apify-client 2.23.0 → 2.23.1

package/dist/bundle.js

@@ -11881,23 +11881,6 @@ module.exports = function (str) {
 };
 
 
-},
-433(module) {
-function webpackEmptyAsyncContext(req) {
-  // Here Promise.resolve().then() is used instead of new Promise() to prevent
-  // uncaught exception popping up in devtools
-  return Promise.resolve().then(function() {
-    var e = new Error("Cannot find module '" + req + "'");
-    e.code = 'MODULE_NOT_FOUND';
-    throw e;
-  });
-}
-webpackEmptyAsyncContext.keys = () => ([]);
-webpackEmptyAsyncContext.resolve = webpackEmptyAsyncContext;
-webpackEmptyAsyncContext.id = 433;
-module.exports = webpackEmptyAsyncContext;
-
-
 },
 1089(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 "use strict";
@@ -12921,10 +12904,8 @@ class HttpClient {
     async initNode() {
         if (!(0,_utils__rspack_import_4.isNode)()) return;
         const [{ ProxyAgent }, os] = await Promise.all([
-            // eslint-disable-next-line @typescript-eslint/consistent-type-imports
-            (0,_utils__rspack_import_4.dynamicNodeImport)('proxy-agent'),
-            // eslint-disable-next-line @typescript-eslint/consistent-type-imports
-            (0,_utils__rspack_import_4.dynamicNodeImport)('node:os')
+            Promise.resolve().then(function __rspack_missing_module() { var e = new Error("Cannot find module 'proxy-agent'"); e.code = 'MODULE_NOT_FOUND'; throw e; }),
+            Promise.resolve(/* import() */).then(__webpack_require__.t.bind(__webpack_require__, 3031, 23))
         ]);
         // We want to keep sockets alive for better performance.
         // Enhanced agent configuration based on agentkeepalive best practices:
@@ -17878,7 +17859,6 @@ __webpack_require__.d(__webpack_exports__, {
   asArray: () => (asArray),
   cast: () => (cast),
   catchNotFoundOrThrow: () => (catchNotFoundOrThrow),
-  dynamicNodeImport: () => (dynamicNodeImport),
   getVersionData: () => (getVersionData),
   isBuffer: () => (isBuffer),
   isNode: () => (isNode),
@@ -17979,10 +17959,8 @@ let gzipPromisified;
     const areDataLargeEnough = Buffer.byteLength(value) >= MIN_GZIP_BYTES;
     if (areDataLargeEnough) {
         if (!gzipPromisified) {
-            // eslint-disable-next-line @typescript-eslint/consistent-type-imports
-            const { promisify } = await dynamicNodeImport('node:util');
-            // eslint-disable-next-line @typescript-eslint/consistent-type-imports
-            const { gzip } = await dynamicNodeImport('node:zlib');
+            const { promisify } = await Promise.resolve(/* import() */).then(__webpack_require__.t.bind(__webpack_require__, 6029, 23));
+            const { gzip } = await Promise.resolve(/* import() */).then(__webpack_require__.t.bind(__webpack_require__, 1134, 23));
             gzipPromisified = promisify(gzip);
         }
         return gzipPromisified(value);
@@ -18012,14 +17990,9 @@ let gzipPromisified;
     return slicedArray;
 }
 function isNode() {
+    if (true) return false;
     return !!(typeof process !== 'undefined' && process.versions && process.versions.node);
 }
-/**
- * Dynamic import wrapper that prevents bundlers from statically analyzing the import specifier.
- * Use this for Node.js-only modules that should not be included in browser bundles.
- */ async function dynamicNodeImport(specifier) {
-    return await __webpack_require__(433)(specifier);
-}
 function isBuffer(value) {
     return ow__rspack_import_0_default().isValid(value, ow__rspack_import_0_default().any((ow__rspack_import_0_default().buffer), (ow__rspack_import_0_default().arrayBuffer), (ow__rspack_import_0_default().typedArray)));
 }
@@ -18029,7 +18002,7 @@ function isStream(value) {
 function getVersionData() {
     if (true) {
         return {
-            version: "2.23.0"
+            version: "2.23.1"
         };
     }
     // eslint-disable-next-line
@@ -18113,6 +18086,21 @@ function asArray(value) {
 "use strict";
 /* (ignored) */
 
+},
+3031() {
+"use strict";
+/* (ignored) */
+
+},
+6029() {
+"use strict";
+/* (ignored) */
+
+},
+1134() {
+"use strict";
+/* (ignored) */
+
 },
 6125(__unused_rspack___webpack_module__, __webpack_exports__, __webpack_require__) {
 "use strict";
@@ -18432,6 +18420,7 @@ var APIFY_ENV_VARS = {
   PROXY_PASSWORD: "APIFY_PROXY_PASSWORD",
   PROXY_PORT: "APIFY_PROXY_PORT",
   PROXY_STATUS_URL: "APIFY_PROXY_STATUS_URL",
+  MCP_PROXY_URL: "APIFY_MCP_PROXY_URL",
   PURGE_ON_START: "APIFY_PURGE_ON_START",
   SDK_LATEST_VERSION: "APIFY_SDK_LATEST_VERSION",
   SYSTEM_INFO_INTERVAL_MILLIS: "APIFY_SYSTEM_INFO_INTERVAL_MILLIS",
@@ -19759,8 +19748,10 @@ var FORBIDDEN_USERNAMES_REGEXPS = [
   "reel",
   "video-reel",
   "mcp",
+  "mcpc",
   "model-context-protocol",
   "modelcontextprotocol",
+  // 'apify.com' intentionally unescaped so "." matches any character, also blocking variants like "apify_com" or "apifyxcom"
   "apify.com",
   "design-kit",
   "press-kit",
@@ -19770,6 +19761,76 @@ var FORBIDDEN_USERNAMES_REGEXPS = [
   "challange",
   "1m-challenge",
   "1m-usd-challenge",
+  // Apify platform resources
+  "key-value-store",
+  "request-queue",
+  "request-queues",
+  "builds",
+  "schedule",
+  // AI / LLM related
+  "llms",
+  "openai",
+  "anthropic",
+  "claude",
+  "copilot",
+  "mistral",
+  "prompt",
+  "prompts",
+  "embeddings",
+  "vectors",
+  // Organizations / workspaces / permissions
+  "orgs",
+  "workspaces",
+  "tenant",
+  "tenants",
+  "permission",
+  "permissions",
+  // Auth / security
+  "saml",
+  "scim",
+  "token",
+  "tokens",
+  "api-key",
+  "api-keys",
+  // Billing / commerce
+  "coupon",
+  "coupons",
+  "discount",
+  "discounts",
+  "promos",
+  "refund",
+  "refunds",
+  "credit",
+  "credits",
+  "billing-portal",
+  // Infrastructure / environments
+  "production",
+  "canary",
+  "restricted",
+  // Communication
+  "conversations",
+  "reactions",
+  "mentions",
+  // Legal / trust / web standards
+  "accessibility",
+  "imprint",
+  "impressum",
+  "trust",
+  "trust-center",
+  "security-center",
+  // Brand protection / impersonation prevention
+  "brand",
+  "branding",
+  "verified",
+  "apify-support",
+  "apify-team",
+  "support-team",
+  "abuse",
+  // Incidents / updates
+  "outage",
+  "incident",
+  "incidents",
+  "what-is-new",
   // Special files
   "index",
   "index\\.html",
@@ -19781,6 +19842,7 @@ var FORBIDDEN_USERNAMES_REGEXPS = [
   "(apple-touch-icon.*)",
   "security-whitepaper\\.pdf",
   "security\\.txt",
+  "llms\\.txt",
   // All hidden files
   "(\\..*)",
   // Username starting with xxx-
@@ -19938,6 +20000,7 @@ var FORBIDDEN_USERNAMES_REGEXPS = [
   "errors",
   "eval",
   "event",
+  "events",
   "exit",
   "explore",
   "facebook",
@@ -21716,14 +21779,20 @@ const factory = (env) => {
     test(() => {
       let duplexAccessed = false;
 
-      const hasContentType = new Request(_platform_index_js__rspack_import_1["default"].origin, {
+      const request = new Request(_platform_index_js__rspack_import_1["default"].origin, {
         body: new ReadableStream(),
         method: 'POST',
         get duplex() {
           duplexAccessed = true;
           return 'half';
         },
-      }).headers.has('Content-Type');
+      });
+
+      const hasContentType = request.headers.has('Content-Type');
+
+      if (request.body != null) {
+        request.body.cancel();
+      }
 
       return duplexAccessed && !hasContentType;
     });
@@ -21867,6 +21936,19 @@ const factory = (env) => {
       // see https://github.com/cloudflare/workerd/issues/902
       const isCredentialsSupported = isRequestSupported && 'credentials' in Request.prototype;
 
+      // If data is FormData and Content-Type is multipart/form-data without boundary,
+      // delete it so fetch can set it correctly with the boundary
+      if (_utils_js__rspack_import_0["default"].isFormData(data)) {
+        const contentType = headers.getContentType();
+        if (
+          contentType &&
+          /^multipart\/form-data/i.test(contentType) &&
+          !/boundary=/i.test(contentType)
+        ) {
+          headers.delete('content-type');
+        }
+      }
+
       const resolvedOptions = {
         ...fetchOptions,
         signal: composedSignal,
@@ -22595,13 +22677,29 @@ class Axios {
         Error.captureStackTrace ? Error.captureStackTrace(dummy) : (dummy = new Error());
 
         // slice off the Error: ... line
-        const stack = dummy.stack ? dummy.stack.replace(/^.+\n/, '') : '';
+        const stack = (() => {
+          if (!dummy.stack) {
+            return '';
+          }
+
+          const firstNewlineIndex = dummy.stack.indexOf('\n');
+
+          return firstNewlineIndex === -1 ? '' : dummy.stack.slice(firstNewlineIndex + 1);
+        })();
         try {
           if (!err.stack) {
             err.stack = stack;
             // match without the 2 top stack lines
-          } else if (stack && !String(err.stack).endsWith(stack.replace(/^.+\n.+\n/, ''))) {
-            err.stack += '\n' + stack;
+          } else if (stack) {
+            const firstNewlineIndex = stack.indexOf('\n');
+            const secondNewlineIndex =
+              firstNewlineIndex === -1 ? -1 : stack.indexOf('\n', firstNewlineIndex + 1);
+            const stackWithoutTwoTopLines =
+              secondNewlineIndex === -1 ? '' : stack.slice(secondNewlineIndex + 1);
+
+            if (!String(err.stack).endsWith(stackWithoutTwoTopLines)) {
+              err.stack += '\n' + stack;
+            }
           }
         } catch (e) {
           // ignore the case where "stack" is an un-writable property
@@ -22785,8 +22883,6 @@ _utils_js__rspack_import_3["default"].forEach(['delete', 'get', 'head', 'options
 });
 
 _utils_js__rspack_import_3["default"].forEach(['post', 'put', 'patch'], function forEachMethodWithData(method) {
-  /*eslint func-names:0*/
-
   function generateHTTPMethod(isForm) {
     return function httpMethod(url, data, config) {
       return this.request(
@@ -22839,40 +22935,40 @@ class AxiosError extends Error {
     return axiosError;
   }
 
-    /**
-     * Create an Error with the specified message, config, error code, request and response.
-     *
-     * @param {string} message The error message.
-     * @param {string} [code] The error code (for example, 'ECONNABORTED').
-     * @param {Object} [config] The config.
-     * @param {Object} [request] The request.
-     * @param {Object} [response] The response.
-     *
-     * @returns {Error} The created error.
-     */
-    constructor(message, code, config, request, response) {
-      super(message);
-      
-      // Make message enumerable to maintain backward compatibility
-      // The native Error constructor sets message as non-enumerable,
-      // but axios < v1.13.3 had it as enumerable
-      Object.defineProperty(this, 'message', {
-          value: message,
-          enumerable: true,
-          writable: true,
-          configurable: true
-      });
-      
-      this.name = 'AxiosError';
-      this.isAxiosError = true;
-      code && (this.code = code);
-      config && (this.config = config);
-      request && (this.request = request);
-      if (response) {
-          this.response = response;
-          this.status = response.status;
-      }
+  /**
+   * Create an Error with the specified message, config, error code, request and response.
+   *
+   * @param {string} message The error message.
+   * @param {string} [code] The error code (for example, 'ECONNABORTED').
+   * @param {Object} [config] The config.
+   * @param {Object} [request] The request.
+   * @param {Object} [response] The response.
+   *
+   * @returns {Error} The created error.
+   */
+  constructor(message, code, config, request, response) {
+    super(message);
+
+    // Make message enumerable to maintain backward compatibility
+    // The native Error constructor sets message as non-enumerable,
+    // but axios < v1.13.3 had it as enumerable
+    Object.defineProperty(this, 'message', {
+      value: message,
+      enumerable: true,
+      writable: true,
+      configurable: true,
+    });
+
+    this.name = 'AxiosError';
+    this.isAxiosError = true;
+    code && (this.code = code);
+    config && (this.config = config);
+    request && (this.request = request);
+    if (response) {
+      this.response = response;
+      this.status = response.status;
     }
+  }
 
   toJSON() {
     return {
@@ -22908,6 +23004,7 @@ AxiosError.ERR_BAD_REQUEST = 'ERR_BAD_REQUEST';
 AxiosError.ERR_CANCELED = 'ERR_CANCELED';
 AxiosError.ERR_NOT_SUPPORT = 'ERR_NOT_SUPPORT';
 AxiosError.ERR_INVALID_URL = 'ERR_INVALID_URL';
+AxiosError.ERR_FORM_DATA_DEPTH_EXCEEDED = 'ERR_FORM_DATA_DEPTH_EXCEEDED';
 
 /* export default */ const __rspack_default_export = (AxiosError);
 
@@ -22928,16 +23025,49 @@ __webpack_require__.d(__webpack_exports__, {
 
 const $internals = Symbol('internals');
 
+const INVALID_HEADER_VALUE_CHARS_RE = /[^\x09\x20-\x7E\x80-\xFF]/g;
+
+function trimSPorHTAB(str) {
+  let start = 0;
+  let end = str.length;
+
+  while (start < end) {
+    const code = str.charCodeAt(start);
+
+    if (code !== 0x09 && code !== 0x20) {
+      break;
+    }
+
+    start += 1;
+  }
+
+  while (end > start) {
+    const code = str.charCodeAt(end - 1);
+
+    if (code !== 0x09 && code !== 0x20) {
+      break;
+    }
+
+    end -= 1;
+  }
+
+  return start === 0 && end === str.length ? str : str.slice(start, end);
+}
+
 function normalizeHeader(header) {
   return header && String(header).trim().toLowerCase();
 }
 
+function sanitizeHeaderValue(str) {
+  return trimSPorHTAB(str.replace(INVALID_HEADER_VALUE_CHARS_RE, ''));
+}
+
 function normalizeValue(value) {
   if (value === false || value == null) {
     return value;
   }
 
-  return _utils_js__rspack_import_0["default"].isArray(value) ? value.map(normalizeValue) : String(value);
+  return _utils_js__rspack_import_0["default"].isArray(value) ? value.map(normalizeValue) : sanitizeHeaderValue(String(value));
 }
 
 function parseTokens(str) {
@@ -23375,7 +23505,7 @@ __webpack_require__.d(__webpack_exports__, {
  */
 function buildFullPath(baseURL, requestedURL, allowAbsoluteUrls) {
   let isRelativeUrl = !(0,_helpers_isAbsoluteURL_js__rspack_import_0["default"])(requestedURL);
-  if (baseURL && (isRelativeUrl || allowAbsoluteUrls == false)) {
+  if (baseURL && (isRelativeUrl || allowAbsoluteUrls === false)) {
     return (0,_helpers_combineURLs_js__rspack_import_1["default"])(baseURL, requestedURL);
   }
   return requestedURL;
@@ -23541,9 +23671,9 @@ function mergeConfig(config1, config2) {
 
   // eslint-disable-next-line consistent-return
   function mergeDirectKeys(a, b, prop) {
-    if (prop in config2) {
+    if (_utils_js__rspack_import_1["default"].hasOwnProp(config2, prop)) {
       return getMergedValue(a, b);
-    } else if (prop in config1) {
+    } else if (_utils_js__rspack_import_1["default"].hasOwnProp(config1, prop)) {
       return getMergedValue(undefined, a);
     }
   }
@@ -23584,7 +23714,9 @@ function mergeConfig(config1, config2) {
   _utils_js__rspack_import_1["default"].forEach(Object.keys({ ...config1, ...config2 }), function computeConfigValue(prop) {
     if (prop === '__proto__' || prop === 'constructor' || prop === 'prototype') return;
     const merge = _utils_js__rspack_import_1["default"].hasOwnProp(mergeMap, prop) ? mergeMap[prop] : mergeDeepProperties;
-    const configValue = merge(config1[prop], config2[prop], prop);
+    const a = _utils_js__rspack_import_1["default"].hasOwnProp(config1, prop) ? config1[prop] : undefined;
+    const b = _utils_js__rspack_import_1["default"].hasOwnProp(config2, prop) ? config2[prop] : undefined;
+    const configValue = merge(a, b, prop);
     (_utils_js__rspack_import_1["default"].isUndefined(configValue) && merge !== mergeDirectKeys) || (config[prop] = configValue);
   });
 
@@ -23697,6 +23829,8 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 
+const own = (obj, key) => (obj != null && _utils_js__rspack_import_0["default"].hasOwnProp(obj, key) ? obj[key] : undefined);
+
 /**
  * It takes a string, tries to parse it, and if it fails, it returns the stringified version
  * of the input
@@ -23764,20 +23898,22 @@ const defaults = {
       let isFileList;
 
       if (isObjectPayload) {
+        const formSerializer = own(this, 'formSerializer');
         if (contentType.indexOf('application/x-www-form-urlencoded') > -1) {
-          return (0,_helpers_toURLEncodedForm_js__rspack_import_3["default"])(data, this.formSerializer).toString();
+          return (0,_helpers_toURLEncodedForm_js__rspack_import_3["default"])(data, formSerializer).toString();
         }
 
         if (
           (isFileList = _utils_js__rspack_import_0["default"].isFileList(data)) ||
           contentType.indexOf('multipart/form-data') > -1
         ) {
-          const _FormData = this.env && this.env.FormData;
+          const env = own(this, 'env');
+          const _FormData = env && env.FormData;
 
           return (0,_helpers_toFormData_js__rspack_import_4["default"])(
             isFileList ? { 'files[]': data } : data,
             _FormData && new _FormData(),
-            this.formSerializer
+            formSerializer
           );
         }
       }
@@ -23793,9 +23929,10 @@ const defaults = {
 
   transformResponse: [
     function transformResponse(data) {
-      const transitional = this.transitional || defaults.transitional;
+      const transitional = own(this, 'transitional') || defaults.transitional;
       const forcedJSONParsing = transitional && transitional.forcedJSONParsing;
-      const JSONRequested = this.responseType === 'json';
+      const responseType = own(this, 'responseType');
+      const JSONRequested = responseType === 'json';
 
       if (_utils_js__rspack_import_0["default"].isResponse(data) || _utils_js__rspack_import_0["default"].isReadableStream(data)) {
         return data;
@@ -23804,17 +23941,17 @@ const defaults = {
       if (
         data &&
         _utils_js__rspack_import_0["default"].isString(data) &&
-        ((forcedJSONParsing && !this.responseType) || JSONRequested)
+        ((forcedJSONParsing && !responseType) || JSONRequested)
       ) {
         const silentJSONParsing = transitional && transitional.silentJSONParsing;
         const strictJSONParsing = !silentJSONParsing && JSONRequested;
 
         try {
-          return JSON.parse(data, this.parseReviver);
+          return JSON.parse(data, own(this, 'parseReviver'));
         } catch (e) {
           if (strictJSONParsing) {
             if (e.name === 'SyntaxError') {
-              throw _core_AxiosError_js__rspack_import_5["default"].from(e, _core_AxiosError_js__rspack_import_5["default"].ERR_BAD_RESPONSE, this, null, this.response);
+              throw _core_AxiosError_js__rspack_import_5["default"].from(e, _core_AxiosError_js__rspack_import_5["default"].ERR_BAD_RESPONSE, this, null, own(this, 'response'));
             }
             throw e;
           }
@@ -23885,7 +24022,7 @@ __webpack_require__.r(__webpack_exports__);
 __webpack_require__.d(__webpack_exports__, {
   VERSION: () => (VERSION)
 });
-const VERSION = "1.13.6";
+const VERSION = "1.15.1";
 
 },
 5267(__unused_rspack___webpack_module__, __webpack_exports__, __webpack_require__) {
@@ -23915,9 +24052,8 @@ function encode(str) {
     ')': '%29',
     '~': '%7E',
     '%20': '+',
-    '%00': '\x00',
   };
-  return encodeURIComponent(str).replace(/[!'()~]|%20|%00/g, function replacer(match) {
+  return encodeURIComponent(str).replace(/[!'()~]|%20/g, function replacer(match) {
     return charMap[match];
   });
 }
@@ -24083,8 +24219,8 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 /**
- * It replaces all instances of the characters `:`, `$`, `,`, `+`, `[`, and `]` with their
- * URI encoded counterparts
+ * It replaces URL-encoded forms of `:`, `$`, `,`, and spaces with
+ * their plain counterparts (`:`, `$`, `,`, `+`).
  *
  * @param {string} val The value to be encoded.
  *
@@ -24364,7 +24500,9 @@ function formDataToJSON(formData) {
 
     if (isLast) {
       if (_utils_js__rspack_import_0["default"].hasOwnProp(target, name)) {
-        target[name] = [target[name], value];
+        target[name] = _utils_js__rspack_import_0["default"].isArray(target[name])
+          ? target[name].concat(value)
+          : [target[name], value];
       } else {
         target[name] = value;
       }
@@ -24605,13 +24743,13 @@ const progressEventReducer = (listener, isDownloadStream, freq = 3) => {
   const _speedometer = (0,_speedometer_js__rspack_import_0["default"])(50, 250);
 
   return (0,_throttle_js__rspack_import_1["default"])((e) => {
-    const loaded = e.loaded;
+    const rawLoaded = e.loaded;
     const total = e.lengthComputable ? e.total : undefined;
-    const progressBytes = loaded - bytesNotified;
+    const loaded = total != null ? Math.min(rawLoaded, total) : rawLoaded;
+    const progressBytes = Math.max(0, loaded - bytesNotified);
     const rate = _speedometer(progressBytes);
-    const inRange = loaded <= total;
 
-    bytesNotified = loaded;
+    bytesNotified = Math.max(bytesNotified, loaded);
 
     const data = {
       loaded,
@@ -24619,7 +24757,7 @@ const progressEventReducer = (listener, isDownloadStream, freq = 3) => {
       progress: total ? loaded / total : undefined,
       bytes: progressBytes,
       rate: rate ? rate : undefined,
-      estimated: rate && total && inRange ? (total - loaded) / rate : undefined,
+      estimated: rate && total ? (total - loaded) / rate : undefined,
       event: e,
       lengthComputable: total != null,
       [isDownloadStream ? 'download' : 'upload']: true,
@@ -24720,10 +24858,18 @@ __webpack_require__.d(__webpack_exports__, {
   // Specifically not if we're in a web worker, or react-native.
 
   if (_platform_index_js__rspack_import_5["default"].hasStandardBrowserEnv) {
-    withXSRFToken && _utils_js__rspack_import_4["default"].isFunction(withXSRFToken) && (withXSRFToken = withXSRFToken(newConfig));
+    if (_utils_js__rspack_import_4["default"].isFunction(withXSRFToken)) {
+      withXSRFToken = withXSRFToken(newConfig);
+    }
 
-    if (withXSRFToken || (withXSRFToken !== false && (0,_isURLSameOrigin_js__rspack_import_6["default"])(newConfig.url))) {
-      // Add xsrf header
+    // Strict boolean check — prevents proto-pollution gadgets (e.g. Object.prototype.withXSRFToken = 1)
+    // and misconfigurations (e.g. "false") from short-circuiting the same-origin check and leaking
+    // the XSRF token cross-origin. See GHSA-xx6v-rp6x-q39c.
+    const shouldSendXSRF =
+      withXSRFToken === true ||
+      (withXSRFToken == null && (0,_isURLSameOrigin_js__rspack_import_6["default"])(newConfig.url));
+
+    if (shouldSendXSRF) {
       const xsrfValue = xsrfHeaderName && xsrfCookieName && _cookies_js__rspack_import_7["default"].read(xsrfCookieName);
 
       if (xsrfValue) {
@@ -25018,6 +25164,7 @@ function toFormData(obj, formData, options) {
   const dots = options.dots;
   const indexes = options.indexes;
   const _Blob = options.Blob || (typeof Blob !== 'undefined' && Blob);
+  const maxDepth = options.maxDepth === undefined ? 100 : options.maxDepth;
   const useBlob = _Blob && _utils_js__rspack_import_0["default"].isSpecCompliantForm(formData);
 
   if (!_utils_js__rspack_import_0["default"].isFunction(visitor)) {
@@ -25110,9 +25257,16 @@ function toFormData(obj, formData, options) {
     isVisitable,
   });
 
-  function build(value, path) {
+  function build(value, path, depth = 0) {
     if (_utils_js__rspack_import_0["default"].isUndefined(value)) return;
 
+    if (depth > maxDepth) {
+      throw new _core_AxiosError_js__rspack_import_2["default"](
+        'Object is too deeply nested (' + depth + ' levels). Max depth: ' + maxDepth,
+        _core_AxiosError_js__rspack_import_2["default"].ERR_FORM_DATA_DEPTH_EXCEEDED
+      );
+    }
+
     if (stack.indexOf(value) !== -1) {
       throw Error('Circular reference detected in ' + path.join('.'));
     }
@@ -25125,7 +25279,7 @@ function toFormData(obj, formData, options) {
         visitor.call(formData, el, _utils_js__rspack_import_0["default"].isString(key) ? key.trim() : key, path, exposedHelpers);
 
       if (result === true) {
-        build(el, path ? path.concat(key) : [key]);
+        build(el, path ? path.concat(key) : [key], depth + 1);
       }
     });
 
@@ -25804,16 +25958,16 @@ const G = getGlobal();
 const FormDataCtor = typeof G.FormData !== 'undefined' ? G.FormData : undefined;
 
 const isFormData = (thing) => {
-  let kind;
-  return thing && (
-    (FormDataCtor && thing instanceof FormDataCtor) || (
-      isFunction(thing.append) && (
-        (kind = kindOf(thing)) === 'formdata' ||
-        // detect form-data instance
-        (kind === 'object' && isFunction(thing.toString) && thing.toString() === '[object FormData]')
-      )
-    )
-  );
+  if (!thing) return false;
+  if (FormDataCtor && thing instanceof FormDataCtor) return true;
+  // Reject plain objects inheriting directly from Object.prototype so prototype-pollution gadgets can't spoof FormData (GHSA-6chq-wfr3-2hj9).
+  const proto = getPrototypeOf(thing);
+  if (!proto || proto === Object.prototype) return false;
+  if (!isFunction(thing.append)) return false;
+  const kind = kindOf(thing);
+  return kind === 'formdata' ||
+    // detect form-data instance
+    (kind === 'object' && isFunction(thing.toString) && thing.toString() === '[object FormData]');
 };
 
 /**
@@ -26469,7 +26623,7 @@ const isIterable = (thing) => thing != null && isFunction(thing[iterator]);
 },
 8330(module) {
 "use strict";
-module.exports = JSON.parse('{"name":"apify-client","version":"2.23.0","description":"Apify API client for JavaScript","main":"dist/index.js","module":"dist/index.mjs","types":"dist/index.d.ts","browser":"dist/bundle.js","unpkg":"dist/bundle.js","exports":{"./package.json":"./package.json","./browser":"./dist/bundle.js",".":{"import":"./dist/index.mjs","require":"./dist/index.js","types":"./dist/index.d.ts","browser":"./dist/bundle.js"}},"keywords":["apify","api","apifier","crawler","scraper"],"author":{"name":"Apify","email":"support@apify.com","url":"https://apify.com"},"contributors":["Jan Curn <jan@apify.com>","Marek Trunkát <marek@apify.com>","Ondra Urban <ondra@apify.com>","Jakub Drobník <jakub.drobnik@apify.com>"],"license":"Apache-2.0","repository":{"type":"git","url":"git+https://github.com/apify/apify-client-js"},"bugs":{"url":"https://github.com/apify/apify-client-js/issues"},"homepage":"https://docs.apify.com/api/client/js/","files":["dist","!dist/*.tsbuildinfo"],"scripts":{"build":"npm run clean && npm run build:node && npm run build:browser","postbuild":"gen-esm-wrapper dist/index.js dist/index.mjs","prepublishOnly":"(test $CI || (echo \\"Publishing is reserved to CI!\\"; exit 1))","clean":"rimraf dist","test":"npm run build && vitest run","test:bundling":"npm run build && npm --prefix=./test/bundling run bundle:all","lint":"eslint","lint:fix":"eslint --fix","tsc-check-tests":"tsc --noEmit --project test/tsconfig.json","format":"prettier --write .","format:check":"prettier --check .","build:node":"tsc","build:browser":"rsbuild build"},"dependencies":{"@apify/consts":"^2.50.0","@apify/log":"^2.2.6","@apify/utilities":"^2.23.2","@crawlee/types":"^3.3.0","ansi-colors":"^4.1.1","async-retry":"^1.3.3","axios":"^1.6.7","content-type":"^1.0.5","ow":"^0.28.2","proxy-agent":"^6.5.0","tslib":"^2.5.0","type-fest":"^4.0.0"},"devDependencies":{"@apify/eslint-config":"^1.0.0","@apify/tsconfig":"^0.1.1","@crawlee/puppeteer":"^3.2.2","@rsbuild/core":"^1.3.6","@rsbuild/plugin-node-polyfill":"^1.3.0","@rspack/cli":"^1.7.6","@rspack/core":"^1.7.6","@stylistic/eslint-plugin-ts":"^4.2.0","@types/async-retry":"^1.4.5","@types/compression":"^1.8.1","@types/content-type":"^1.1.5","@types/express":"^5.0.0","@types/node":"^24.0.0","ajv":"^8.17.1","body-parser":"^2.0.0","compression":"^1.7.4","esbuild":"0.27.4","eslint":"^9.24.0","eslint-config-prettier":"^10.1.2","express":"^5.0.0","gen-esm-wrapper":"^1.1.2","globals":"^17.0.0","prettier":"^3.5.3","puppeteer":"^24.0.0","rimraf":"^6.0.0","rolldown":"^1.0.0-rc.4","typescript":"^5.8.3","typescript-eslint":"^8.29.1","vitest":"^4.0.16","webpack":"^5.105.2","webpack-cli":"^7.0.0"},"packageManager":"npm@10.9.2"}')
+module.exports = JSON.parse('{"name":"apify-client","version":"2.23.1","description":"Apify API client for JavaScript","main":"dist/index.js","module":"dist/index.mjs","types":"dist/index.d.ts","browser":"dist/bundle.js","unpkg":"dist/bundle.js","exports":{"./package.json":"./package.json","./browser":"./dist/bundle.js",".":{"import":"./dist/index.mjs","require":"./dist/index.js","types":"./dist/index.d.ts","browser":"./dist/bundle.js"}},"keywords":["apify","api","apifier","crawler","scraper"],"author":{"name":"Apify","email":"support@apify.com","url":"https://apify.com"},"contributors":["Jan Curn <jan@apify.com>","Marek Trunkát <marek@apify.com>","Ondra Urban <ondra@apify.com>","Jakub Drobník <jakub.drobnik@apify.com>"],"license":"Apache-2.0","repository":{"type":"git","url":"git+https://github.com/apify/apify-client-js"},"bugs":{"url":"https://github.com/apify/apify-client-js/issues"},"homepage":"https://docs.apify.com/api/client/js/","files":["dist","!dist/*.tsbuildinfo"],"scripts":{"build":"npm run clean && npm run build:node && npm run build:browser","postbuild":"gen-esm-wrapper dist/index.js dist/index.mjs","prepublishOnly":"(test $CI || (echo \\"Publishing is reserved to CI!\\"; exit 1))","clean":"rimraf dist","test":"npm run build && vitest run","test:bundling":"npm run build && npm --prefix=./test/bundling run bundle:all","lint":"eslint","lint:fix":"eslint --fix","tsc-check-tests":"tsc --noEmit --project test/tsconfig.json","format":"prettier --write .","format:check":"prettier --check .","build:node":"tsc","build:browser":"rsbuild build"},"dependencies":{"@apify/consts":"^2.50.0","@apify/log":"^2.2.6","@apify/utilities":"^2.23.2","@crawlee/types":"^3.3.0","ansi-colors":"^4.1.1","async-retry":"^1.3.3","axios":"^1.6.7","content-type":"^1.0.5","ow":"^0.28.2","proxy-agent":"^6.5.0","tslib":"^2.5.0","type-fest":"^4.0.0"},"devDependencies":{"@apify/eslint-config":"^1.0.0","@apify/tsconfig":"^0.1.1","@crawlee/puppeteer":"^3.2.2","@rsbuild/core":"^1.3.6","@rsbuild/plugin-node-polyfill":"^1.3.0","@rspack/cli":"^1.7.6","@rspack/core":"^1.7.6","@stylistic/eslint-plugin-ts":"^4.2.0","@types/async-retry":"^1.4.5","@types/compression":"^1.8.1","@types/content-type":"^1.1.5","@types/express":"^5.0.0","@types/node":"^24.0.0","ajv":"^8.17.1","body-parser":"^2.0.0","compression":"^1.7.4","esbuild":"0.27.4","eslint":"^9.24.0","eslint-config-prettier":"^10.1.2","express":"^5.0.0","gen-esm-wrapper":"^1.1.2","globals":"^17.0.0","prettier":"^3.5.3","puppeteer":"^24.0.0","rimraf":"^6.0.0","rolldown":"^1.0.0-rc.4","typescript":"^5.8.3","typescript-eslint":"^8.29.1","vitest":"^4.0.16","webpack":"^5.105.2","webpack-cli":"^7.0.0"},"packageManager":"npm@10.9.2"}')
 
 },