Update dependency scrapy to v2.14.2

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
scrapy (changelog)	2.11.2 → 2.14.2

---

Release Notes

scrapy/scrapy (scrapy)

v2.14.2

Compare Source

• Values from the Referrer-Policy header of HTTP responses are no longer executed as Python callables. See the cwxj-rr6w-m6w7 security advisory for details.
• In line with the standard, 301 redirects of POST requests are converted into GET requests.

Full Changelog

v2.14.1

Compare Source

• Deprecate maybeDeferred_coro()
• Pass the spider arg to custom stat collectors {open,close}_spider()
• Replace deprecated Codecov CI action

Full Changelog

v2.14.0

Compare Source

• More coroutine-based replacements for Deferred-based APIs
• The default priority queue is now DownloaderAwarePriorityQueue
• Dropped support for Python 3.9 and PyPy 3.10
• Improved and documented the API for custom download handlers

Full changelog

v2.13.4

Compare Source

Fix for the CVE-2025-6176 security issue: improved protection against decompression bombs in HttpCompressionMiddleware for responses compressed using the br and deflate methods. Requires brotli >= 1.2.0.

Full changelog

v2.13.3

Compare Source

• Changed the values for DOWNLOAD_DELAY (from 0 to 1) and CONCURRENT_REQUESTS_PER_DOMAIN (from 8 to 1) in the default project template.
• Fixed several bugs in the engine initialization and exception handling logic.
• Allowed running tests with Twisted 25.5.0+ again and fixed test failures with lxml 6.0.0.

See the full changelog

v2.13.2

Compare Source

• Fixed a bug introduced in Scrapy 2.13.0 that caused results of request errbacks to be ignored when the errback was called because of a downloader error.
• Docs and error messages improvements related to the Scrapy 2.13.0 default reactor change.

See the full changelog

v2.13.1

Compare Source

• Give callback requests precedence over start requests when priority values are the same.

See the full changelog

v2.13.0

Compare Source

• The asyncio reactor is now enabled by default
• Replaced start_requests() (sync) with start() (async) and changed how it is iterated.
• Added the allow_offsite request meta key
• Spider middlewares that don't support asynchronous spider output are deprecated
• Added a base class for universal spider middlewares

See the full changelog

v2.12.0

Compare Source

• Dropped support for Python 3.8, added support for Python 3.13
• start_requests can now yield items
• Added scrapy.http.JsonResponse
• Added the CLOSESPIDER_PAGECOUNT_NO_ITEM setting

See the full changelog.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.