Skip to content

chore(deps): bump impit from 0.14.1 to 0.14.2 - #110

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/impit-0.14.2
Jun 29, 2026
Merged

github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/impit-0.14.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 29, 2026

Copy link
Copy Markdown
Contributor

Bumps impit from 0.14.1 to 0.14.2.

Release notes

Sourced from impit's releases.

impit-node@0.14.2

Changelog

All notable changes to this project will be documented in this file.

js-0.14.2 - 2026-06-22

Bug Fixes

  • Raise on mid-stream body errors instead of silent EOF (#482)

    • Mid-stream body errors (connection reset, truncated chunked transfer) were mapped to StopIteration/StopAsyncIteration, which signal normal end-of-iteration — so for/async for ended silently and callers processed partial bodies as complete (a silent data-integrity bug, #475). Both sync and async iterators now propagate the classified ImpitError as a real exception and set the consumed/closed flags consistently with the clean-EOF branch. Streamed truncation surfaces in reqwest as a Decode-kinded error rather than Body, so the existing unexpected-EOF classification missed it and fell through to the catch-all HTTPError. The guard is widened to cover is_decode(), so truncated streams now raise RemoteProtocolError, matching httpx. Verified against a vanilla server that truncates the body mid-response; added sync + async regression tests.
  • Encode string chunks when serializing stream bodies (#487)

Features

  • Add iOS 18 system TLS fingerprint (#465)
    • Adds an iOS 18 system TLS fingerprint as Browser::Ios18 (string: "ios18").

js-0.14.1 - 2026-05-29

Bug Fixes

  • Handle missing APIFY_HTTPBIN_TOKEN in musllinux aarch64 Python tests (#444)

    • Third-party PRs run without repository secrets, and the musllinux aarch64 Python job was passing APIFY_HTTPBIN_TOKEN to run-on-arch-action in a way that produced a non-flat env value. That caused the job to fail before tests could use their existing fallback behavior. ---------
  • Migrate http3 DNS lookup from hickory-client to hickory-resolver (#454)

    • impit/src/http3.rs only used hickory to fire a single HTTPS-record DNS query against a hard-coded 8.8.8.8:53 for h3 discovery. Migrated that to hickory-resolver 0.26.1, which: - pulls in the patched hickory-proto 0.26.1, - uses the system DNS config instead of hard-coding Google's resolver, - drops the manual background-task plumbing and Drop impl since the resolver manages its own connections. API shifts handled along the way: Record::data() → Record.data (now a public field), SVCB::svc_params() → SVCB.svc_params (public field).
  • Drop only-allow preinstall from the published package (#464)

js-0.14.0 - 2026-05-07

Features

  • Return the vanillaFallback option as an alternative for failing requests (#441)
    • The vanillaFallback option has been noop in a few of the latest versions of impit. The changes from this PR return this feature to support, e.g., servers with old TLS stacks that uncover some of the emulation discrepancies and cause the requests to fail.

js-0.13.1 - 2026-04-22

Bug Fixes

... (truncated)

Commits
  • 372d4a5 chore(js-release): Update package version [skip ci]
  • f52afa7 fix(node): encode string chunks when serializing stream bodies (#487)
  • ef7f4e9 docs: update changelog [skip ci]
  • 4599228 chore(py-release): bump pyproject.toml version [skip ci]
  • 163dc64 chore: bump pyo3 to 0.29.0 (#485)
  • 9678630 chore(deps): update actions/checkout action to v7 (#484)
  • 42f163b fix(python): raise on mid-stream body errors instead of silent EOF (#482)
  • 25cf5cb chore(deps): bump js-yaml and markdown-it to resolve security alerts (#483)
  • 195a7a1 fix(python): share browser-string resolution across sync and async clients (#...
  • c1d8c10 chore(deps): update dependency proxy-chain to v3 (#460)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [impit](https://github.com/apify/impit) from 0.14.1 to 0.14.2.
- [Release notes](https://github.com/apify/impit/releases)
- [Commits](apify/impit@js-0.14.1...js-0.14.2)

---
updated-dependencies:
- dependency-name: impit
  dependency-version: 0.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Dependency updates and dependency maintenance label Jun 29, 2026
@dependabot
dependabot Bot requested a review from Medformatik as a code owner June 29, 2026 04:27
@dependabot dependabot Bot added the dependencies Dependency updates and dependency maintenance label Jun 29, 2026
@github-actions
github-actions Bot enabled auto-merge (squash) June 29, 2026 04:27
@github-actions
github-actions Bot merged commit 828933a into main Jun 29, 2026
8 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/impit-0.14.2 branch June 29, 2026 04:32
Medformatik added a commit that referenced this pull request Oct 28, 2026
…ge as such (#657)

## What changed and why

On openmapx.com, Overpass rejects a query string repeated within about
30 seconds (diagnosed read-only on the host, not by me):
- **Cause:** the `wiktorn/overpass-api` image sets
`OVERPASS_ALLOW_DUPLICATE_QUERIES=no`. Its dispatcher then answers a
query string that is running, or ran moments ago, with `runtime error:
open64: 0 Success /osm3s_osm_base
Dispatcher_Client::request_read_and_idx::duplicate_query`. That answer
is an HTML page with **HTTP 200**.
- **Health:** our Docker healthcheck and `check`'s probe send the same
`node(1)` string every time. The healthcheck failed 3 of its last 4
runs; the container only stays "healthy" because of `retries: 3`. This
is the intermittent `check` failure, `response missing "elements"`.
- **Users:** `packages/core/src/utils/overpass/client.ts` called
`res.json()` on that 200 HTML page. A user's query repeated within the
window failed with a `SyntaxError`.

**1. The bundled service allows repeated queries.**
`services/overpass/service.json` sets
`"OVERPASS_ALLOW_DUPLICATE_QUERIES":
"${OVERPASS_ALLOW_DUPLICATE_QUERIES:-yes}"`.
- **Private instance:** only app-api, which bounds its requests, and the
OpenConditions ingest reach it.
- **Both dispatchers take it:** I checked the pinned image
(`sha256:9bb5f4a9…`) locally. The main dispatcher's
`/app/bin/dispatcher_start.sh` passes
`--allow-duplicate-queries=${OVERPASS_ALLOW_DUPLICATE_QUERIES}`.
`dispatcher_areas` in `/etc/supervisor/conf.d/supervisord.conf` runs
`dispatcher --areas …
--allow-duplicate-queries=%(ENV_OVERPASS_ALLOW_DUPLICATE_QUERIES)s`. The
image's own `ENV` is `no`.
- **Why the image's healthcheck works and ours didn't:** the image's
`docker-healthcheck.sh` queries a random node id when duplicates aren't
allowed. Ours is a fixed string, and works with them allowed.
- **Opting out:** set `OVERPASS_ALLOW_DUPLICATE_QUERIES=no` in
`infra/docker/.env`. It's documented in `infra/docker/.env.example` and
`install/configuration.md`.
- **Wrong comment fixed:** the comment over the probe in
`packages/cli/src/commands/check.ts` blamed an orphaned shared-memory
segment after a timeout-less query. It now names the real cause.
- **Nothing to regenerate:** `check-service-files` reports "21 service
files: the bundle list and their history are current". The history
covers service files, not manifests, and no other generated file mirrors
Overpass's environment.

**2. The client never surfaces Overpass's error page as a
`SyntaxError`.** It reads a 200 body as text and parses it as JSON. A
body that isn't JSON is checked for Overpass's error page: each
`<strong>Error</strong>: …` paragraph's text, with tags dropped
(repeatedly, until none is left, so nested tags can't leave one) and
entities decoded. A numeric entity is decoded only when it's a valid
code point (up to `0x10FFFF`); any other, such as `&#99999999;`, stays
as written instead of throwing a `RangeError`. That text is then
classified as follows, matching how statuses and remarks are already
handled:

| Error page says | Error | Like |
| --- | --- | --- |
| a dispatcher or runtime error: `duplicate_query`, `Dispatcher_Client`,
`runtime error` | `OverpassUnavailableError`, with Overpass's text in
its message and `detail` | 504 / 408 / a timeout without an answer |
| `timed out`, `out of memory` | `OverpassTimeoutError` | the
runtime-limit remark |
| `rate_limited` | `OverpassRateLimitError` | 429 |
| anything else (a parse error, say) | `Error("Overpass API error:
<text>")` | other failures |
| a body that is neither JSON nor such a page | `Error("Overpass API
answered with a body that is neither JSON nor an error page")` | |

Because the error is `OverpassUnavailableError`, a query to the default
public endpoint falls back to the public mirror, as for a 504. A
configured local instance (`OVERPASS_URL`, as here) gets no fallback, as
before.

**3. Release note** (`release-notes/overpass-duplicate-queries.md`,
`operator-action`): the setting is in Overpass's container environment,
so a render alone doesn't apply it. Recreate it once on the host with
`pnpm openmapx services update overpass --no-deps`; its database
persists and the dispatchers restart.

## Verification

- **Tests, `packages/core/src/utils/overpass/client.test.ts`**, with an
error page in the shape osm3s writes, carrying the exact
`duplicate_query` text from openmapx.com:
- **Repeated query:** it's an `OverpassUnavailableError` whose message
carries that text, never a `SyntaxError`.
- **Public endpoint:** the same page tries the public mirror, as a 504
does.
- **Timeouts and rate limits:** a `Query timed out` page is an
`OverpassTimeoutError`, and a dispatcher `rate_limited` page an
`OverpassRateLimitError`.
- **Other pages:** a parse error keeps its decoded text
(`&quot;nod&quot;` becomes `"nod"`), and a non-JSON, non-page body says
so.
- **Nested tags:** `<b<i>>dis</i>patcher</b>` comes out as `dispatcher`.
- **Numeric entities:** `&#110;` decodes and `&#1114111;` (the last code
point) decodes, while `&#99999999;` and `&#1114112;` stay as written;
never a `RangeError`. Run against the previous code, this test fails
with `RangeError: Invalid code point 99999999`.
- **Updated:** `integrations/transit-overpass/overpass.test.ts` faked
`fetch` with an object that had only `json()`. The client now reads the
body with `text()`, so that test answers with a real `Response`.
- **Ran locally:**
- the full node project (`vitest run --project node`): 18268 passed, 265
skipped, none failed;
- `vitest --project node` over `packages/core`, `packages/cli`,
`integrations/poi-search`, `apps/api/src/routes` and the authority-gate
script tests: 5364 passed and 20 skipped, with the Overpass client tests
now at 16 passed (with poi-search: 92);
  - `tsc --noEmit` for core and cli, and `biome check`;
  - `prettier --check` on the docs and the release note;
  - `check-service-files`;
- the extension-cli `dist/cli.js` is byte-identical to `origin/main`'s.
- **Not run:** Overpass itself. I didn't start the image with a
database, so I haven't seen the dispatcher accept a repeated query with
the setting, nor a recreate on a host. The flag's effect is as the
image's scripts above show. I didn't touch the production host.

## Release and upgrade impact

Product impact: operator-action

No package release: `@openmapx/extension-cli`'s built `dist/cli.js` is
byte-identical on `origin/main` and on this branch; the core change
doesn't reach its artifact.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Dependency updates and dependency maintenance

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants