e2b-dev--e2b

Author	SHA1	Message	Date
Sebastion	8374033875	fix(cli): restrict ~/.e2b/config.json permissions to owner-only (#1320 ) ## Summary The CLI stores credentials (E2B access token and team API key) in plaintext at `~/.e2b/config.json`. Today the file is created with the process default umask, which on most Linux distributions and macOS results in mode `0644` — readable by every other local user and by any process running as a different UID on the same machine. This PR routes all three write sites through a single `writeUserConfig()` helper that creates `~/.e2b` as `0700` and `config.json` as `0600`, matching the convention used by the AWS CLI (`~/.aws/credentials`), `kubectl` (`~/.kube/config`), and `gh` (`~/.config/gh/hosts.yml`). - CWE: CWE-312 (Cleartext Storage of Sensitive Information) — partial mitigation. The file remains plaintext on disk (the existing `// TODO` in `user.ts` already acknowledges that keychain storage is the proper long-term fix); this change reduces exposure to other local users / less-privileged processes, which is the standard industry mitigation while plaintext storage remains. - Affected file: `packages/cli/src/user.ts` and the three writers in `packages/cli/src/commands/`. - Severity: Moderate on shared / multi-user machines (CI runners, dev VMs, jump boxes); low on single-user workstations. ## What's in `~/.e2b/config.json` ```ts { email, accessToken, // user access token teamName, teamId, teamApiKey // team API key } ``` `accessToken` authenticates the user against the E2B control plane; `teamApiKey` authorizes sandbox creation against the team. Either is sufficient to impersonate the user / spend on the team's account. ## Fix A new helper in `packages/cli/src/user.ts`: ```ts export function writeUserConfig(configPath: string, config: UserConfig): void { const dir = path.dirname(configPath) fs.mkdirSync(dir, { recursive: true, mode: 0o700 }) fs.chmodSync(dir, 0o700) fs.writeFileSync(configPath, JSON.stringify(config, null, 2), { mode: 0o600 }) fs.chmodSync(configPath, 0o600) } ``` The explicit `chmodSync` calls are intentional: `mkdirSync({ mode })` and `writeFileSync({ mode })` only set permissions when the path is created. If the directory or file already exists with looser permissions (the common case for users upgrading), `chmodSync` corrects them on the next write. Call sites updated: - `packages/cli/src/commands/auth/login.ts` - `packages/cli/src/commands/auth/configure.ts` - `packages/cli/src/commands/template/buildWithProxy.ts` `logout` uses `unlinkSync` and is unaffected. I grep'd the package for any other writers to `USER_CONFIG_PATH` — these three are the complete set. Behavior on Windows: `chmodSync` only manipulates the read-only bit on Windows, which is consistent with how the AWS/kubectl/gh CLIs behave. ACL hardening on Windows is out of scope for this change. ## Tests Added `packages/cli/tests/user_config_permissions.test.ts`, which writes a config to a temporary path and asserts the resulting directory is `0700` and file is `0600`, plus that the JSON round-trips correctly. Manually verified before/after on Linux: ``` # before this PR $ ls -l ~/.e2b/config.json -rw-r--r-- 1 user user 234 ... config.json # after $ ls -l ~/.e2b/config.json -rw------- 1 user user 234 ... config.json ``` ## Why this is worth fixing The exploitable scenario is a multi-tenant or shared-account host: another local user (or a process running as `nobody`, a CI worker UID, a sandboxed app, etc.) can `cat ~/<victim>/.e2b/config.json` and lift live credentials. No privilege escalation, no race, no special tooling — the file is simply world-readable today. Before submitting, I tried to disprove the finding: I checked whether E2B sets a restrictive umask anywhere in the CLI bootstrap (it doesn't), whether the tokens are short-lived enough to make disclosure low-impact (the access token isn't visibly rotated and the team API key is long-lived), and whether the directory itself was being created restrictively elsewhere (it wasn't — `mkdirSync` was called with default mode). None of those mitigations are in place, so the permission tightening is doing real work. This doesn't close out CWE-312 — that requires moving the secrets out of plaintext entirely, which the existing TODO acknowledges. It does close the "any local user can read it" gap, which is the cheap, high-value half of the mitigation. _Submitted by Sebastion — autonomous open-source security research from [Foundation Machines](https://foundationmachines.ai). Free for public repos via the [Sebastion AI GitHub App](https://github.com/marketplace/sebastion-ai)._ --------- Co-authored-by: Mish Ushakov <10400064+mishushakov@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-02 23:07:58 -07:00
github-actions[bot]	dead38a396	[skip ci] Release new versions	2026-06-02 14:24:33 +00:00
Yizuki_Ame	ad377962dc	fix: await async callbacks in CommandHandle.wait() (#1261 ) Fixes #1259 ## Problem The `CommandHandle.wait()` method fires `onStdout`, `onStderr`, and `onPty` callbacks without `await`, so async callbacks run as fire-and-forget microtasks. If a callback performs I/O (e.g. writing to a file, sending over network), `wait()` can resolve before the callback finishes, leading to lost data or race conditions. ## Fix Add `await` before each optional-chain callback invocation: ```diff -this.onStdout?.(stdout) +await this.onStdout?.(stdout) ``` This is fully backwards compatible — `await`-ing a sync function's return value is a no-op. ## Tests 3 parameterized test cases (`stdout`, `stderr`, `pty`) verify that `wait()` does not resolve until an async callback's promise settles. _This fix was developed with AI assistance and reviewed by a human._	2026-06-02 06:44:20 -07:00
dependabot[bot]	13f63dcd37	chore(deps-dev): bump the npm_and_yarn group across 3 directories with 1 update (#1376 ) Bumps the npm_and_yarn group with 1 update in the / directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Bumps the npm_and_yarn group with 1 update in the /packages/cli directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Bumps the npm_and_yarn group with 1 update in the /packages/js-sdk directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Updates `vitest` from 3.2.4 to 4.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitest-dev/vitest/releases">vitest's releases</a>.</em></p> <blockquote> <h2>v4.1.0</h2> <p>Vitest 4.1 is out!</p> <p>This release page lists all changes made to the project during the 4.1 beta. To get a review of all the new features, read our <a href="https://vitest.dev/blog/vitest-4-1">blog post</a>.</p> <h3> 🚀 Features</h3> <ul> <li>Return a disposable from doMock() - by <a href="https://github.com/kirkwaiblinger"><code>@kirkwaiblinger</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9332">vitest-dev/vitest#9332</a> <a href="https://github.com/vitest-dev/vitest/commit/e3e659a96"><!-- raw HTML omitted -->(e3e65)<!-- raw HTML omitted --></a></li> <li>Added chai style assertions - by <a href="https://github.com/ronnakamoto"><code>@ronnakamoto</code></a> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/8842">vitest-dev/vitest#8842</a> <a href="https://github.com/vitest-dev/vitest/commit/841df9ac5"><!-- raw HTML omitted -->(841df)<!-- raw HTML omitted --></a></li> <li>Update to sinon/fake-timers v15 and add <code>setTickMode</code> to timer controls - by <a href="https://github.com/atscott"><code>@atscott</code></a> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/8726">vitest-dev/vitest#8726</a> <a href="https://github.com/vitest-dev/vitest/commit/4b480aaed"><!-- raw HTML omitted -->(4b480)<!-- raw HTML omitted --></a></li> <li>Expose matcher types - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9448">vitest-dev/vitest#9448</a> <a href="https://github.com/vitest-dev/vitest/commit/3e4b913b1"><!-- raw HTML omitted -->(3e4b9)<!-- raw HTML omitted --></a></li> <li>Add <code>toTestSpecification</code> to reported tasks - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9464">vitest-dev/vitest#9464</a> <a href="https://github.com/vitest-dev/vitest/commit/1a4705da9"><!-- raw HTML omitted -->(1a470)<!-- raw HTML omitted --></a></li> <li>Show a warning if <code>vi.mock</code> or <code>vi.hoisted</code> are declared outside of top level of the module - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9387">vitest-dev/vitest#9387</a> <a href="https://github.com/vitest-dev/vitest/commit/5db54a468"><!-- raw HTML omitted -->(5db54)<!-- raw HTML omitted --></a></li> <li>Track and display expectedly failed tests (.fails) in UI and CLI - by <a href="https://github.com/Copilot"><code>@Copilot</code></a>, <strong>sheremet-va</strong> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9476">vitest-dev/vitest#9476</a> <a href="https://github.com/vitest-dev/vitest/commit/77d75fd34"><!-- raw HTML omitted -->(77d75)<!-- raw HTML omitted --></a></li> <li>Support tags - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9478">vitest-dev/vitest#9478</a> <a href="https://github.com/vitest-dev/vitest/commit/de7c8a521"><!-- raw HTML omitted -->(de7c8)<!-- raw HTML omitted --></a></li> <li>Implement <code>aroundEach</code> and <code>aroundAll</code> hooks - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9450">vitest-dev/vitest#9450</a> <a href="https://github.com/vitest-dev/vitest/commit/2a8cb9dc2"><!-- raw HTML omitted -->(2a8cb)<!-- raw HTML omitted --></a></li> <li>Stabilize experimental features - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9529">vitest-dev/vitest#9529</a> <a href="https://github.com/vitest-dev/vitest/commit/b5fd2a16a"><!-- raw HTML omitted -->(b5fd2)<!-- raw HTML omitted --></a></li> <li>Accept <code>new</code> or <code>all</code> in <code>--update</code> flag - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9543">vitest-dev/vitest#9543</a> <a href="https://github.com/vitest-dev/vitest/commit/a5acf28a5"><!-- raw HTML omitted -->(a5acf)<!-- raw HTML omitted --></a></li> <li>Support <code>meta</code> in test options - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9535">vitest-dev/vitest#9535</a> <a href="https://github.com/vitest-dev/vitest/commit/7d622e3d1"><!-- raw HTML omitted -->(7d622)<!-- raw HTML omitted --></a></li> <li>Support type inference with a new <code>test.extend</code> syntax - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9550">vitest-dev/vitest#9550</a> <a href="https://github.com/vitest-dev/vitest/commit/e53854fcc"><!-- raw HTML omitted -->(e5385)<!-- raw HTML omitted --></a></li> <li>Support vite 8 beta, fix type issues in the config with different vite versions - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9587">vitest-dev/vitest#9587</a> <a href="https://github.com/vitest-dev/vitest/commit/990281dfd"><!-- raw HTML omitted -->(99028)<!-- raw HTML omitted --></a></li> <li>Add assertion helper to hide internal stack traces - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> and <strong>Claude Opus 4.6</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9594">vitest-dev/vitest#9594</a> <a href="https://github.com/vitest-dev/vitest/commit/eeb0ae2f8"><!-- raw HTML omitted -->(eeb0a)<!-- raw HTML omitted --></a></li> <li>Store failure screenshots using artifacts API - by <a href="https://github.com/macarie"><code>@macarie</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9588">vitest-dev/vitest#9588</a> <a href="https://github.com/vitest-dev/vitest/commit/24603e3c4"><!-- raw HTML omitted -->(24603)<!-- raw HTML omitted --></a></li> <li>Allow <code>vitest list</code> to statically collect tests instead of running files to collect them - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9630">vitest-dev/vitest#9630</a> <a href="https://github.com/vitest-dev/vitest/commit/7a8e7fc20"><!-- raw HTML omitted -->(7a8e7)<!-- raw HTML omitted --></a></li> <li>Add <code>--detect-async-leaks</code> - by <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9528">vitest-dev/vitest#9528</a> <a href="https://github.com/vitest-dev/vitest/commit/c594d4af3"><!-- raw HTML omitted -->(c594d)<!-- raw HTML omitted --></a></li> <li>Implement <code>mockThrow</code> and <code>mockThrowOnce</code> - by <a href="https://github.com/thor-juhasz"><code>@thor-juhasz</code></a> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9512">vitest-dev/vitest#9512</a> <a href="https://github.com/vitest-dev/vitest/commit/619179fb7"><!-- raw HTML omitted -->(61917)<!-- raw HTML omitted --></a></li> <li>Support <code>update: "none"</code> and add docs about snapshots behavior on CI - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9700">vitest-dev/vitest#9700</a> <a href="https://github.com/vitest-dev/vitest/commit/05f1854e2"><!-- raw HTML omitted -->(05f18)<!-- raw HTML omitted --></a></li> <li>Support playwright <code>launchOptions</code> with <code>connectOptions</code> - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9702">vitest-dev/vitest#9702</a> <a href="https://github.com/vitest-dev/vitest/commit/f0ff1b2a0"><!-- raw HTML omitted -->(f0ff1)<!-- raw HTML omitted --></a></li> <li>Add <code>page/locator.mark</code> API to enhance playwright trace - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9652">vitest-dev/vitest#9652</a> <a href="https://github.com/vitest-dev/vitest/commit/d0ee546fe"><!-- raw HTML omitted -->(d0ee5)<!-- raw HTML omitted --></a></li> <li><strong>api</strong>: <ul> <li>Support tests starting or ending with <code>test</code> in <code>experimental_parseSpecification</code> - by <a href="https://github.com/jgillick"><code>@jgillick</code></a> and <strong>Jeremy Gillick</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9235">vitest-dev/vitest#9235</a> <a href="https://github.com/vitest-dev/vitest/commit/2f367fad3"><!-- raw HTML omitted -->(2f367)<!-- raw HTML omitted --></a></li> <li>Add filters to <code>createSpecification</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9336">vitest-dev/vitest#9336</a> <a href="https://github.com/vitest-dev/vitest/commit/c8e6c7fbf"><!-- raw HTML omitted -->(c8e6c)<!-- raw HTML omitted --></a></li> <li>Expose <code>runTestFiles</code> as alternative to <code>runTestSpecifications</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9443">vitest-dev/vitest#9443</a> <a href="https://github.com/vitest-dev/vitest/commit/43d761821"><!-- raw HTML omitted -->(43d76)<!-- raw HTML omitted --></a></li> <li>Add <code>allowWrite</code> and <code>allowExec</code> options to <code>api</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9350">vitest-dev/vitest#9350</a> <a href="https://github.com/vitest-dev/vitest/commit/20e00ef78"><!-- raw HTML omitted -->(20e00)<!-- raw HTML omitted --></a></li> <li>Allow passing down test cases to <code>toTestSpecification</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9627">vitest-dev/vitest#9627</a> <a href="https://github.com/vitest-dev/vitest/commit/6f17d5ddf"><!-- raw HTML omitted -->(6f17d)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>browser</strong>: <ul> <li>Add <code>userEvent.wheel</code> API - by <a href="https://github.com/macarie"><code>@macarie</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9188">vitest-dev/vitest#9188</a> <a href="https://github.com/vitest-dev/vitest/commit/660801979"><!-- raw HTML omitted -->(66080)<!-- raw HTML omitted --></a></li> <li>Add <code>filterNode</code> option to prettyDOM for filtering browser assertion error output - by <a href="https://github.com/Copilot"><code>@Copilot</code></a>, <strong>sheremet-va</strong> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9475">vitest-dev/vitest#9475</a> <a href="https://github.com/vitest-dev/vitest/commit/d3220fcd8"><!-- raw HTML omitted -->(d3220)<!-- raw HTML omitted --></a></li> <li>Support playwright persistent context - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a>, <strong>Claude Opus 4.6</strong> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9229">vitest-dev/vitest#9229</a> <a href="https://github.com/vitest-dev/vitest/commit/f865d2ba4"><!-- raw HTML omitted -->(f865d)<!-- raw HTML omitted --></a></li> <li>Added <code>detailsPanelPosition</code> option and button - by <a href="https://github.com/shairez"><code>@shairez</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9525">vitest-dev/vitest#9525</a> <a href="https://github.com/vitest-dev/vitest/commit/c8a31147c"><!-- raw HTML omitted -->(c8a31)<!-- raw HTML omitted --></a></li> <li>Use BlazeDiff instead of pixelmatch - by <a href="https://github.com/macarie"><code>@macarie</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9514">vitest-dev/vitest#9514</a> <a href="https://github.com/vitest-dev/vitest/commit/309362089"><!-- raw HTML omitted -->(30936)<!-- raw HTML omitted --></a></li> <li>Add <code>findElement</code> and enable strict mode in webdriverio and preview - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9677">vitest-dev/vitest#9677</a> <a href="https://github.com/vitest-dev/vitest/commit/c3f37721c"><!-- raw HTML omitted -->(c3f37)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>cli</strong>: <ul> <li>Add <a href="https://github.com/bomb"><code>@bomb</code></a>.sh/tab completions - by <a href="https://github.com/AmirSa12"><code>@AmirSa12</code></a> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/8639">vitest-dev/vitest#8639</a> <a href="https://github.com/vitest-dev/vitest/commit/200f31704"><!-- raw HTML omitted -->(200f3)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>coverage</strong>: <ul> <li>Support <code>ignore start/stop</code> ignore hints - by <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9204">vitest-dev/vitest#9204</a> <a href="https://github.com/vitest-dev/vitest/commit/e59c94ba6"><!-- raw HTML omitted -->(e59c9)<!-- raw HTML omitted --></a></li> <li>Add <code>coverage.changed</code> option to report only changed files - by <a href="https://github.com/kykim00"><code>@kykim00</code></a> and <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9521">vitest-dev/vitest#9521</a> <a href="https://github.com/vitest-dev/vitest/commit/1d9392c67"><!-- raw HTML omitted -->(1d939)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>experimental</strong>: <ul> <li>Add <code>onModuleRunner</code> hook to <code>worker.init</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9286">vitest-dev/vitest#9286</a> <a href="https://github.com/vitest-dev/vitest/commit/e977f3deb"><!-- raw HTML omitted -->(e977f)<!-- raw HTML omitted --></a></li> <li>Option to disable the module runner - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> and <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9210">vitest-dev/vitest#9210</a> <a href="https://github.com/vitest-dev/vitest/commit/9be6121ee"><!-- raw HTML omitted -->(9be61)<!-- raw HTML omitted --></a></li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitest-dev/vitest/commit/4150b913171bda3971a4a4c47c633c26d0c6ae45"><code>4150b91</code></a> chore: release v4.1.0</li> <li><a href="https://github.com/vitest-dev/vitest/commit/1de0aa22dd6311a93546a75a3c58a6be519c1baf"><code>1de0aa2</code></a> fix: correctly identify concurrent test during static analysis (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9846">#9846</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/c3cac1c1b5a91d921942e9391fbd94841717363f"><code>c3cac1c</code></a> fix: use isAgent check, not just TTY, for watch mode (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9841">#9841</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/eab68ba2b8ea6f89717c0b885c573579659d7c3b"><code>eab68ba</code></a> chore(deps): update all non-major dependencies (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9824">#9824</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/031f02a89be34491c441b4da9c4e2bacb7db71df"><code>031f02a</code></a> fix: allow catch/finally for async assertion (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9827">#9827</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/3e9e096a231fa0ec6475da82e36cbd6fcc9bc8f9"><code>3e9e096</code></a> feat(reporters): add <code>agent</code> reporter to reduce ai agent token usage (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9779">#9779</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/0c2c01361a95dd26d0d7fd7bc38bcca8dbc6e5d2"><code>0c2c013</code></a> chore: release v4.1.0-beta.6</li> <li><a href="https://github.com/vitest-dev/vitest/commit/8181e06e765f4d043818b244c76795022fa78ff6"><code>8181e06</code></a> fix: <code>hideSkippedTests</code> should not hide <code>test.todo</code> (fix <a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9562">#9562</a>) (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9781">#9781</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/a8216b0014b83612e40ef49f919d5293b68717b3"><code>a8216b0</code></a> fix: manual and redirect mock shouldn't <code>load</code> or <code>transform</code> original module...</li> <li><a href="https://github.com/vitest-dev/vitest/commit/689a22a1b8c79595f6f4ae82d2b43c895d7f1c50"><code>689a22a</code></a> fix(browser): types of <code>getCDPSession</code> and <code>cdp()</code> (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9716">#9716</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitest-dev/vitest/commits/v4.1.0/packages/vitest">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for vitest since your current version.</p> </details> <br /> Updates `vitest` from 3.2.4 to 4.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitest-dev/vitest/releases">vitest's releases</a>.</em></p> <blockquote> <h2>v4.1.0</h2> <p>Vitest 4.1 is out!</p> <p>This release page lists all changes made to the project during the 4.1 beta. To get a review of all the new features, read our <a href="https://vitest.dev/blog/vitest-4-1">blog post</a>.</p> <h3> 🚀 Features</h3> <ul> <li>Return a disposable from doMock() - by <a href="https://github.com/kirkwaiblinger"><code>@kirkwaiblinger</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9332">vitest-dev/vitest#9332</a> <a href="https://github.com/vitest-dev/vitest/commit/e3e659a96"><!-- raw HTML omitted -->(e3e65)<!-- raw HTML omitted --></a></li> <li>Added chai style assertions - by <a href="https://github.com/ronnakamoto"><code>@ronnakamoto</code></a> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/8842">vitest-dev/vitest#8842</a> <a href="https://github.com/vitest-dev/vitest/commit/841df9ac5"><!-- raw HTML omitted -->(841df)<!-- raw HTML omitted --></a></li> <li>Update to sinon/fake-timers v15 and add <code>setTickMode</code> to timer controls - by <a href="https://github.com/atscott"><code>@atscott</code></a> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/8726">vitest-dev/vitest#8726</a> <a href="https://github.com/vitest-dev/vitest/commit/4b480aaed"><!-- raw HTML omitted -->(4b480)<!-- raw HTML omitted --></a></li> <li>Expose matcher types - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9448">vitest-dev/vitest#9448</a> <a href="https://github.com/vitest-dev/vitest/commit/3e4b913b1"><!-- raw HTML omitted -->(3e4b9)<!-- raw HTML omitted --></a></li> <li>Add <code>toTestSpecification</code> to reported tasks - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9464">vitest-dev/vitest#9464</a> <a href="https://github.com/vitest-dev/vitest/commit/1a4705da9"><!-- raw HTML omitted -->(1a470)<!-- raw HTML omitted --></a></li> <li>Show a warning if <code>vi.mock</code> or <code>vi.hoisted</code> are declared outside of top level of the module - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9387">vitest-dev/vitest#9387</a> <a href="https://github.com/vitest-dev/vitest/commit/5db54a468"><!-- raw HTML omitted -->(5db54)<!-- raw HTML omitted --></a></li> <li>Track and display expectedly failed tests (.fails) in UI and CLI - by <a href="https://github.com/Copilot"><code>@Copilot</code></a>, <strong>sheremet-va</strong> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9476">vitest-dev/vitest#9476</a> <a href="https://github.com/vitest-dev/vitest/commit/77d75fd34"><!-- raw HTML omitted -->(77d75)<!-- raw HTML omitted --></a></li> <li>Support tags - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9478">vitest-dev/vitest#9478</a> <a href="https://github.com/vitest-dev/vitest/commit/de7c8a521"><!-- raw HTML omitted -->(de7c8)<!-- raw HTML omitted --></a></li> <li>Implement <code>aroundEach</code> and <code>aroundAll</code> hooks - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9450">vitest-dev/vitest#9450</a> <a href="https://github.com/vitest-dev/vitest/commit/2a8cb9dc2"><!-- raw HTML omitted -->(2a8cb)<!-- raw HTML omitted --></a></li> <li>Stabilize experimental features - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9529">vitest-dev/vitest#9529</a> <a href="https://github.com/vitest-dev/vitest/commit/b5fd2a16a"><!-- raw HTML omitted -->(b5fd2)<!-- raw HTML omitted --></a></li> <li>Accept <code>new</code> or <code>all</code> in <code>--update</code> flag - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9543">vitest-dev/vitest#9543</a> <a href="https://github.com/vitest-dev/vitest/commit/a5acf28a5"><!-- raw HTML omitted -->(a5acf)<!-- raw HTML omitted --></a></li> <li>Support <code>meta</code> in test options - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9535">vitest-dev/vitest#9535</a> <a href="https://github.com/vitest-dev/vitest/commit/7d622e3d1"><!-- raw HTML omitted -->(7d622)<!-- raw HTML omitted --></a></li> <li>Support type inference with a new <code>test.extend</code> syntax - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9550">vitest-dev/vitest#9550</a> <a href="https://github.com/vitest-dev/vitest/commit/e53854fcc"><!-- raw HTML omitted -->(e5385)<!-- raw HTML omitted --></a></li> <li>Support vite 8 beta, fix type issues in the config with different vite versions - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9587">vitest-dev/vitest#9587</a> <a href="https://github.com/vitest-dev/vitest/commit/990281dfd"><!-- raw HTML omitted -->(99028)<!-- raw HTML omitted --></a></li> <li>Add assertion helper to hide internal stack traces - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> and <strong>Claude Opus 4.6</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9594">vitest-dev/vitest#9594</a> <a href="https://github.com/vitest-dev/vitest/commit/eeb0ae2f8"><!-- raw HTML omitted -->(eeb0a)<!-- raw HTML omitted --></a></li> <li>Store failure screenshots using artifacts API - by <a href="https://github.com/macarie"><code>@macarie</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9588">vitest-dev/vitest#9588</a> <a href="https://github.com/vitest-dev/vitest/commit/24603e3c4"><!-- raw HTML omitted -->(24603)<!-- raw HTML omitted --></a></li> <li>Allow <code>vitest list</code> to statically collect tests instead of running files to collect them - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9630">vitest-dev/vitest#9630</a> <a href="https://github.com/vitest-dev/vitest/commit/7a8e7fc20"><!-- raw HTML omitted -->(7a8e7)<!-- raw HTML omitted --></a></li> <li>Add <code>--detect-async-leaks</code> - by <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9528">vitest-dev/vitest#9528</a> <a href="https://github.com/vitest-dev/vitest/commit/c594d4af3"><!-- raw HTML omitted -->(c594d)<!-- raw HTML omitted --></a></li> <li>Implement <code>mockThrow</code> and <code>mockThrowOnce</code> - by <a href="https://github.com/thor-juhasz"><code>@thor-juhasz</code></a> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9512">vitest-dev/vitest#9512</a> <a href="https://github.com/vitest-dev/vitest/commit/619179fb7"><!-- raw HTML omitted -->(61917)<!-- raw HTML omitted --></a></li> <li>Support <code>update: "none"</code> and add docs about snapshots behavior on CI - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9700">vitest-dev/vitest#9700</a> <a href="https://github.com/vitest-dev/vitest/commit/05f1854e2"><!-- raw HTML omitted -->(05f18)<!-- raw HTML omitted --></a></li> <li>Support playwright <code>launchOptions</code> with <code>connectOptions</code> - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9702">vitest-dev/vitest#9702</a> <a href="https://github.com/vitest-dev/vitest/commit/f0ff1b2a0"><!-- raw HTML omitted -->(f0ff1)<!-- raw HTML omitted --></a></li> <li>Add <code>page/locator.mark</code> API to enhance playwright trace - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9652">vitest-dev/vitest#9652</a> <a href="https://github.com/vitest-dev/vitest/commit/d0ee546fe"><!-- raw HTML omitted -->(d0ee5)<!-- raw HTML omitted --></a></li> <li><strong>api</strong>: <ul> <li>Support tests starting or ending with <code>test</code> in <code>experimental_parseSpecification</code> - by <a href="https://github.com/jgillick"><code>@jgillick</code></a> and <strong>Jeremy Gillick</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9235">vitest-dev/vitest#9235</a> <a href="https://github.com/vitest-dev/vitest/commit/2f367fad3"><!-- raw HTML omitted -->(2f367)<!-- raw HTML omitted --></a></li> <li>Add filters to <code>createSpecification</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9336">vitest-dev/vitest#9336</a> <a href="https://github.com/vitest-dev/vitest/commit/c8e6c7fbf"><!-- raw HTML omitted -->(c8e6c)<!-- raw HTML omitted --></a></li> <li>Expose <code>runTestFiles</code> as alternative to <code>runTestSpecifications</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9443">vitest-dev/vitest#9443</a> <a href="https://github.com/vitest-dev/vitest/commit/43d761821"><!-- raw HTML omitted -->(43d76)<!-- raw HTML omitted --></a></li> <li>Add <code>allowWrite</code> and <code>allowExec</code> options to <code>api</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9350">vitest-dev/vitest#9350</a> <a href="https://github.com/vitest-dev/vitest/commit/20e00ef78"><!-- raw HTML omitted -->(20e00)<!-- raw HTML omitted --></a></li> <li>Allow passing down test cases to <code>toTestSpecification</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9627">vitest-dev/vitest#9627</a> <a href="https://github.com/vitest-dev/vitest/commit/6f17d5ddf"><!-- raw HTML omitted -->(6f17d)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>browser</strong>: <ul> <li>Add <code>userEvent.wheel</code> API - by <a href="https://github.com/macarie"><code>@macarie</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9188">vitest-dev/vitest#9188</a> <a href="https://github.com/vitest-dev/vitest/commit/660801979"><!-- raw HTML omitted -->(66080)<!-- raw HTML omitted --></a></li> <li>Add <code>filterNode</code> option to prettyDOM for filtering browser assertion error output - by <a href="https://github.com/Copilot"><code>@Copilot</code></a>, <strong>sheremet-va</strong> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9475">vitest-dev/vitest#9475</a> <a href="https://github.com/vitest-dev/vitest/commit/d3220fcd8"><!-- raw HTML omitted -->(d3220)<!-- raw HTML omitted --></a></li> <li>Support playwright persistent context - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a>, <strong>Claude Opus 4.6</strong> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9229">vitest-dev/vitest#9229</a> <a href="https://github.com/vitest-dev/vitest/commit/f865d2ba4"><!-- raw HTML omitted -->(f865d)<!-- raw HTML omitted --></a></li> <li>Added <code>detailsPanelPosition</code> option and button - by <a href="https://github.com/shairez"><code>@shairez</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9525">vitest-dev/vitest#9525</a> <a href="https://github.com/vitest-dev/vitest/commit/c8a31147c"><!-- raw HTML omitted -->(c8a31)<!-- raw HTML omitted --></a></li> <li>Use BlazeDiff instead of pixelmatch - by <a href="https://github.com/macarie"><code>@macarie</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9514">vitest-dev/vitest#9514</a> <a href="https://github.com/vitest-dev/vitest/commit/309362089"><!-- raw HTML omitted -->(30936)<!-- raw HTML omitted --></a></li> <li>Add <code>findElement</code> and enable strict mode in webdriverio and preview - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9677">vitest-dev/vitest#9677</a> <a href="https://github.com/vitest-dev/vitest/commit/c3f37721c"><!-- raw HTML omitted -->(c3f37)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>cli</strong>: <ul> <li>Add <a href="https://github.com/bomb"><code>@bomb</code></a>.sh/tab completions - by <a href="https://github.com/AmirSa12"><code>@AmirSa12</code></a> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/8639">vitest-dev/vitest#8639</a> <a href="https://github.com/vitest-dev/vitest/commit/200f31704"><!-- raw HTML omitted -->(200f3)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>coverage</strong>: <ul> <li>Support <code>ignore start/stop</code> ignore hints - by <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9204">vitest-dev/vitest#9204</a> <a href="https://github.com/vitest-dev/vitest/commit/e59c94ba6"><!-- raw HTML omitted -->(e59c9)<!-- raw HTML omitted --></a></li> <li>Add <code>coverage.changed</code> option to report only changed files - by <a href="https://github.com/kykim00"><code>@kykim00</code></a> and <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9521">vitest-dev/vitest#9521</a> <a href="https://github.com/vitest-dev/vitest/commit/1d9392c67"><!-- raw HTML omitted -->(1d939)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>experimental</strong>: <ul> <li>Add <code>onModuleRunner</code> hook to <code>worker.init</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9286">vitest-dev/vitest#9286</a> <a href="https://github.com/vitest-dev/vitest/commit/e977f3deb"><!-- raw HTML omitted -->(e977f)<!-- raw HTML omitted --></a></li> <li>Option to disable the module runner - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> and <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9210">vitest-dev/vitest#9210</a> <a href="https://github.com/vitest-dev/vitest/commit/9be6121ee"><!-- raw HTML omitted -->(9be61)<!-- raw HTML omitted --></a></li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitest-dev/vitest/commit/4150b913171bda3971a4a4c47c633c26d0c6ae45"><code>4150b91</code></a> chore: release v4.1.0</li> <li><a href="https://github.com/vitest-dev/vitest/commit/1de0aa22dd6311a93546a75a3c58a6be519c1baf"><code>1de0aa2</code></a> fix: correctly identify concurrent test during static analysis (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9846">#9846</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/c3cac1c1b5a91d921942e9391fbd94841717363f"><code>c3cac1c</code></a> fix: use isAgent check, not just TTY, for watch mode (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9841">#9841</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/eab68ba2b8ea6f89717c0b885c573579659d7c3b"><code>eab68ba</code></a> chore(deps): update all non-major dependencies (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9824">#9824</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/031f02a89be34491c441b4da9c4e2bacb7db71df"><code>031f02a</code></a> fix: allow catch/finally for async assertion (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9827">#9827</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/3e9e096a231fa0ec6475da82e36cbd6fcc9bc8f9"><code>3e9e096</code></a> feat(reporters): add <code>agent</code> reporter to reduce ai agent token usage (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9779">#9779</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/0c2c01361a95dd26d0d7fd7bc38bcca8dbc6e5d2"><code>0c2c013</code></a> chore: release v4.1.0-beta.6</li> <li><a href="https://github.com/vitest-dev/vitest/commit/8181e06e765f4d043818b244c76795022fa78ff6"><code>8181e06</code></a> fix: <code>hideSkippedTests</code> should not hide <code>test.todo</code> (fix <a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9562">#9562</a>) (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9781">#9781</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/a8216b0014b83612e40ef49f919d5293b68717b3"><code>a8216b0</code></a> fix: manual and redirect mock shouldn't <code>load</code> or <code>transform</code> original module...</li> <li><a href="https://github.com/vitest-dev/vitest/commit/689a22a1b8c79595f6f4ae82d2b43c895d7f1c50"><code>689a22a</code></a> fix(browser): types of <code>getCDPSession</code> and <code>cdp()</code> (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9716">#9716</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitest-dev/vitest/commits/v4.1.0/packages/vitest">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for vitest since your current version.</p> </details> <br /> Updates `vitest` from 3.2.4 to 4.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitest-dev/vitest/releases">vitest's releases</a>.</em></p> <blockquote> <h2>v4.1.0</h2> <p>Vitest 4.1 is out!</p> <p>This release page lists all changes made to the project during the 4.1 beta. To get a review of all the new features, read our <a href="https://vitest.dev/blog/vitest-4-1">blog post</a>.</p> <h3> 🚀 Features</h3> <ul> <li>Return a disposable from doMock() - by <a href="https://github.com/kirkwaiblinger"><code>@kirkwaiblinger</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9332">vitest-dev/vitest#9332</a> <a href="https://github.com/vitest-dev/vitest/commit/e3e659a96"><!-- raw HTML omitted -->(e3e65)<!-- raw HTML omitted --></a></li> <li>Added chai style assertions - by <a href="https://github.com/ronnakamoto"><code>@ronnakamoto</code></a> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/8842">vitest-dev/vitest#8842</a> <a href="https://github.com/vitest-dev/vitest/commit/841df9ac5"><!-- raw HTML omitted -->(841df)<!-- raw HTML omitted --></a></li> <li>Update to sinon/fake-timers v15 and add <code>setTickMode</code> to timer controls - by <a href="https://github.com/atscott"><code>@atscott</code></a> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/8726">vitest-dev/vitest#8726</a> <a href="https://github.com/vitest-dev/vitest/commit/4b480aaed"><!-- raw HTML omitted -->(4b480)<!-- raw HTML omitted --></a></li> <li>Expose matcher types - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9448">vitest-dev/vitest#9448</a> <a href="https://github.com/vitest-dev/vitest/commit/3e4b913b1"><!-- raw HTML omitted -->(3e4b9)<!-- raw HTML omitted --></a></li> <li>Add <code>toTestSpecification</code> to reported tasks - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9464">vitest-dev/vitest#9464</a> <a href="https://github.com/vitest-dev/vitest/commit/1a4705da9"><!-- raw HTML omitted -->(1a470)<!-- raw HTML omitted --></a></li> <li>Show a warning if <code>vi.mock</code> or <code>vi.hoisted</code> are declared outside of top level of the module - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9387">vitest-dev/vitest#9387</a> <a href="https://github.com/vitest-dev/vitest/commit/5db54a468"><!-- raw HTML omitted -->(5db54)<!-- raw HTML omitted --></a></li> <li>Track and display expectedly failed tests (.fails) in UI and CLI - by <a href="https://github.com/Copilot"><code>@Copilot</code></a>, <strong>sheremet-va</strong> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9476">vitest-dev/vitest#9476</a> <a href="https://github.com/vitest-dev/vitest/commit/77d75fd34"><!-- raw HTML omitted -->(77d75)<!-- raw HTML omitted --></a></li> <li>Support tags - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9478">vitest-dev/vitest#9478</a> <a href="https://github.com/vitest-dev/vitest/commit/de7c8a521"><!-- raw HTML omitted -->(de7c8)<!-- raw HTML omitted --></a></li> <li>Implement <code>aroundEach</code> and <code>aroundAll</code> hooks - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9450">vitest-dev/vitest#9450</a> <a href="https://github.com/vitest-dev/vitest/commit/2a8cb9dc2"><!-- raw HTML omitted -->(2a8cb)<!-- raw HTML omitted --></a></li> <li>Stabilize experimental features - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9529">vitest-dev/vitest#9529</a> <a href="https://github.com/vitest-dev/vitest/commit/b5fd2a16a"><!-- raw HTML omitted -->(b5fd2)<!-- raw HTML omitted --></a></li> <li>Accept <code>new</code> or <code>all</code> in <code>--update</code> flag - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9543">vitest-dev/vitest#9543</a> <a href="https://github.com/vitest-dev/vitest/commit/a5acf28a5"><!-- raw HTML omitted -->(a5acf)<!-- raw HTML omitted --></a></li> <li>Support <code>meta</code> in test options - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9535">vitest-dev/vitest#9535</a> <a href="https://github.com/vitest-dev/vitest/commit/7d622e3d1"><!-- raw HTML omitted -->(7d622)<!-- raw HTML omitted --></a></li> <li>Support type inference with a new <code>test.extend</code> syntax - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9550">vitest-dev/vitest#9550</a> <a href="https://github.com/vitest-dev/vitest/commit/e53854fcc"><!-- raw HTML omitted -->(e5385)<!-- raw HTML omitted --></a></li> <li>Support vite 8 beta, fix type issues in the config with different vite versions - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9587">vitest-dev/vitest#9587</a> <a href="https://github.com/vitest-dev/vitest/commit/990281dfd"><!-- raw HTML omitted -->(99028)<!-- raw HTML omitted --></a></li> <li>Add assertion helper to hide internal stack traces - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> and <strong>Claude Opus 4.6</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9594">vitest-dev/vitest#9594</a> <a href="https://github.com/vitest-dev/vitest/commit/eeb0ae2f8"><!-- raw HTML omitted -->(eeb0a)<!-- raw HTML omitted --></a></li> <li>Store failure screenshots using artifacts API - by <a href="https://github.com/macarie"><code>@macarie</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9588">vitest-dev/vitest#9588</a> <a href="https://github.com/vitest-dev/vitest/commit/24603e3c4"><!-- raw HTML omitted -->(24603)<!-- raw HTML omitted --></a></li> <li>Allow <code>vitest list</code> to statically collect tests instead of running files to collect them - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9630">vitest-dev/vitest#9630</a> <a href="https://github.com/vitest-dev/vitest/commit/7a8e7fc20"><!-- raw HTML omitted -->(7a8e7)<!-- raw HTML omitted --></a></li> <li>Add <code>--detect-async-leaks</code> - by <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9528">vitest-dev/vitest#9528</a> <a href="https://github.com/vitest-dev/vitest/commit/c594d4af3"><!-- raw HTML omitted -->(c594d)<!-- raw HTML omitted --></a></li> <li>Implement <code>mockThrow</code> and <code>mockThrowOnce</code> - by <a href="https://github.com/thor-juhasz"><code>@thor-juhasz</code></a> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9512">vitest-dev/vitest#9512</a> <a href="https://github.com/vitest-dev/vitest/commit/619179fb7"><!-- raw HTML omitted -->(61917)<!-- raw HTML omitted --></a></li> <li>Support <code>update: "none"</code> and add docs about snapshots behavior on CI - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9700">vitest-dev/vitest#9700</a> <a href="https://github.com/vitest-dev/vitest/commit/05f1854e2"><!-- raw HTML omitted -->(05f18)<!-- raw HTML omitted --></a></li> <li>Support playwright <code>launchOptions</code> with <code>connectOptions</code> - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9702">vitest-dev/vitest#9702</a> <a href="https://github.com/vitest-dev/vitest/commit/f0ff1b2a0"><!-- raw HTML omitted -->(f0ff1)<!-- raw HTML omitted --></a></li> <li>Add <code>page/locator.mark</code> API to enhance playwright trace - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9652">vitest-dev/vitest#9652</a> <a href="https://github.com/vitest-dev/vitest/commit/d0ee546fe"><!-- raw HTML omitted -->(d0ee5)<!-- raw HTML omitted --></a></li> <li><strong>api</strong>: <ul> <li>Support tests starting or ending with <code>test</code> in <code>experimental_parseSpecification</code> - by <a href="https://github.com/jgillick"><code>@jgillick</code></a> and <strong>Jeremy Gillick</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9235">vitest-dev/vitest#9235</a> <a href="https://github.com/vitest-dev/vitest/commit/2f367fad3"><!-- raw HTML omitted -->(2f367)<!-- raw HTML omitted --></a></li> <li>Add filters to <code>createSpecification</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9336">vitest-dev/vitest#9336</a> <a href="https://github.com/vitest-dev/vitest/commit/c8e6c7fbf"><!-- raw HTML omitted -->(c8e6c)<!-- raw HTML omitted --></a></li> <li>Expose <code>runTestFiles</code> as alternative to <code>runTestSpecifications</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9443">vitest-dev/vitest#9443</a> <a href="https://github.com/vitest-dev/vitest/commit/43d761821"><!-- raw HTML omitted -->(43d76)<!-- raw HTML omitted --></a></li> <li>Add <code>allowWrite</code> and <code>allowExec</code> options to <code>api</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9350">vitest-dev/vitest#9350</a> <a href="https://github.com/vitest-dev/vitest/commit/20e00ef78"><!-- raw HTML omitted -->(20e00)<!-- raw HTML omitted --></a></li> <li>Allow passing down test cases to <code>toTestSpecification</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9627">vitest-dev/vitest#9627</a> <a href="https://github.com/vitest-dev/vitest/commit/6f17d5ddf"><!-- raw HTML omitted -->(6f17d)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>browser</strong>: <ul> <li>Add <code>userEvent.wheel</code> API - by <a href="https://github.com/macarie"><code>@macarie</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9188">vitest-dev/vitest#9188</a> <a href="https://github.com/vitest-dev/vitest/commit/660801979"><!-- raw HTML omitted -->(66080)<!-- raw HTML omitted --></a></li> <li>Add <code>filterNode</code> option to prettyDOM for filtering browser assertion error output - by <a href="https://github.com/Copilot"><code>@Copilot</code></a>, <strong>sheremet-va</strong> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9475">vitest-dev/vitest#9475</a> <a href="https://github.com/vitest-dev/vitest/commit/d3220fcd8"><!-- raw HTML omitted -->(d3220)<!-- raw HTML omitted --></a></li> <li>Support playwright persistent context - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a>, <strong>Claude Opus 4.6</strong> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9229">vitest-dev/vitest#9229</a> <a href="https://github.com/vitest-dev/vitest/commit/f865d2ba4"><!-- raw HTML omitted -->(f865d)<!-- raw HTML omitted --></a></li> <li>Added <code>detailsPanelPosition</code> option and button - by <a href="https://github.com/shairez"><code>@shairez</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9525">vitest-dev/vitest#9525</a> <a href="https://github.com/vitest-dev/vitest/commit/c8a31147c"><!-- raw HTML omitted -->(c8a31)<!-- raw HTML omitted --></a></li> <li>Use BlazeDiff instead of pixelmatch - by <a href="https://github.com/macarie"><code>@macarie</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9514">vitest-dev/vitest#9514</a> <a href="https://github.com/vitest-dev/vitest/commit/309362089"><!-- raw HTML omitted -->(30936)<!-- raw HTML omitted --></a></li> <li>Add <code>findElement</code> and enable strict mode in webdriverio and preview - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9677">vitest-dev/vitest#9677</a> <a href="https://github.com/vitest-dev/vitest/commit/c3f37721c"><!-- raw HTML omitted -->(c3f37)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>cli</strong>: <ul> <li>Add <a href="https://github.com/bomb"><code>@bomb</code></a>.sh/tab completions - by <a href="https://github.com/AmirSa12"><code>@AmirSa12</code></a> and <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/8639">vitest-dev/vitest#8639</a> <a href="https://github.com/vitest-dev/vitest/commit/200f31704"><!-- raw HTML omitted -->(200f3)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>coverage</strong>: <ul> <li>Support <code>ignore start/stop</code> ignore hints - by <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9204">vitest-dev/vitest#9204</a> <a href="https://github.com/vitest-dev/vitest/commit/e59c94ba6"><!-- raw HTML omitted -->(e59c9)<!-- raw HTML omitted --></a></li> <li>Add <code>coverage.changed</code> option to report only changed files - by <a href="https://github.com/kykim00"><code>@kykim00</code></a> and <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9521">vitest-dev/vitest#9521</a> <a href="https://github.com/vitest-dev/vitest/commit/1d9392c67"><!-- raw HTML omitted -->(1d939)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>experimental</strong>: <ul> <li>Add <code>onModuleRunner</code> hook to <code>worker.init</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9286">vitest-dev/vitest#9286</a> <a href="https://github.com/vitest-dev/vitest/commit/e977f3deb"><!-- raw HTML omitted -->(e977f)<!-- raw HTML omitted --></a></li> <li>Option to disable the module runner - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> and <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9210">vitest-dev/vitest#9210</a> <a href="https://github.com/vitest-dev/vitest/commit/9be6121ee"><!-- raw HTML omitted -->(9be61)<!-- raw HTML omitted --></a></li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitest-dev/vitest/commit/4150b913171bda3971a4a4c47c633c26d0c6ae45"><code>4150b91</code></a> chore: release v4.1.0</li> <li><a href="https://github.com/vitest-dev/vitest/commit/1de0aa22dd6311a93546a75a3c58a6be519c1baf"><code>1de0aa2</code></a> fix: correctly identify concurrent test during static analysis (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9846">#9846</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/c3cac1c1b5a91d921942e9391fbd94841717363f"><code>c3cac1c</code></a> fix: use isAgent check, not just TTY, for watch mode (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9841">#9841</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/eab68ba2b8ea6f89717c0b885c573579659d7c3b"><code>eab68ba</code></a> chore(deps): update all non-major dependencies (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9824">#9824</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/031f02a89be34491c441b4da9c4e2bacb7db71df"><code>031f02a</code></a> fix: allow catch/finally for async assertion (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9827">#9827</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/3e9e096a231fa0ec6475da82e36cbd6fcc9bc8f9"><code>3e9e096</code></a> feat(reporters): add <code>agent</code> reporter to reduce ai agent token usage (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9779">#9779</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/0c2c01361a95dd26d0d7fd7bc38bcca8dbc6e5d2"><code>0c2c013</code></a> chore: release v4.1.0-beta.6</li> <li><a href="https://github.com/vitest-dev/vitest/commit/8181e06e765f4d043818b244c76795022fa78ff6"><code>8181e06</code></a> fix: <code>hideSkippedTests</code> should not hide <code>test.todo</code> (fix <a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9562">#9562</a>) (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9781">#9781</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/a8216b0014b83612e40ef49f919d5293b68717b3"><code>a8216b0</code></a> fix: manual and redirect mock shouldn't <code>load</code> or <code>transform</code> original module...</li> <li><a href="https://github.com/vitest-dev/vitest/commit/689a22a1b8c79595f6f4ae82d2b43c895d7f1c50"><code>689a22a</code></a> fix(browser): types of <code>getCDPSession</code> and <code>cdp()</code> (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9716">#9716</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitest-dev/vitest/commits/v4.1.0/packages/vitest">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for vitest since your current version.</p> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/e2b-dev/E2B/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jakub Novak <jakub@e2b.dev>	2026-06-02 02:36:24 -07:00
dependabot[bot]	6e3a469a8c	chore(deps-dev): bump urllib3 from 2.6.3 to 2.7.0 in /packages/python-sdk in the pip group across 1 directory (#1324 ) Bumps the pip group with 1 update in the /packages/python-sdk directory: [urllib3](https://github.com/urllib3/urllib3). Updates `urllib3` from 2.6.3 to 2.7.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/releases">urllib3's releases</a>.</em></p> <blockquote> <h2>2.7.0</h2> <h2>🚀 urllib3 is fundraising for HTTP/2 support</h2> <p><a href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3 is raising ~$40,000 USD</a> to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects <a href="https://opencollective.com/urllib3">please consider contributing financially</a> to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.</p> <p>Thank you for your support.</p> <h2>Security</h2> <p>Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.</p> <ul> <li> <p>Decompression-bomb safeguards of the streaming API were bypassed:</p> <ol> <li>When <code>HTTPResponse.drain_conn()</code> was called after the response had been read and decompressed partially. (Reported by <a href="https://github.com/Cycloctane"><code>@Cycloctane</code></a>)</li> <li>During the second <code>HTTPResponse.read(amt=N)</code> or <code>HTTPResponse.stream(amt=N)</code> call when the response was decompressed using the official <a href="https://pypi.org/project/brotli/">Brotli</a> library. (Reported by <a href="https://github.com/kimkou2024"><code>@kimkou2024</code></a>)</li> </ol> <p>See GHSA-mf9v-mfxr-j63j for details.</p> </li> <li> <p>HTTP pools created using <code>ProxyManager.connection_from_url</code> did not strip sensitive headers specified in <code>Retry.remove_headers_on_redirect</code> when redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by <a href="https://github.com/christos-spearbit"><code>@christos-spearbit</code></a>)</p> </li> </ul> <h2>Deprecations and Removals</h2> <ul> <li>Used <code>FutureWarning</code> instead of <code>DeprecationWarning</code> for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3763">urllib3/urllib3#3763</a>)</li> <li>Removed support for end-of-life Python 3.9. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3720">urllib3/urllib3#3720</a>)</li> <li>Removed support for end-of-life PyPy3.10. (<a href="https://redirect.github.com/urllib3/urllib3/issues/4979">urllib3/urllib3#4979</a>)</li> <li>Bumped the minimum supported pyOpenSSL version to 19.0.0. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3777">urllib3/urllib3#3777</a>)</li> </ul> <h2>Bugfixes</h2> <ul> <li>Fixed a bug where <code>HTTPResponse.read(amt=None)</code> was ignoring decompressed data buffered from previous partial reads. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3636">urllib3/urllib3#3636</a>)</li> <li>Fixed a bug where <code>HTTPResponse.read()</code> could cache only part of the response after a partial read when <code>cache_content=True</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/4967">urllib3/urllib3#4967</a>)</li> <li>Fixed <code>HTTPResponse.stream()</code> and <code>HTTPResponse.read_chunked()</code> to handle <code>amt=0</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3793">urllib3/urllib3#3793</a>)</li> <li>Updated <code>_TYPE_BODY</code> type alias to include missing <code>Iterable[str]</code>, matching the documented and runtime behavior of chunked request bodies. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3798">urllib3/urllib3#3798</a>)</li> <li>Fixed <code>LocationParseError</code> when paths resembling schemeless URIs were passed to <code>HTTPConnectionPool.urlopen()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3352">urllib3/urllib3#3352</a>)</li> <li>Fixed <code>BaseHTTPResponse.readinto()</code> type annotation to accept <code>memoryview</code> in addition to <code>bytearray</code>, matching the <code>io.RawIOBase.readinto</code> contract and enabling use with <code>io.BufferedReader</code> without type errors. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3764">urllib3/urllib3#3764</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's changelog</a>.</em></p> <blockquote> <h1>2.7.0 (2026-05-07)</h1> <h2>Security</h2> <p>Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.</p> <ul> <li> <p>Decompression-bomb safeguards of the streaming API were bypassed:</p> <ol> <li>When <code>HTTPResponse.drain_conn()</code> was called after the response had been read and decompressed partially.</li> <li>During the second <code>HTTPResponse.read(amt=N)</code> or <code>HTTPResponse.stream(amt=N)</code> call when the response was decompressed using the official <code>Brotli <https://pypi.org/project/brotli/></code>__ library.</li> </ol> <p>See <code>GHSA-mf9v-mfxr-j63j <https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j></code>__ for details.</p> </li> <li> <p>HTTP pools created using <code>ProxyManager.connection_from_url</code> did not strip sensitive headers specified in <code>Retry.remove_headers_on_redirect</code> when redirecting to a different host. (<code>GHSA-qccp-gfcp-xxvc <https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc></code>__)</p> </li> </ul> <h2>Deprecations and Removals</h2> <ul> <li>Used <code>FutureWarning</code> instead of <code>DeprecationWarning</code> for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (<code>[#3763](https://github.com/urllib3/urllib3/issues/3763) <https://github.com/urllib3/urllib3/issues/3763></code>__)</li> <li>Removed support for end-of-life Python 3.9. (<code>[#3720](https://github.com/urllib3/urllib3/issues/3720) <https://github.com/urllib3/urllib3/issues/3720></code>__)</li> <li>Removed support for end-of-life PyPy3.10. (<code>[#4979](https://github.com/urllib3/urllib3/issues/4979) <https://github.com/urllib3/urllib3/issues/4979></code>__)</li> <li>Bumped the minimum supported pyOpenSSL version to 19.0.0. (<code>[#3777](https://github.com/urllib3/urllib3/issues/3777) <https://github.com/urllib3/urllib3/issues/3777></code>__)</li> </ul> <h2>Bugfixes</h2> <ul> <li>Fixed a bug where <code>HTTPResponse.read(amt=None)</code> was ignoring decompressed data buffered from previous partial reads. (<code>[#3636](https://github.com/urllib3/urllib3/issues/3636) <https://github.com/urllib3/urllib3/issues/3636></code>__)</li> <li>Fixed a bug where <code>HTTPResponse.read()</code> could cache only part of the response after a partial read when <code>cache_content=True</code>.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/urllib3/urllib3/commit/9a950b92d999f906b6020bb2d1076ee56cddd5d2"><code>9a950b9</code></a> Release 2.7.0</li> <li><a href="https://github.com/urllib3/urllib3/commit/5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc"><code>5ec0de4</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a"><code>2bdcc44</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/f45b0df09d8620ac6ed0491eb9362c8c87b7bc2c"><code>f45b0df</code></a> Fix a misleading example for <code>ProxyManager</code> (<a href="https://redirect.github.com/urllib3/urllib3/issues/4970">#4970</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/577193ca029872384f82c133449e0935f6d8a64b"><code>577193c</code></a> Switch to nightly PyPy3.11 in CI for now (<a href="https://redirect.github.com/urllib3/urllib3/issues/4984">#4984</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/e90af45bb006c3a452a3a21644a2681523f5c7fc"><code>e90af45</code></a> Avoid infinite loop in <code>HTTPResponse.read_chunked</code> when <code>amt=0</code> (<a href="https://redirect.github.com/urllib3/urllib3/issues/4974">#4974</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/67ed74fdaec6659a6534621ec8e3aaaa6f976210"><code>67ed74f</code></a> Bump dev dependencies (<a href="https://redirect.github.com/urllib3/urllib3/issues/4972">#4972</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/3abd481097b54d87b574ac7ea593c3f40938a84d"><code>3abd481</code></a> Upgrade mypy to version 1.20.2 (<a href="https://redirect.github.com/urllib3/urllib3/issues/4978">#4978</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/2b8725dfcac4f21d4d93cc0cc3a64a33af08f890"><code>2b8725d</code></a> Drop support for EOL PyPy3.10 (<a href="https://redirect.github.com/urllib3/urllib3/issues/4979">#4979</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/2944b2a0a6c573f5548a39cfd17196f98ee21b33"><code>2944b2a</code></a> Upgrade <code>setup-chrome</code> and <code>setup-firefox</code> to fix warnings (<a href="https://redirect.github.com/urllib3/urllib3/issues/4973">#4973</a>)</li> <li>Additional commits viewable in <a href="https://github.com/urllib3/urllib3/compare/2.6.3...2.7.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=urllib3&package-manager=pip&previous-version=2.6.3&new-version=2.7.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/e2b-dev/E2B/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jakub Novák <jakub@e2b.dev>	2026-06-01 18:57:09 +02:00
Matt Brockman	b7fa99e2b7	Silence undici fallback warning (#1375 ) don't need the warning for undici --------- Co-authored-by: Mish Ushakov <10400064+mishushakov@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-01 15:48:29 +00:00
github-actions[bot]	e113618db0	[skip ci] Release new versions	2026-05-29 23:46:06 +00:00
Matt Brockman	4b9cc043dc	Fix/python envd stable transport (#1368 )	2026-05-29 16:39:30 -07:00
github-actions[bot]	44f07b607a	[skip ci] Release new versions	2026-05-27 21:33:52 +00:00
Mish Ushakov	4a4bb36839	feat(sdk): validate E2B API key format client-side (#1356 ) ## Summary - Both JS and Python SDKs now validate that the configured E2B API key matches `e2b_` followed by 40 hex characters (mirroring the server-side check in [`infra/.../keys/key.go`](https://github.com/e2b-dev/infra/blob/main/packages/shared/pkg/keys/key.go#L66)) and throw `AuthenticationError` / `AuthenticationException` with an example token (`e2b_0000…`) and a link to the API Keys dashboard tab. - Validation runs inside `ApiClient` / `ApiClient.__init__` whenever an API key is present, so callers get immediate, actionable feedback instead of a generic 401 from the server. - Added unit tests (`validateApiKey.test.ts`, `test_validate_api_key.py`) and updated existing fixtures that used placeholder keys like `'test-key'` / `'base-api-key'` to use the valid format. ## Test plan - [x] `pnpm run format`, `pnpm run lint`, `pnpm run typecheck` - [x] `pnpm exec vitest run tests/api/validateApiKey.test.ts tests/api/handleApiError.test.ts tests/sandbox/abortSignal.test.ts tests/template/abortSignal.test.ts tests/sandbox/configPropagation.test.ts tests/connectionConfig.test.ts` - [x] `poetry run pytest tests/test_validate_api_key.py tests/test_api_client_transport.py tests/sync/sandbox_sync/test_config_propagation.py tests/async/sandbox_async/test_config_propagation.py tests/test_connection_config.py` 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-27 21:21:19 +00:00
Mish Ushakov	2691c73d1c	chore(sdk): sync OpenAPI spec from infra, regenerate clients (#1357 ) ## Summary - Sync `spec/openapi.yml` from [e2b-dev/infra@main](https://github.com/e2b-dev/infra/blob/main/spec/openapi.yml) and re-run `make codegen`. - Schema changes surfaced in the generated clients: `SandboxMetric.memCache` (new required int64 — also exposed on the public `SandboxMetrics` wrapper in both SDKs), `NodeStatus` gains `standby`, `TeamUser.email` becomes nullable + deprecated, and `POST /v3/templates` gains a `403` response. - Upstream-only spec changes (not generated because the client filters by tag): new `AuthProviderBearerAuth`/`AuthProviderTeamAuth` security schemes, new admin endpoints for team API keys, and a `clusterID` query param on `GET /nodes`. ## Test plan - [x] \`pnpm run format\`, \`pnpm run lint\`, \`pnpm run typecheck\` - [x] JS \`tests/sandbox/metrics.test.ts\` against the live API - [x] Python sync + async \`test_metrics.py\` against the live API 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-27 22:57:28 +02:00
Mish Ushakov	a6bf71a083	fix(sdks): handle multi-source COPY/ADD in fromDockerfile (#1355 ) ## Summary - Fixes #1349: `Template.fromDockerfile` (JS) and `Template.from_dockerfile` (Python) silently dropped intermediate sources from multi-source `COPY`/`ADD`, keeping only the first one and producing broken images without warning. - Both parsers now emit one `copy()` call per source to the same destination (matching Docker semantics), preserving `--chown` across all calls. - Added tests in both SDKs (multi-source COPY, and multi-source COPY with `--chown`), plus changesets for `e2b` and `@e2b/python-sdk`. ## Test plan - [x] `pnpm run test tests/template/methods/fromDockerfile.test.ts` (JS) - [x] `poetry run pytest tests/{async,sync}/template_*/methods/test_from_dockerfile.py` (Python) - [x] `pnpm run format` / `pnpm run lint` 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-27 22:57:03 +02:00
Jakub Novak	e2a660c3ee	[skip ci] Release new versions	2026-05-27 12:20:55 +00:00
Jakub Novák	18a10afa87	chore(js): add max concurrency limits (#1351 ) Set limit for max concurrent inflight connection, with burst traffic it could happen that the number of connection overwhelms the underlaying infrastructure or at least saturate it to the point each request is too slow to succeed and blocking the rest	2026-05-27 04:17:40 -07:00
github-actions[bot]	d39f17e123	[skip ci] Release new versions	2026-05-27 00:24:30 +00:00
Mish Ushakov	c485bf5476	feat(sdk): add Sandbox.updateNetwork / update_network (#1337 )	2026-05-26 17:12:29 -07:00
Mish Ushakov	3786f34336	feat(sdk): support structured network rules with per-host transforms (#1286 )	2026-05-26 16:35:21 -07:00
Mish Ushakov	ba315c0795	feat(js-sdk): support AbortSignal for Template operations (#1339 ) ## Summary - Extends AbortSignal support (introduced for Sandbox in #1328) to `Template.build`, `buildInBackground`, `getBuildStatus`, `exists`, `assignTags`, `removeTags`, and `getTags`. Aborting the signal cancels in-flight requests and, for `Template.build`, the status-polling loop. - Refactors signal+timeout plumbing: `ConnectionConfig` now stores `signal`, and `ApiClient` / `VolumeApiClient` auto-apply it (plus `requestTimeoutMs`) to every request via a custom fetch wrapper. The 22 explicit \`signal: config.getSignal(...)\` lines across sandboxApi.ts and volume/index.ts are dropped. - Volume's \`FILE_TIMEOUT_MS\` overrides move one level up into the \`VolumeConnectionConfig\` constructor. Dead \`VolumeConnectionConfig.getSignal()\` removed. ## Test plan - [x] \`pnpm run typecheck\` / \`lint\` / \`format\` - [x] New \`tests/template/abortSignal.test.ts\` covering all 8 Template entry points (MSW-based) - [x] Existing \`tests/sandbox/abortSignal.test.ts\`, \`tests/template/uploadFile.test.ts\`, \`tests/connectionConfig.test.ts\` still pass 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-26 23:21:31 +02:00
Matt Brockman	3ea4ef597b	js uses the stable `sandbox` host url with headers (#1342 ) improved h2 perf for envd execution by using stable `sandbox.e2b.app` with headers (aside from upload/download reqs) can change number of connections via `E2B_ENVD_RPC_CONNECTIONS` env var \| Total \| SDK \| Created \| Executed \| Exec wall \| Exec p50 \| Exec p90 \| Exec p95 \| Exec p99 \| Peak exec conns \| Peak exec hosts \| Errors \| \|---:\|---\|---:\|---:\|---:\|---:\|---:\|---:\|---:\|---:\|---:\|---\| \| 750 \| old per-sandbox host \| 750/750 \| 749/750 \| 9.792s \| 4489ms \| 8682ms \| 9213ms \| 9631ms \| 752 \| 750 \| 1x `fetch failed` \| \| 750 \| updated stable host \| 750/750 \| 750/750 \| 0.840s \| 595ms \| 752ms \| 783ms \| 794ms \| 102 \| 1 \| 0 \| \| 1500 \| old per-sandbox host \| 1500/1500 \| 837/1500 \| 10.783s \| 5200ms \| 9633ms \| 10199ms \| 10603ms \| 1502 \| 1500 \| 663x `fetch failed` \| \| 1500 \| updated stable host \| 1500/1500 \| 1500/1500 \| 1.236s \| 775ms \| 1085ms \| 1124ms \| 1149ms \| 102 \| 1 \| 0 \| --------- Co-authored-by: Jakub Novák <jakub@e2b.dev>	2026-05-26 06:48:46 -07:00
github-actions[bot]	43c4524293	[skip ci] Release new versions	2026-05-22 19:46:53 +00:00
Jakub Novák	8640378c17	feat(python-sdk): allow opting out of HTTP/2 in `get_transport` (#1347 )	2026-05-22 12:40:00 -07:00
Mish Ushakov	a9bb287fc1	fix(python-sdk): close gRPC streams on watcher/command teardown (#1346 ) ## Summary - `AsyncWatchHandle.stop()` and `AsyncCommandHandle.disconnect()` previously only cancelled the consumer task and left the underlying server-streaming gRPC call open — the `await self._events.aclose()` was commented out as a Python 3.8 `RuntimeError` workaround. On long-lived sandboxes this leaks one stream per call and eventually produces `Code.internal: error creating watcher: too many open files`. - The SDK now pins `python = "^3.10"`, so the workaround is removed. `stop()`/`disconnect()` cancel the consumer task, await it, then `aclose()` the async generator. The JS SDK already aborts the underlying request via `AbortController`, so no JS change is needed. ## Test plan - [ ] CI: `pnpm run format`, `pnpm run lint`, `pnpm run typecheck` (passed locally) - [ ] CI: `tests/async/sandbox_async/files/test_watch.py` and async command tests still pass - [ ] Reproduce the leak: in a long-lived async sandbox, repeatedly create+stop a watcher and confirm fd count no longer climbs 🤖 Generated with [Claude Code](https://claude.com/claude-code)	2026-05-22 20:51:21 +02:00
Mish Ushakov	6d66d159d1	fix(cli): handle missing xdg-open on headless machines during login (#1345 ) ## Summary - `e2b auth login` previously crashed on headless machines (no `xdg-open`) with an unhandled `error` event from the spawned browser process. - Attach an `error` listener (and `.catch`) to the `open` call; on failure, print the login URL so the user can open it manually. - Added a changeset for `@e2b/cli` (patch). ## Test plan - [ ] On a headless Linux box without `xdg-open`, run `e2b auth login` and confirm the CLI prints the manual URL instead of crashing. - [ ] On macOS/Linux with a desktop, confirm the browser still opens automatically and login completes. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-22 20:37:24 +02:00
github-actions[bot]	74c42b15ee	[skip ci] Release new versions	2026-05-22 15:53:30 +00:00
Jakub Novák	2680c89c3e	Remove Sandbox.betaCreate / beta_create (#1344 ) It didn't have any extra functionality	2026-05-22 16:36:29 +02:00
github-actions[bot]	9b0c25f8ae	[skip ci] Release new versions	2026-05-22 09:48:05 +00:00
Tomas Valenta	d21b936bf7	fix(sdks): make lifecycle.on_timeout and auto_pause precedence consistent (#1343 ) ## Summary When `lifecycle.on_timeout` is set it wins; otherwise we fall back to the `auto_pause` argument. Previously the Python SDKs subscripted `lifecycle["on_timeout"]`, which raised `KeyError` if a caller passed a `lifecycle` dict missing that key (TypedDict is not enforced at runtime). The JS SDK silently used the whole `lifecycle` object even when `onTimeout` was undefined. In both cases, mixing `lifecycle` and `auto_pause` had inconsistent and surprising behavior across the public surfaces (`create` vs `beta_create`). Now both SDKs use `.get`/optional chaining on `on_timeout` and only treat `lifecycle` as authoritative when that field is actually present. Touched files: - `packages/python-sdk/e2b/sandbox_async/sandbox_api.py` - `packages/python-sdk/e2b/sandbox_sync/sandbox_api.py` - `packages/js-sdk/src/sandbox/sandboxApi.ts` --------- Co-authored-by: Jakub Novak <jakub@e2b.dev>	2026-05-22 02:28:18 -07:00
github-actions[bot]	2eaba1a7a8	[skip ci] Release new versions	2026-05-22 00:18:05 +00:00
Matt Brockman	e10958d87e	Js api http2 dispatcher (#1340 ) use undici for the js api calls as well where we can; improved connection use leads to speed improvement at high concurrency	2026-05-21 12:27:42 -07:00
github-actions[bot]	71f6719bf6	[skip ci] Release new versions	2026-05-18 12:30:54 +00:00
Mish Ushakov	2ac5de2edf	feat(js-sdk): support AbortSignal for request cancellation (#1328 )	2026-05-15 23:24:16 +02:00
github-actions[bot]	70f0d833f5	[skip ci] Release new versions	2026-05-14 17:36:14 +00:00
Mish Ushakov	eaf452a82b	feat: add optional name to createSnapshot and return snapshot names (#1327 ) ## Summary - Add optional `name` parameter to `createSnapshot` / `create_snapshot` in the JS and Python SDKs so callers can name the resulting snapshot template. - Return the `names` field from the snapshot API on `SnapshotInfo` (both in `createSnapshot` responses and in `listSnapshots` paginator results) so callers can discover the namespaced snapshot names. - Includes a changeset (`patch` for `e2b` and `@e2b/python-sdk`). ## Test plan - [ ] `pnpm run format`, `pnpm run lint`, `pnpm run typecheck` all pass locally - [ ] Integration tests on a sandbox with valid credentials: `sandbox.createSnapshot({ name: 'my-snap' })` returns non-empty `names` Resolves https://github.com/e2b-dev/E2B/issues/1249 --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 17:22:31 +00:00
Mish Ushakov	575339b163	test(python-sdk): parallelize async sandbox teardown (#1309 ) ## Summary - Replace the sequential `for sandbox in sandboxes: await sandbox.kill()` teardown in `async_sandbox_factory` with `asyncio.gather(..., return_exceptions=True)` so a failure on one kill no longer blocks cleanup of the rest, and teardown runs concurrently. - Hoist the `_test_failed` check above the loop so the failure log is printed once per fixture rather than per sandbox. ## Test plan - [ ] `pnpm run format`, `pnpm run lint`, `pnpm run typecheck` (python-sdk) all pass - [ ] `pnpm run test` against affected python async sandbox tests 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 13:26:47 +00:00
github-actions[bot]	9e962ae555	[skip ci] Release new versions	2026-05-11 17:38:06 +00:00
Matt Brockman	b2a2786707	Bug e2b 2195 throws dynamic usage of require is not eng 4003 (#1323 ) Fix the JS SDK envd HTTP/2 transport so it works in Next.js/Turbopack production builds.	2026-05-11 10:04:19 -07:00
github-actions[bot]	e3092d5719	[skip ci] Release new versions	2026-05-06 00:56:25 +00:00
Matt Brockman	f7a97e698e	enable http2 for js sdk envd rpc/api traffic (#1311 ) Enables HTTP/2 for JS SDK sandbox envd traffic in Node by routing envd RPC/API requests through undici with an HTTP/2-enabled dispatcher. Non-Node runtimes continue to use global fetch. Management API and volume clients are unchanged. Requires bumping node from >=20 to >= 20.18.1 for undici	2026-05-05 17:24:16 -07:00
Matt Brockman	20ea715252	Enable HTTP/2 for Python SDK transports for sandbox/main api calls (#1310 ) switches python sdk to use http2 for calls to main api + sandboxes doesn't add it to volumes yet - need to test those separately	2026-05-05 17:23:46 -07:00
github-actions[bot]	76f5effde6	[skip ci] Release new versions	2026-04-30 18:04:41 +00:00
Mish Ushakov	bd99b23c1c	chore(deps): drop unused npm-check-updates devDep to clear tar alerts (#1306 ) ## Summary Resolves the remaining 6 high-severity Dependabot alerts for `tar` on the default branch. `tar@6.2.1` was being pulled in transitively via `npm-check-updates@16 -> pacote@15 / cacache -> tar@^6`, and Dependabot's `<= 7.5.10` ranges include 6.x semver-wise. Since `npm-check-updates` was declared as a `devDependency` but never actually invoked anywhere (no script, CI workflow, or doc references it), removing it entirely is cleaner than bumping it — alerts cleared with zero risk of regression. After removal, the lock contains only `tar@7.5.12`, which satisfies all six advisories. ## Test plan - [x] `pnpm run lint` (js-sdk + cli) - [x] `pnpm run typecheck` (js-sdk + cli) - [x] `pnpm run format` (js-sdk + cli) - [x] tar-related unit tests pass (`tests/template/utils`, `tests/template/uploadFile` — 54 tests) 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>	2026-04-30 19:27:32 +02:00
github-actions[bot]	5ed9c32ea7	[skip ci] Release new versions	2026-04-30 15:15:40 +00:00
Mish Ushakov	55e9e0eb5a	chore(deps): resolve Dependabot security alerts across npm and python (#1302 ) ## Summary Resolves all 31 open [Dependabot alerts](https://github.com/e2b-dev/e2b/security/dependabot) across the workspace. - npm — added range-based `pnpm.overrides` to bump vulnerable transitive deps to their patched versions: postcss, vite, lodash, brace-expansion, picomatch (2.x + 4.x), yaml, @tootallnate/once, smol-toml, flatted, and minimatch (3.x/5.x/9.x/10.x). - python-sdk — bumped dev deps in `poetry.lock`: pytest 7.4 → 9.0.3 (with constraint update in `pyproject.toml`), pytest-asyncio 0.23 → 1.3 (required for pytest 9), python-dotenv 1.2.2, pygments 2.20.0, requests 2.33.1, black 26.3.1; removed 4 now-unused `# ty: ignore` directives that pytest 9's stricter type signatures made obsolete. ## Test plan - [x] \`pnpm run typecheck\` passes - [x] \`pnpm run lint\` passes - [x] \`pnpm run format\` clean - [x] CLI tests (80/80) and js-sdk/python-sdk unit tests pass; integration tests not run locally (need \`E2B_API_KEY\`) 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>	2026-04-30 14:45:19 +00:00
github-actions[bot]	3ff25f784e	[skip ci] Release new versions	2026-04-27 21:27:14 +00:00
Mish Ushakov	2c995d4494	refactor(sdk): make octet-stream file upload opt-in via useOctetStream (#1296 ) ## Summary - Adds an opt-in `useOctetStream` / `use_octet_stream` flag to sandbox file write — JS on `FilesystemWriteOpts`, Python keyword on `write` / `write_files` (async + sync). - Changes the default upload path to `multipart/form-data` regardless of envd version. Callers must opt in to `application/octet-stream` (requires envd 0.5.7 or later). ## Example JS: ```ts // Default — multipart/form-data await sandbox.files.write('hello.txt', 'world') // Opt in to application/octet-stream (envd >= 0.5.7) await sandbox.files.writeFiles( [{ path: 'a.txt', data: 'a' }, { path: 'b.txt', data: 'b' }], { useOctetStream: true }, ) ``` Python: ```python # Default — multipart/form-data sandbox.files.write('hello.txt', 'world') # Opt in to application/octet-stream (envd >= 0.5.7) await sandbox.files.write_files( [{'path': 'a.txt', 'data': 'a'}, {'path': 'b.txt', 'data': 'b'}], use_octet_stream=True, ) ``` ## Test plan - [ ] JS: `pnpm --filter e2b run lint && pnpm --filter e2b run typecheck` - [ ] Python: `cd packages/python-sdk && poetry run make lint && poetry run make typecheck` - [ ] Manual write with and without `useOctetStream` / `use_octet_stream` against envd 0.5.7+. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>	2026-04-27 21:16:33 +00:00
github-actions[bot]	557b723cc1	[skip ci] Release new versions	2026-04-24 18:35:47 +00:00
Mish Ushakov	3167e19b4f	fix(sdk): buffer template upload to set Content-Length, add regression tests (#1294 ) ## Summary Consolidates the fix and tests from #1285 and #1293 into a single PR. - js-sdk: `uploadFile` used to pass a Node `Readable` directly to `fetch`, causing undici to fall back to `Transfer-Encoding: chunked`. S3 presigned PUT URLs reject chunked with 501 NotImplemented. Fix buffers the archive first so `Content-Length` is set. Includes: - Regression test that spins up a local HTTP server and asserts `Content-Length` is set and matches the body, and `Transfer-Encoding` is not chunked. - Type-fix for the CLI's typecheck (cast `Pack` → `AsyncIterable<Buffer>`). - Dynamic import of `node:stream/consumers` so the browser bundle doesn't pull it in. - python-sdk: Adds sync + async regression tests for `upload_file` that guard against the same class of bug (someone swapping `tar_buffer.getvalue()` for a stream/generator). No Python code change — the current implementation already passes bytes to `httpx.put(..., content=...)`. Authorship of the original JS fix commit preserved (truffle-dev). Closes #1243. ## Test plan - [x] `pnpm run test tests/template/uploadFile.test.ts` — passes - [x] `pnpm run typecheck` / `lint` clean across js-sdk and cli - [x] `poetry run pytest tests/sync/template_sync/test_upload_file.py tests/async/template_async/test_upload_file.py -v` — both pass - [x] `poetry run make format` / `make lint` / `make typecheck` clean 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: truffle <truffleagent@gmail.com> Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>	2026-04-24 07:14:54 -07:00
Mish Ushakov	b97fd4dfd0	test: remove apt, bun, npm, pip install tests (#1275 ) ## Summary - Deletes install test files for apt, bun, npm, and pip in both JS and Python SDKs - Removes sync and async variants in Python - Stacktrace tests for these install methods are kept 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-24 06:27:23 -07:00
Mish Ushakov	c2d6eef78d	test: reduce test_sbx_metrics flakiness by extending polling window (#1291 ) ## Summary - Bumps metrics polling from 15s to 30s in Python async/sync and JS SDK tests so the backend has enough headroom to populate metrics under load — this test was the new #1 CI offender (5/9 Python runs and 4/10 JS runs failed). - Raises the async Python sandbox timeout from 20s to 60s for parity with sync, and adds per-test timeout overrides (`@pytest.mark.timeout(60)` / `{ timeout: 60_000 }`) so polling can complete under the default 30s pytest/vitest cap. - Happy path is unchanged: the loop still breaks as soon as metrics appear. ## Test plan - [x] `pnpm run format`, `pnpm run lint`, `pnpm run typecheck` pass - [x] `test_sbx_metrics` (Python async) passed locally in 8.4s - [x] `test_sbx_metrics` (Python sync) passed locally in 15.6s - [x] `metrics.test.ts` (JS) passed locally in 20.7s 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>	2026-04-24 06:03:49 -07:00
Matt Brockman	a6a1156a76	fix: cli info handles not found without showing error message (#1247 ) Handles sandbox not found on cli info	2026-04-21 08:33:07 -07:00

1 2 3 4 5 ...

1653 Commits