chore(deps): bump impit from 0.14.1 to 0.14.2

[dependabot]

Bumps impit from 0.14.1 to 0.14.2.

Release notes

Sourced from impit's releases.

impit-node@0.14.2

Changelog

All notable changes to this project will be documented in this file.

js-0.14.2 - 2026-06-22

Bug Fixes

• Raise on mid-stream body errors instead of silent EOF (#482)

  • Mid-stream body errors (connection reset, truncated chunked transfer) were mapped to StopIteration/StopAsyncIteration, which signal normal end-of-iteration — so for/async for ended silently and callers processed partial bodies as complete (a silent data-integrity bug, #475). Both sync and async iterators now propagate the classified ImpitError as a real exception and set the consumed/closed flags consistently with the clean-EOF branch. Streamed truncation surfaces in reqwest as a Decode-kinded error rather than Body, so the existing unexpected-EOF classification missed it and fell through to the catch-all HTTPError. The guard is widened to cover is_decode(), so truncated streams now raise RemoteProtocolError, matching httpx. Verified against a vanilla server that truncates the body mid-response; added sync + async regression tests.

• Encode string chunks when serializing stream bodies (#487)

Features

• Add iOS 18 system TLS fingerprint (#465)
  • Adds an iOS 18 system TLS fingerprint as Browser::Ios18 (string: "ios18").

js-0.14.1 - 2026-05-29

Bug Fixes

• Handle missing APIFY_HTTPBIN_TOKEN in musllinux aarch64 Python tests (#444)

  • Third-party PRs run without repository secrets, and the musllinux aarch64 Python job was passing APIFY_HTTPBIN_TOKEN to run-on-arch-action in a way that produced a non-flat env value. That caused the job to fail before tests could use their existing fallback behavior. ---------

• Migrate http3 DNS lookup from hickory-client to hickory-resolver (#454)

  • impit/src/http3.rs only used hickory to fire a single HTTPS-record DNS query against a hard-coded 8.8.8.8:53 for h3 discovery. Migrated that to hickory-resolver 0.26.1, which: - pulls in the patched hickory-proto 0.26.1, - uses the system DNS config instead of hard-coding Google's resolver, - drops the manual background-task plumbing and Drop impl since the resolver manages its own connections. API shifts handled along the way: Record::data() → Record.data (now a public field), SVCB::svc_params() → SVCB.svc_params (public field).

• Drop only-allow preinstall from the published package (#464)

js-0.14.0 - 2026-05-07

Features

• Return the vanillaFallback option as an alternative for failing requests (#441)
  • The vanillaFallback option has been noop in a few of the latest versions of impit. The changes from this PR return this feature to support, e.g., servers with old TLS stacks that uncover some of the emulation discrepancies and cause the requests to fail.

js-0.13.1 - 2026-04-22

Bug Fixes

... (truncated)

Commits

• 372d4a5 chore(js-release): Update package version [skip ci]
• f52afa7 fix(node): encode string chunks when serializing stream bodies (#487)
• ef7f4e9 docs: update changelog [skip ci]
• 4599228 chore(py-release): bump pyproject.toml version [skip ci]
• 163dc64 chore: bump pyo3 to 0.29.0 (#485)
• 9678630 chore(deps): update actions/checkout action to v7 (#484)
• 42f163b fix(python): raise on mid-stream body errors instead of silent EOF (#482)
• 25cf5cb chore(deps): bump js-yaml and markdown-it to resolve security alerts (#483)
• 195a7a1 fix(python): share browser-string resolution across sync and async clients (#...
• c1d8c10 chore(deps): update dependency proxy-chain to v3 (#460)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)