chore(deps): bump scrapling from 0.4.11 to 0.4.12

[dependabot]

Bumps scrapling from 0.4.11 to 0.4.12.

Release notes

Sourced from scrapling's releases.

Release v0.4.12

A release focused on making your spiders smarter about the websites they crawl

[!NOTE] Follow us on X for daily tips and tricks

🚀 New Stuff and quality of life changes

• Spiders can now tune their own speed with AutoThrottle. Instead of guessing a download_delay that's either too slow or gets you banned, the spider measures how fast each website answers and adjusts the delay of every domain on its own. When a website starts blocking or rate-limiting you, it doubles the delay (or waits exactly what the Retry-After header asks for) until that stops, then speeds back up. Your download_delay and any robots.txt Crawl-delay are still respected as the minimum. (Check the docs)

  class MySpider(Spider):
      name = "adaptive"
      start_urls = ["https://example.com"]
      autothrottle_enabled = True
      autothrottle_start_delay = 2.0
      autothrottle_max_delay = 30.0
      autothrottle_block_backoff = True

• Export your results to CSV and XML, next to the JSON/JSONL exporters you already had. Items that don't all share the same keys are still exported without losing anything, and nested values are written as JSON. (Check the docs)

  result = MySpider().start()
  result.items.to_csv("products.csv")
  result.items.to_xml("products.xml")

• The MCP server can now require authentication, so you can safely expose it instead of keeping it on your own machine. Any request without the token is rejected, and you can also restrict which hostnames the server answers to. (Check the docs)

  scrapling mcp --http --auth-token "$(openssl rand -hex 32)"

• Browsers now accept CDP URLs over HTTP, not just WebSocket ones. So next to the wss:// endpoints managed browser providers hand out, you can now point any browser fetcher or MCP session at a Chrome you started yourself with --remote-debugging-port=9222.

• Published Docker images are now tagged with their release version instead of only latest, so you can pin the exact version you want, by @​JanRK in #384.

🐛 Bug Fixes

• Fixed cached responses losing all their cookies when the response came from a browser engine, which silently broke any session or auth logic relying on them while using the spiders' development mode, by @​amitvijapur in #379. (Fixes #376)

• Fixed StealthyFetcher forcing the en-US locale on every browser instead of following your system's, which made websites see a mismatch between your locale and your IP address and treat you as suspicious, like Google answering with 429s. (Fixes #381)

• Fixed a misleading error message in the storage system and removed a dead call left after inserts, by @​fix2015 in #377.

Performance

• get_all_text() is now O(nodes) instead of walking up the ancestors of every single text node, which makes it around 5-6x faster on deeply nested pages, by @​yetval in #378.

🙏 Special thanks to the community for all the continuous testing and feedback

---

... (truncated)

Commits

• fc96fcc v0.4.12 (#388)
• 1166ce3 ci: lock workflows to be triggered by the repo owner alone
• 0a7fec8 feat(spiders): Add exporters to CSV/XML
• 347db4c docs: add the auto throttle option
• ca51962 feat(spiders): Auto throttle based on website speed/protection
• 9526bac agent: update the skill with the latest updates
• 563b134 feat(mcp): Add auth to the mcp server and the option to set allowed host
• 0ca4aea docs: Update main pages with the recently added features
• 9ecffdb fix(cdp): Make browsers accept CDP urls with http protocol
• f293d83 ci(docker): tag images with the release version on merge (#384)
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​scrapling@​0.4.11 ⏵ 0.4.12	+1

View full report

[github-actions]

Dependency audit failed

audit-ci detected high/critical vulnerabilities.

Failing CVEs / advisories

• CVE-2026-14257
• GHSA-22jq-vg5j-6vgg
• GHSA-2m8v-j782-fhvr
• GHSA-4cwx-7wf7-3272
• GHSA-4xrf-jv44-h6hh
• GHSA-6g55-p6wh-862q
• GHSA-8xcm-r25x-g524
• GHSA-fxqj-rqcc-2cmp
• GHSA-jr45-8vmc-qm54
• GHSA-m8rv-5g2x-5cg5
• GHSA-mwp4-54f8-5fhr
• GHSA-rgw5-rvv9-x895
• GHSA-v3r7-h72x-cjcm

[github-actions]

Dependency audit failed

audit-ci detected high/critical vulnerabilities.

Failing CVEs / advisories

• CVE-2026-14257
• GHSA-22jq-vg5j-6vgg
• GHSA-2m8v-j782-fhvr
• GHSA-4cwx-7wf7-3272
• GHSA-4xrf-jv44-h6hh
• GHSA-6g55-p6wh-862q
• GHSA-8xcm-r25x-g524
• GHSA-fxqj-rqcc-2cmp
• GHSA-jr45-8vmc-qm54
• GHSA-m8rv-5g2x-5cg5
• GHSA-mwp4-54f8-5fhr
• GHSA-rgw5-rvv9-x895
• GHSA-v3r7-h72x-cjcm

[Sam-Aitech]

@dependabot rebase

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud