Repository navigation
chore(deps): scheduled patch/minor dependency updates for js-sdk / cli / python-sdk - #1994
Conversation
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
….1, playwright 1.64.0, wrangler 4.149.0, wcmatch 11.1 Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
|
I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".
|
🦋 Changeset detectedLatest commit: f7b8d5b The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
There was a problem hiding this comment.
TASTE.md review: complies — dependency/lockfile-only change (no edits to the public JS/Python SDK surface), so T-1–T-74 (parity, API shape, timeouts, config, module structure, errors, deprecation, docstrings) have nothing to apply to; 0 violations.
Package ArtifactsBuilt from 8877a3f. Download artifacts from this workflow run. JS SDK ( npm install ./e2b-dockerfile-utils-0.1.2-devin-1792393360-sdk-dep-updates.0.tgz ./e2b-2.56.1-devin-1792393360-sdk-dep-updates.0.tgzCLI ( npm install ./e2b-cli-2.22.1-devin-1792393360-sdk-dep-updates.0.tgzCode Interpreter JS SDK ( npm install ./e2b-code-interpreter-2.9.1-devin-1792393360-sdk-dep-updates.0.tgzDesktop JS SDK ( npm install ./e2b-desktop-2.5.1-devin-1792393360-sdk-dep-updates.0.tgzPython SDK ( pip install ./e2b_dockerfile_utils-0.1.1+devin.1792393360.sdk.dep.updates-py3-none-any.whl ./e2b-2.56.0+devin.1792393360.sdk.dep.updates-py3-none-any.whlCode Interpreter Python SDK ( pip install ./e2b_code_interpreter-2.11.0+devin.1792393360.sdk.dep.updates-py3-none-any.whlDesktop Python SDK ( pip install ./e2b_desktop-2.7.0+devin.1792393360.sdk.dep.updates-py3-none-any.whl |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
|
CI triage for the failing SDK Tests jobs. None of the failures look caused by this PR's dependency changes:
Lint, Typecheck, Generated files, Build Packages, all CLI jobs, and the production Python, deno, bun, browser and cloudflare jobs all pass. The staging |
…SA-wq5f-xc86-pv6w) (#1995) ## Summary Clears [GHSA-wq5f-xc86-pv6w](GHSA-wq5f-xc86-pv6w) (**high**): `sharp <0.35.5` bundles a librsvg vulnerable to CVE-2026-96889. The GHSA itself has no CVE ID assigned; the CVE in the title is the upstream librsvg one it references. ```diff # pnpm-workspace.yaml overrides (+ matching line in pnpm-lock.yaml) - sharp@<0.35.4: ^0.35.4 + sharp@<0.35.5: ^0.35.5 ``` Patch-level bump of the existing override. When this PR was opened, `sharp@0.35.4` came in through the `packages/js-sdk` devDependency chain `wrangler > miniflare > sharp`. #1994 has since bumped `wrangler` on `main`, so the resolved tree is already on `sharp@0.35.5`. After merging `main`, this PR only raises the override floor so a vulnerable `sharp` can't be resolved again. 0.35.5 was published 2026-09-27, so it satisfies `minimumReleaseAge`. **Dev-only:** no published package (`e2b`, `@e2b/cli`, Python SDK) depends on `sharp`, so no changeset. ## Verification - `pnpm install --frozen-lockfile` passes. `pnpm why -r sharp` shows only `sharp@0.35.5`. - `pnpm audit`: the sharp advisory no longer shows up. What's left is `braces` (high, CVE-2026-93687) and `sprintf-js` (moderate, CVE-2026-97058). Neither has a patched version, and both come only through `@changesets/*` release tooling. - On the first CI run, lint, typecheck, build and the Cloudflare/miniflare tests passed. Some SDK integration jobs failed against the live staging/production API: template-build error-message mismatch, an auto-resume test, and a 503. Other PRs that ran at the same time failed the same staging jobs. Link to Devin session: https://app.devin.ai/sessions/4bc93953132c4fc3808932cf35fde056 Open in Devin Desktop: https://app.devin.ai/desktop/session/4bc93953132c4fc3808932cf35fde056?variant=devin <!-- devin-review-badge-begin --> --- <a href="https://app.devin.ai/review/e2b-dev/e2b/pull/1995" target="_blank"><picture><source media="(prefers-color-scheme: dark)" srcset="https://static.devin.ai/assets/gh-devin-review-dark.svg?v=4"><img src="https://static.devin.ai/assets/gh-devin-review-light.svg?v=4" alt="Devin Review"></picture></a> <!-- devin-review-badge-end --> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
![https://static.devin.ai/assets/gh-devin-review-dark.svg?v=4"><img](https://static.devin.ai/assets/gh-devin-review-dark.svg?v=4"><img){kind=link}
1 participant
Summary
Scheduled dependency refresh for
packages/js-sdk,packages/cli,packages/python-sdk. Only versions published ≥7 days ago (cutoff 2026-10-12) were taken; changelogs reviewed, no code changes needed.Commit 1 — patch
python-dotenvCommit 2 — minor
@bufbuild/protobuf@redocly/clicodegen.Dockerfileredocly bundletargets → generated specs identicalplaywrightscreen, JSX via tsconfig,--update-snapshots=missing, hidden iframes) don't touch our vitest-browser usage; lock pinned to 1.64.0 (1.64.1 is <7d)wranglersharpfrom the lockwcmatch>=10.1,<12unchanged)Changeset:
e2b(JS) patch for the@bufbuild/protobufruntime bump. Python deps are lock-only, so no Python changeset.Majors — not included (need migration work, tracked in #1908):
commander11→15,inquirer12→14,@inquirer/prompts7→8,@npmcli/package-json7→8,boxen7→9,chalk5→6,@iarna/toml2→3,dotenv16→18,knip5→6,msw2→3,json-schema-to-typescript15→16,vitest/@vitest/*4→5,@types/node22→26,tsdown0.22→0.23,@cloudflare/vitest-pool-workers0.18→0.23; Pythonconnectrpc0.11→0.12,protobuf-py0.1→0.6,ruff0.11→0.17,ty0.0.15→0.0.89, codegen pins (datamodel-code-generator,protoc-gen-*,black).Too new (<7 days), re-check next run:
undici8.12.2,vitest/@vitest/*4.1.12,playwright1.64.1,wrangler≥4.150,@redocly/cli≥2.62.2.Verification
pnpm run lint,pnpm run format,pnpm run typecheck— passpnpm build— passvitest --project unit: 757 passed / 8 failed. Failures arelist.test.ts/create.test.ts > metadata(sandbox list API returning empty results — same symptom as the Python list failures below, which reproduce onmain) and the knownhttpbintemplate gappytest -n 8: 1423 passed / 16 failed. All aretest_sbx_list.py+test_file_symlink; the same tests fail identically on a cleanmaincheckout (env/backend), so not caused by this PRLink to Devin session: https://app.devin.ai/sessions/b12b35bc9dee4f82aaffcf9875575781
Open in Devin Desktop: https://app.devin.ai/desktop/session/b12b35bc9dee4f82aaffcf9875575781?variant=devin