2v4-37r5-5v8g",
-        "GHSA-mwp4-54f8-5fhr"
+        "GHSA-mwp4-54f8-5fhr",
+        "GHSA-rpw4-54j3-4h4q"
     ]
 }

apps/api/package.json

@@ -127,7 +127,7 @@
     "langsmith": "^0.6.0",
     "lodash": "^4.18.0",
     "marked": "^14.1.2",
-    "multer": "^2.3.0",
+    "multer": "^2.4.0",
     "ollama-ai-provider-v2": "^3.6.0",
     "parse-diff": "^0.11.1",
     "pdf-parse": "^1.1.1",
@@ -146,7 +146,7 @@
     "turndown": "^7.1.3",
     "typescript": "npm:@typescript/typescript6@6.0.2",
     "typescript-7": "npm:typescript@7.0.2",
-    "undici": "7.29.0",
+    "undici": "7.30.0",
     "uuid": "^13.0.1",
     "winston": "^3.14.2",
     "ws": "^8.21.0",

apps/api/pnpm-workspace.yaml

@@ -18,7 +18,7 @@ overrides:
   ajv: "^8.18.0"
   fast-xml-builder: ">=1.1.6 <2.0.0"
   fast-xml-parser: "^5.7.0"
-  fast-uri: "3.1.6"
+  fast-uri: "3.1.8"
   "glob@>=10.2.0 <10.5.0": ">=10.5.0"
   "js-yaml@>=3.0.0 <3.15.2": "3.15.2"
   "js-yaml@>=4.0.0 <4.3.2": "4.3.2"
@@ -27,7 +27,7 @@ overrides:
   "bn.js@<5.2.3": ">=5.2.3"
   "@tootallnate/once@<3.0.1": ">=3.0.1"
   yauzl: "^3.2.1"
-  undici: "7.29.0"
+  undici: "7.30.0"
   "picomatch@<4.0.4": ">=4.0.4"
   "yaml@<2.8.3": ">=2.8.3"
   "smol-toml@<1.7.1": "1.8.0"

apps/api/src/routes/exchange.ts

@@ -195,6 +195,22 @@ exchangeRouter.post(
   wrap(exchangeProxy(DISCOVER_TIMEOUT_MS, { requiresRetrieveFlag: false })),
 );
 
+exchangeRouter.get(
+  "/enrichment/preferences",
+  authMiddleware(RateLimiterMode.Labs),
+  wrap(exchangeProxy(ANALYTICS_TIMEOUT_MS, { requiresRetrieveFlag: false })),
+);
+exchangeRouter.put(
+  "/enrichment/preferences",
+  authMiddleware(RateLimiterMode.Labs),
+  wrap(exchangeProxy(ANALYTICS_TIMEOUT_MS, { requiresRetrieveFlag: false })),
+);
+exchangeRouter.post(
+  "/enrichment/plan",
+  authMiddleware(RateLimiterMode.Labs),
+  wrap(exchangeProxy(ANALYTICS_TIMEOUT_MS, { requiresRetrieveFlag: false })),
+);
+
 exchangeRouter.post(
   "/retrieve",
   authMiddleware(RateLimiterMode.Exchange, { allowAgentManagedKey: true }),

apps/playwright-service-ts/pnpm-workspace.yaml

@@ -5,4 +5,4 @@ overrides:
   "path-to-regexp@<8.4.0": ">=8.4.0"
   "qs@<6.16.0": ">=6.16.0 <7.0.0"
   "esbuild@>=0.17.0 <0.28.1": "0.28.1"
-  "ip-address@>=10.0.0 <10.3.1": "10.4.0"
+  "ip-address@>=10.0.0 <10.7.2": "10.7.2"

apps/test-suite/pnpm-workspace.yaml

@@ -7,7 +7,7 @@ overrides:
   fast-xml-builder: ">=1.1.6 <2.0.0"
   fast-xml-parser: "^5.7.0"
   "minimatch@<10.2.3": ">=10.2.3"
-  "undici@>=7.0.0 <7.29.0": "7.29.0"
+  "undici@>=7.0.0 <8.0.0": "7.30.0"
   "picomatch@<4.0.4": ">=4.0.4"
   "brace-expansion@>=5.0.0 <5.0.9": "5.0.9"
   "js-yaml@>=3.0.0 <3.15.2": "3.15.2"

apps/ui/ingestion-ui/pnpm-workspace.yaml

@@ -4,7 +4,7 @@ allowBuilds:
 overrides:
   "@humanfs/node@<0.16.8": ">=0.16.8 <0.17.0"
   ajv: "^8.18.0"
-  fast-uri: "3.1.6"
+  fast-uri: "3.1.8"
   "flatted@<3.4.2": ">=3.4.2"
   "minimatch@<10.2.3": ">=10.2.3"
   "rollup@<4.59.0": ">=4.59.0"