firecrawl 4.25.4 → 4.26.0

package/audit-ci.jsonc

@@ -1,4 +1,12 @@
 {
     "$schema": "https://github.com/IBM/audit-ci/raw/main/docs/schema.json",
-    "low": true
+    "low": true,
+    "allowlist": [
+        // GHSA-h67p-54hq-rp68 (js-yaml):
+        // Jest coverage tooling still resolves a js-yaml 3.x line; the non-affected
+        // release is 4.x, so avoid a major-crossing override in this SDK package.
+        // Owner: team-engineering-reviewers. Tracking: create internal ticket.
+        // Expires: 2026-06-30.
+        "GHSA-h67p-54hq-rp68"
+    ]
 }

package/dist/{chunk-BVQPX6RA.js → chunk-P63N5KWQ.js}

@@ -12,7 +12,7 @@ var require_package = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@mendable/firecrawl-js",
-      version: "4.25.4",
+      version: "4.26.0",
       description: "JavaScript SDK for Firecrawl API",
       main: "dist/index.js",
       types: "dist/index.d.ts",
@@ -38,7 +38,7 @@ var require_package = __commonJS({
       author: "Mendable.ai",
       license: "MIT",
       dependencies: {
-        axios: "1.16.1",
+        axios: "1.18.0",
         firecrawl: "4.16.0",
         "typescript-event-target": "^1.1.1",
         zod: "^3.23.8",
@@ -84,6 +84,8 @@ var require_package = __commonJS({
           "brace-expansion": ">=5.0.6",
           "axios@>=1.0.0 <1.16.0": "1.16.1",
           "follow-redirects@<1.16.0": ">=1.16.0 <2.0.0",
+          "form-data@>=4.0.0 <4.0.6": "4.0.6",
+          "@babel/core@>=7.0.0 <7.29.6": "7.29.7",
           "esbuild@>=0.17.0 <0.28.1": "0.28.1"
         }
       }

package/dist/index.cjs

@@ -39,7 +39,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@mendable/firecrawl-js",
-      version: "4.25.4",
+      version: "4.26.0",
       description: "JavaScript SDK for Firecrawl API",
       main: "dist/index.js",
       types: "dist/index.d.ts",
@@ -65,7 +65,7 @@ var require_package = __commonJS({
       author: "Mendable.ai",
       license: "MIT",
       dependencies: {
-        axios: "1.16.1",
+        axios: "1.18.0",
         firecrawl: "4.16.0",
         "typescript-event-target": "^1.1.1",
         zod: "^3.23.8",
@@ -111,6 +111,8 @@ var require_package = __commonJS({
           "brace-expansion": ">=5.0.6",
           "axios@>=1.0.0 <1.16.0": "1.16.1",
           "follow-redirects@<1.16.0": ">=1.16.0 <2.0.0",
+          "form-data@>=4.0.0 <4.0.6": "4.0.6",
+          "@babel/core@>=7.0.0 <7.29.6": "7.29.7",
           "esbuild@>=0.17.0 <0.28.1": "0.28.1"
         }
       }
@@ -164,7 +166,10 @@ var HttpClient = class {
       baseURL: this.apiUrl,
       timeout: options.timeoutMs ?? 3e5,
       headers: {
-        Authorization: `Bearer ${this.apiKey}`
+        // Omit the Authorization header entirely when no API key is set so that
+        // scrape/search/interact can use the keyless free tier (the cloud only
+        // grants it when no Authorization header is present).
+        ...this.apiKey ? { Authorization: `Bearer ${this.apiKey}` } : {}
       },
       transitional: { clarifyTimeoutError: true }
     });
@@ -1945,9 +1950,6 @@ var FirecrawlClient = class {
     const opts = typeof options === "string" ? { apiKey: options } : options;
     const apiKey = (opts.apiKey ?? process.env.FIRECRAWL_API_KEY ?? "").trim();
     const apiUrl = (opts.apiUrl ?? process.env.FIRECRAWL_API_URL ?? "https://api.firecrawl.dev").replace(/\/$/, "");
-    if (this.isCloudService(apiUrl) && !apiKey) {
-      throw new Error("API key is required for the cloud API. Set FIRECRAWL_API_KEY env or pass apiKey.");
-    }
     this.http = new HttpClient({
       apiKey,
       apiUrl,

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   require_package
-} from "./chunk-BVQPX6RA.js";
+} from "./chunk-P63N5KWQ.js";
 
 // src/v2/utils/httpClient.ts
 import axios from "axios";
@@ -34,7 +34,10 @@ var HttpClient = class {
       baseURL: this.apiUrl,
       timeout: options.timeoutMs ?? 3e5,
       headers: {
-        Authorization: `Bearer ${this.apiKey}`
+        // Omit the Authorization header entirely when no API key is set so that
+        // scrape/search/interact can use the keyless free tier (the cloud only
+        // grants it when no Authorization header is present).
+        ...this.apiKey ? { Authorization: `Bearer ${this.apiKey}` } : {}
       },
       transitional: { clarifyTimeoutError: true }
     });
@@ -1815,9 +1818,6 @@ var FirecrawlClient = class {
     const opts = typeof options === "string" ? { apiKey: options } : options;
     const apiKey = (opts.apiKey ?? process.env.FIRECRAWL_API_KEY ?? "").trim();
     const apiUrl = (opts.apiUrl ?? process.env.FIRECRAWL_API_URL ?? "https://api.firecrawl.dev").replace(/\/$/, "");
-    if (this.isCloudService(apiUrl) && !apiKey) {
-      throw new Error("API key is required for the cloud API. Set FIRECRAWL_API_KEY env or pass apiKey.");
-    }
     this.http = new HttpClient({
       apiKey,
       apiUrl,
@@ -2244,7 +2244,7 @@ var FirecrawlApp = class {
       if (typeof process !== "undefined" && process.env && process.env.npm_package_version) {
         return process.env.npm_package_version;
       }
-      const packageJson = await import("./package-4T5PXLTT.js");
+      const packageJson = await import("./package-VYUXJRD4.js");
       return packageJson.default.version;
     } catch (error) {
       const isTest = typeof process !== "undefined" && (process.env.JEST_WORKER_ID != null || false);

package/dist/{package-4T5PXLTT.js → package-VYUXJRD4.js}

@@ -1,4 +1,4 @@
 import {
   require_package
-} from "./chunk-BVQPX6RA.js";
+} from "./chunk-P63N5KWQ.js";
 export default require_package();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "firecrawl",
-  "version": "4.25.4",
+  "version": "4.26.0",
   "description": "JavaScript SDK for Firecrawl API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -19,7 +19,7 @@
   "author": "Mendable.ai",
   "license": "MIT",
   "dependencies": {
-    "axios": "1.16.1",
+    "axios": "1.18.0",
     "typescript-event-target": "^1.1.1",
     "zod": "^3.23.8",
     "zod-to-json-schema": "^3.23.0"

package/src/__tests__/unit/v2/clientOptions.test.ts

@@ -67,12 +67,11 @@ describe('Firecrawl v2 Client Options', () => {
     expect(client).toBeInstanceOf(FirecrawlClient);
   });
 
-  it('should throw for empty string API key on cloud', () => {
-    expect(() => new Firecrawl('')).toThrow('API key is required');
-  });
-
-  it('should throw for whitespace-only string API key on cloud', () => {
-    expect(() => new Firecrawl('   ')).toThrow('API key is required');
+  it('should construct without an API key for the keyless free tier', () => {
+    // No key: scrape/search/interact use the keyless free tier; the SDK no
+    // longer throws at construction.
+    expect(() => new Firecrawl('')).not.toThrow();
+    expect(() => new Firecrawl('   ')).not.toThrow();
   });
 
   it('should provide v1 accessor when constructed with string', () => {

package/src/v2/client.ts

@@ -137,9 +137,9 @@ export class FirecrawlClient {
     const apiKey = (opts.apiKey ?? process.env.FIRECRAWL_API_KEY ?? "").trim();
     const apiUrl = (opts.apiUrl ?? process.env.FIRECRAWL_API_URL ?? "https://api.firecrawl.dev").replace(/\/$/, "");
 
-    if (this.isCloudService(apiUrl) && !apiKey) {
-      throw new Error("API key is required for the cloud API. Set FIRECRAWL_API_KEY env or pass apiKey.");
-    }
+    // No API key is allowed: scrape, search, and interact fall back to the
+    // keyless free tier (rate-limited per IP). Other methods will return 401
+    // from the API until a key is provided.
 
     this.http = new HttpClient({
       apiKey,

package/src/v2/utils/httpClient.ts

@@ -34,7 +34,10 @@ export class HttpClient {
       baseURL: this.apiUrl,
       timeout: options.timeoutMs ?? 300000,
       headers: {
-        Authorization: `Bearer ${this.apiKey}`,
+        // Omit the Authorization header entirely when no API key is set so that
+        // scrape/search/interact can use the keyless free tier (the cloud only
+        // grants it when no Authorization header is present).
+        ...(this.apiKey ? { Authorization: `Bearer ${this.apiKey}` } : {}),
       },
       transitional: { clarifyTimeoutError: true },
     });