Follow-up to #1559 with two changes. First, it removes four
`pnpm.overrides` entries whose targets are no longer in the dependency
graph at all — `@next/eslint-plugin-next>glob` (the parent package is
gone), `yaml@2.x`, `@tootallnate/once`, and `flatted`; the lockfile
change is header-only and no resolved package versions change, verified
with a clean `pnpm audit`. The remaining overrides are kept because no
parent's declared range excludes the vulnerable versions, so they are
the only enforcement of the patched floors. Second, it adds a patch
changeset for `@e2b/cli`: the CLI bundles all runtime dependencies into
`dist/index.js` at build time (tsdown `alwaysBundle`), so the patched
transitive deps from #1559 (e.g. brace-expansion 5.0.7 via the
glob/minimatch chains) only reach users through a new release. No
changeset is needed for the `e2b` SDK or Python SDK since they publish
dependency ranges that resolve fresh at user install time. Supersedes
#1560.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Fixes all 6 open [Dependabot
alerts](https://github.com/e2b-dev/E2B/security/dependabot) plus 2
advisories surfaced by `pnpm audit`, by bumping vulnerable transitive
dependencies through `pnpm.overrides`: vite 6.4.2→6.4.3
(`server.fs.deny` bypass, NTLMv2 hash disclosure), js-yaml 3.14.2→3.15.0
/ 4.1.1→4.3.0 (merge-key DoS), @babel/core 7.27.1→7.29.7 (arbitrary file
read via `sourceMappingURL`), brace-expansion 1.1.12→1.1.16 /
5.0.5→5.0.7 (DoS), and underscore 1.13.6→1.13.8 (recursion DoS). Vite
required a manual lockfile version+integrity rewrite because pnpm does
not re-resolve auto-installed optional peers (vite enters the graph via
vitest) when an override changes. Only brace-expansion@5 is in a runtime
dependency chain (`glob` in the SDK/CLI); all other bumps are dev
tooling, no package manifests changed, so no changeset is needed.
Verified with a clean `pnpm audit`, passing
lint/typecheck/format/builds, and a live vitest smoke test against a
real sandbox.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Replaces ESLint (and its `@typescript-eslint/*` and `unused-imports`
plugins) with [oxlint](https://oxc.rs) across the `js-sdk` and `cli`
packages. A root `.oxlintrc.json` replaces the three `.eslintrc.cjs`
files, the package `lint` scripts now run `oxlint`, the related
devDependencies are swapped for `oxlint`, and the lint CI path filter is
updated accordingly. Formatting rules
(`quotes`/`semi`/`linebreak-style`) are dropped because Prettier already
enforces them, and `no-unused-vars` is set to error to preserve the
previous unused-imports check. The one behavior change is that
`@typescript-eslint/member-ordering` has no oxlint equivalent and is no
longer enforced. `lint`, `typecheck`, and `prettier` all pass clean for
both packages.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
## Summary
Fixes Dependabot alert
[#304](https://github.com/e2b-dev/E2B/security/dependabot/304)
(critical,
[CVE-2026-9277](https://nvd.nist.gov/vuln/detail/CVE-2026-9277) /
[GHSA-w7jw-789q-3m8p](https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p)).
`shell-quote` is a transitive dependency (pulled in via `npm-run-all`).
Versions `< 1.8.4` are vulnerable to a command-injection issue:
`quote()` did not escape line terminators (`\n`, `\r`, U+2028, U+2029)
in object `.op` values, allowing content after a newline to execute as a
separate shell command.
This adds a pnpm override forcing `shell-quote` to `^1.8.4`, consistent
with the existing security-override pattern in the root `package.json`.
The lockfile now resolves `shell-quote@1.8.4`.
## Changes
- `package.json`: add `"shell-quote@<1.8.4": "^1.8.4"` to
`pnpm.overrides`
- `pnpm-lock.yaml`: regenerated — `shell-quote` 1.8.3 → 1.8.4
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Resolves Dependabot alert #300 (GHSA-58qx-3vcg-4xpx / CVE-2026-45736),
an uninitialized memory disclosure in `ws`. Adds a pnpm override forcing
`ws` to `^8.20.1`, which bumps the transitive resolution (pulled in via
`@vitest/browser`) from `8.19.0` to `8.21.0`. This follows the existing
override pattern in the root `package.json` for prior CVE bumps. No
changeset needed since only root dev tooling is affected.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
## Summary
Resolves all 31 open [Dependabot
alerts](https://github.com/e2b-dev/e2b/security/dependabot) across the
workspace.
- **npm** — added range-based `pnpm.overrides` to bump vulnerable
transitive deps to their patched versions: postcss, vite, lodash,
brace-expansion, picomatch (2.x + 4.x), yaml, @tootallnate/once,
smol-toml, flatted, and minimatch (3.x/5.x/9.x/10.x).
- **python-sdk** — bumped dev deps in `poetry.lock`: pytest 7.4 → 9.0.3
(with constraint update in `pyproject.toml`), pytest-asyncio 0.23 → 1.3
(required for pytest 9), python-dotenv 1.2.2, pygments 2.20.0, requests
2.33.1, black 26.3.1; removed 4 now-unused `# ty: ignore` directives
that pytest 9's stricter type signatures made obsolete.
## Test plan
- [x] \`pnpm run typecheck\` passes
- [x] \`pnpm run lint\` passes
- [x] \`pnpm run format\` clean
- [x] CLI tests (80/80) and js-sdk/python-sdk unit tests pass;
integration tests not run locally (need \`E2B_API_KEY\`)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> **Medium Risk**
> Medium risk because it deletes a large subtree (`apps/web`) and
removes SDK-reference generation/commit steps from the package publish
workflow, which may affect downstream docs/release expectations.
>
> **Overview**
> **Removes the docs web app and generated SDK reference content.** The
PR deletes `apps/web` configs/scripts (Next.js/MDX setup, Sentry config,
prebuild/sitemap generation) and removes the committed `sdk-reference`
MDX pages.
>
> **Simplifies repo automation and ownership.** The package publish
workflow no longer generates/clones/commits SDK reference docs,
`CODEOWNERS` drops web/docs ownership entries, and the root ESLint
config removes `@stylistic/ts` in favor of the built-in `semi` rule.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
4158d777b5f3d3fa30b538e434d34ce0e697d473. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
## Summary
- Resolved 43 type diagnostics reported by ty (Astral's Python type
checker)
- Fixed Self type issues on class singletons
- Added explicit type annotations for shadowed attributes
- Replaced None with UNSET for auto-generated API parameters
- Fixed method signature alignment for protocol matching
- Added targeted type: ignore suppressions for pattern-based limitations
All checks pass: ty check, ruff format, ruff check.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> Mostly typing/CI changes, but some adjustments affect sandbox
connect/pause overload dispatch and API response/parameter handling
(`UNSET` vs `None`), which could alter edge-case runtime behavior.
>
> **Overview**
> Fixes Python SDK static typing issues for Astral’s `ty` checker and
wires typechecking into CI.
>
> Adds a new `Typecheck` GitHub Action plus workspace `typecheck`
scripts (TS packages via `tsc`, Python SDK via `make typecheck` running
`ty`), and publishes a patch changeset for `@e2b/python-sdk`.
>
> Across the Python SDK, adjusts type annotations and overloads (e.g.,
`Self`/singleton typing, `connect` overloads, optional
`user`/token/domain handling), tightens API model parsing with
`cast`/`Optional` checks and `UNSET` usage, and adds a few targeted `ty`
ignore comments in tests/protocols to silence checker limitations.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
f66402847c40cee7e44e1aaa7caa97e271ba9978. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
---------
Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> Upgrade `e2b` to 2.8.4 in CLI, update `eslint-config-next` to 14.2.35
in web app, add pnpm override for `@next/eslint-plugin-next>glob`, and
refresh lockfile.
>
> - **Dependencies**:
> - **CLI**: Bump `e2b` from `^2.7.0` to `^2.8.4` in
`packages/cli/package.json`.
> - **Web**: Update `eslint-config-next` from `14.2.21` to `14.2.35` in
`apps/web/package.json`.
> - **Tooling/Config**:
> - Add pnpm override to force `@next/eslint-plugin-next>glob@*` to
`10.5.0` in root `package.json`.
> - **Lockfile**:
> - Regenerate `pnpm-lock.yaml` reflecting the above upgrades and
transitive dependency adjustments (e.g.,
`@next/eslint-plugin-next@14.2.35`, `glob@10.5.0`).
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
b143ae8745bb90ff83a0332364ee5052f76db3fb. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> Upgrades CLI prompting deps (inquirer v12, @inquirer/prompts v7.9) and
switches release scripts to use pnpm/pnpx changeset; lockfile updated
accordingly.
>
> - **CLI**:
> - Upgrade `inquirer` to `^12.10.0` and `@inquirer/prompts` to `^7.9.0`
in `packages/cli/package.json`.
> - **Tooling/Release Scripts**:
> - Change root `package.json` scripts to use `pnpm changeset ...` and
add `changeset` script via `pnpx @changesets/cli`.
> - Remove direct root dependency on `@changesets/cli`.
> - **Lockfile**:
> - Refresh `pnpm-lock.yaml` to reflect dependency upgrades and
removals.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
0596c189ae264d795de4168a2d2497121ae0d72d. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Mish Ushakov