<!-- CURSOR_SUMMARY -->
> [!NOTE]
> Aligns metrics APIs to use Unix seconds (no milliseconds) for
`start`/`end` across SDKs.
>
> - **JS SDK**: `SandboxMetricsOpts` `start`/`end` now `Date` only;
convert to seconds before calling `GET /sandboxes/{sandboxID}/metrics`.
> - **Python SDK (async/sync)**: send `int(timestamp())` for
`start`/`end` instead of milliseconds.
> - **Tests**: JS and Python tests now pass `start`/`end` and validate
non-empty results.
> - **Changesets**: patch notes for `e2b` and `@e2b/python-sdk`.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7c59f8023fc0de9a5eda7ffd4c588057c7465f3e. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
## Summary
The public API accepts `Optional[float]` for timeout parameters (e.g.,
`60.0`), but `_create_stream_timeout` was typed as `Optional[int]` and
passed the value directly to `str()`, producing `'60000.0'` instead of
`'60000'`.
The Go backend's `strconv.ParseInt` fails on float strings, causing
'invalid syntax' errors for valid timeout values.
## Changes
- Updates type hint to `Optional[float]` for consistency with public API
- Wraps `timeout * 1000` in `int()` before `str()` conversion
## Test
```python
# Before: str(60.0 * 1000) -> '60000.0' (fails ParseInt)
# After: str(int(60.0 * 1000)) -> '60000' (works)
```
Fixes#1063
small follow-up to #1068
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> Aligns alias existence error handling across SDKs to use
template-specific errors.
>
> - JS: `checkAliasExists` now passes `TemplateError` to
`handleApiError` and imports `TemplateError` in `buildApi.ts`
> - Python: `check_alias_exists` uses `TemplateException` in both async
and sync `build_api.py`
> - Adds changeset for patch releases of `@e2b/python-sdk` and `e2b`
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
0624c03207d0ee09b2fc838e204f6232cba5c748. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Integration tests will fail until the feature is deployed in E2B Cloud
production.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> Enables checking template alias availability from both SDKs.
>
> - JS: Implements `checkAliasExists` in `template/buildApi.ts`, exposes
`Template.aliasExists` in `template/index.ts`, adds `AliasExistsOptions`
type and tests
> - Python: Adds `Template.alias_exists` and
`AsyncTemplate.alias_exists` wired to generated
`get_templates_aliases_{alias}` client; includes sync/async tests
> - API: Regenerates schemas/clients to include `GET
/templates/aliases/{alias}`, template build logs endpoint and
parameters, and supporting models (e.g., `TemplateAliasResponse`)
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
4e577fd77888478ac83b66db7537cd2355ea050b. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
---------
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> Adds support for parsing ownership on file copy operations in
Dockerfile-based templates.
>
> - JS: Update `dockerfileParser.ts` to treat `COPY/ADD` as
`ModifiableInstruction`, parse `--chown` via `instruction.getFlags()`,
and pass `user` to `templateBuilder.copy(src, dest, { user })`
> - Python: Update `_handle_copy_instruction` in `dockerfile_parser.py`
to extract `--chown=<user[:group]>` and pass `user` to
`template_builder.copy(src, dest, user=user)`
> - Tests: Add JS and Python (sync/async) tests verifying `COPY --chown`
parsing and argument propagation
> - Changeset: Patch releases for `@e2b/python-sdk` and `e2b`
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
9f3b151be18288bdcc41eaf37157b5d4572f0abf. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
## Summary
- Fixes garbled Unicode and box-drawing character rendering when running
tmux inside E2B sandboxes
- Adds `LANG=C.UTF-8` and `LC_ALL=C.UTF-8` environment variable defaults
to PTY creation in both JS/TS and Python SDKs
## Problem
When running applications like Claude Code inside tmux in an E2B
sandbox, Unicode characters and box-drawing glyphs render incorrectly:
**Before (broken):**
- Box-drawing characters appear as broken dashes
- Text alignment is garbled
- The Claude mascot renders as `------` instead of proper pixel art
**After (fixed):**
- Proper Unicode rendering
- Correct box-drawing characters
- Properly aligned text
## Root Cause
The PTY session was created with `TERM=xterm-256color` but without UTF-8
locale settings. Running `locale` in the sandbox showed:
```
LANG=
LC_CTYPE="POSIX"
LC_ALL=
```
tmux requires UTF-8 locale settings to properly render Unicode
characters. Without them, it falls back to ASCII-only rendering.
## Solution
Set `LANG` and `LC_ALL` to `C.UTF-8` by default when creating PTY
sessions. This locale is:
- Available on most modern Linux distributions
- Provides UTF-8 character encoding
- Portable and doesn't require specific locale packages
The fix uses `setdefault` (Python) / nullish coalescing (JS) to allow
users to override these values if needed.
## Files Changed
| File | Change |
|------|--------|
| `packages/js-sdk/src/sandbox/commands/pty.ts` | Add LANG and LC_ALL
defaults |
| `packages/python-sdk/e2b/sandbox_async/commands/pty.py` | Add LANG and
LC_ALL defaults |
| `packages/python-sdk/e2b/sandbox_sync/commands/pty.py` | Add LANG and
LC_ALL defaults |
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Fix tmux Unicode rendering by enforcing UTF-8 locale in PTYs**
>
> - In PTY creation (JS `pty.ts`, Python async/sync `pty.py`), default
`LANG` and `LC_ALL` to `C.UTF-8`; set `TERM` only if not already
provided
> - Adds changeset entry documenting the patch
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
a914027d39568da2c9b022cb25e6f9b4e9aab91c. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Add a note to the template environment variables that they exist only
during template build, so users don't get confused.
---------
Co-authored-by: Mish <10400064+mishushakov@users.noreply.github.com>
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> Introduce `connect` methods to attach to running PTY sessions across
JS and Python SDKs, with tests and default timeout handling.
>
> - **SDKs**:
> - **JS (`packages/js-sdk/src/sandbox/commands/pty.ts`)**:
> - Add `Pty.connect(pid, opts?)` to attach to running PTYs; accepts
`PtyConnectOpts` with `onData`, `timeoutMs`, and `requestTimeoutMs`.
> - Factor default PTY connection timeout via
`defaultPtyConnectionTimeout` and apply to `create`/`connect` calls.
> - **Python**:
> - Async: Add `AsyncSandbox.pty.connect(pid, on_data, timeout?,
request_timeout?)` in `e2b/sandbox_async/commands/pty.py`.
> - Sync: Add `sandbox.pty.connect(pid, timeout?, request_timeout?)` in
`e2b/sandbox_sync/commands/pty.py`.
> - **Tests**:
> - JS: `packages/js-sdk/tests/sandbox/pty/ptyConnect.test.ts` validates
connect/reconnect and output handling.
> - Python: async and sync tests under
`packages/python-sdk/tests/.../pty/test_pty_connect.py` verify
reconnection and exit codes.
> - **Release**:
> - Changeset: minor version bumps for `@e2b/python-sdk` and `e2b`; note
“added option to connect to a running pty session”.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
539c4f518606544dfcef253df5bde49354fe7903. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
---------
Co-authored-by: Mish <10400064+mishushakov@users.noreply.github.com>
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> Adjusts the watch directory test to modify the file content and scan
returned events for a WRITE on the target file instead of asserting the
first event.
>
> - **Tests (python-sdk)**:
> - Updates `tests/sync/sandbox_sync/files/test_watch.py`
`test_watch_directory_changes` to:
> - Write updated content after `watch_dir` is started.
> - Iterate over `handle.get_new_events()` to find a
`FilesystemEventType.WRITE` for the target filename, asserting its
presence.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
f32678e4ed4b141ff9dc498fd9c655f374a66c76. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> Upgrade `e2b` to 2.8.4 in CLI, update `eslint-config-next` to 14.2.35
in web app, add pnpm override for `@next/eslint-plugin-next>glob`, and
refresh lockfile.
>
> - **Dependencies**:
> - **CLI**: Bump `e2b` from `^2.7.0` to `^2.8.4` in
`packages/cli/package.json`.
> - **Web**: Update `eslint-config-next` from `14.2.21` to `14.2.35` in
`apps/web/package.json`.
> - **Tooling/Config**:
> - Add pnpm override to force `@next/eslint-plugin-next>glob@*` to
`10.5.0` in root `package.json`.
> - **Lockfile**:
> - Regenerate `pnpm-lock.yaml` reflecting the above upgrades and
transitive dependency adjustments (e.g.,
`@next/eslint-plugin-next@14.2.35`, `glob@10.5.0`).
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
b143ae8745bb90ff83a0332364ee5052f76db3fb. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> Refactors the ESM file URL test for `getCallerDirectory` to use temp
paths and `pathToFileURL`, removing hardcoded paths and a redundant
case.
>
> - **Tests**
(`packages/js-sdk/tests/template/utils/getCallerDirectory.test.ts`):
> - Refactor ESM `file://` handling test to be platform-agnostic:
> - Use `os.tmpdir()` and `path.join` to build test paths.
> - Use `pathToFileURL` instead of string-building `file://` URLs.
> - Update assertions to compare against computed paths.
> - Remove redundant "three slashes" `file://` URL test.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
08a197d1fe86d609e08e333f0226051e5c7e36e3. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
## Summary
Fixes#1045
`getCallerDirectory()` fails in ESM modules because
`CallSite.getFileName()` returns
`file://` URLs, but `path.dirname()` doesn't handle URLs.
**Fix:** Convert `file://` URLs to filesystem paths using
`fileURLToPath()` before
passing to `path.dirname()`.
## Changes
- Added `fileURLToPath` import from `node:url`
- Updated `getCallerDirectory()` to handle `file://` URLs
- Added unit tests for ESM URL handling
## Testing
- Built the SDK locally (`pnpm run build`)
- Linked to a test ESM project using my [reproduction
repository](https://github.com/bxxf/e2b-template-issue-repro) (`pnpm
link`)
- Verified `Template().copy()` works without `ENOENT` errors
- All existing tests pass
---------
Co-authored-by: Filip Brebera <filip.brebera@gendigital.com>
Co-authored-by: Mish <10400064+mishushakov@users.noreply.github.com>
Bumps the pip group with 1 update in the /packages/python-sdk directory:
[urllib3](https://github.com/urllib3/urllib3).
Updates `urllib3` from 2.5.0 to 2.6.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/releases">urllib3's
releases</a>.</em></p>
<blockquote>
<h2>2.6.0</h2>
<h2>🚀 urllib3 is fundraising for HTTP/2 support</h2>
<p><a
href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3
is raising ~$40,000 USD</a> to release HTTP/2 support and ensure
long-term sustainable maintenance of the project after a sharp decline
in financial support. If your company or organization uses Python and
would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and
thousands of other projects <a
href="https://opencollective.com/urllib3">please consider contributing
financially</a> to ensure HTTP/2 support is developed sustainably and
maintained for the long-haul.</p>
<p>Thank you for your support.</p>
<h2>Security</h2>
<ul>
<li>Fixed a security issue where streaming API could improperly handle
highly compressed HTTP content ("decompression bombs") leading
to excessive resource consumption even when a small amount of data was
requested. Reading small chunks of compressed data is safer and much
more efficient now. (CVE-2025-66471 reported by <a
href="https://github.com/Cycloctane"><code>@Cycloctane</code></a>, 8.9
High, GHSA-2xpw-w6gg-jr37)</li>
<li>Fixed a security issue where an attacker could compose an HTTP
response with virtually unlimited links in the
<code>Content-Encoding</code> header, potentially leading to a denial of
service (DoS) attack by exhausting system resources during decoding. The
number of allowed chained encodings is now limited to 5. (CVE-2025-66418
reported by <a
href="https://github.com/illia-v"><code>@illia-v</code></a>, 8.9 High,
GHSA-gm62-xv2j-4w53)</li>
</ul>
<blockquote>
<p>[!IMPORTANT]</p>
<ul>
<li>If urllib3 is not installed with the optional
<code>urllib3[brotli]</code> extra, but your environment contains a
Brotli/brotlicffi/brotlipy package anyway, make sure to upgrade it to at
least Brotli 1.2.0 or brotlicffi 1.2.0.0 to benefit from the security
fixes and avoid warnings. Prefer using <code>urllib3[brotli]</code> to
install a compatible Brotli package automatically.</li>
<li>If you use custom decompressors, please make sure to update them to
respect the changed API of
<code>urllib3.response.ContentDecoder</code>.</li>
</ul>
</blockquote>
<h2>Features</h2>
<ul>
<li>Enabled retrieval, deletion, and membership testing in
<code>HTTPHeaderDict</code> using bytes keys. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3653">#3653</a>)</li>
<li>Added host and port information to string representations of
<code>HTTPConnection</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3666">#3666</a>)</li>
<li>Added support for Python 3.14 free-threading builds explicitly. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3696">#3696</a>)</li>
</ul>
<h2>Removals</h2>
<ul>
<li>Removed the <code>HTTPResponse.getheaders()</code> method in favor
of <code>HTTPResponse.headers</code>. Removed the
<code>HTTPResponse.getheader(name, default)</code> method in favor of
<code>HTTPResponse.headers.get(name, default)</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3622">#3622</a>)</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>Fixed redirect handling in <code>urllib3.PoolManager</code> when an
integer is passed for the retries parameter. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3649">#3649</a>)</li>
<li>Fixed <code>HTTPConnectionPool</code> when used in Emscripten with
no explicit port. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3664">#3664</a>)</li>
<li>Fixed handling of <code>SSLKEYLOGFILE</code> with expandable
variables. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3700">#3700</a>)</li>
</ul>
<h2>Misc</h2>
<ul>
<li>Changed the <code>zstd</code> extra to install
<code>backports.zstd</code> instead of <code>zstandard</code> on Python
3.13 and before. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3693">#3693</a>)</li>
<li>Improved the performance of content decoding by optimizing
<code>BytesQueueBuffer</code> class. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3710">#3710</a>)</li>
<li>Allowed building the urllib3 package with newer setuptools-scm v9.x.
(<a
href="https://redirect.github.com/urllib3/urllib3/issues/3652">#3652</a>)</li>
<li>Ensured successful urllib3 builds by setting Hatchling requirement
to ≥ 1.27.0. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3638">#3638</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's
changelog</a>.</em></p>
<blockquote>
<h1>2.6.0 (2025-12-05)</h1>
<h2>Security</h2>
<ul>
<li>Fixed a security issue where streaming API could improperly handle
highly
compressed HTTP content ("decompression bombs") leading to
excessive resource
consumption even when a small amount of data was requested. Reading
small
chunks of compressed data is safer and much more efficient now.
(<code>GHSA-2xpw-w6gg-jr37
<https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37></code>__)</li>
<li>Fixed a security issue where an attacker could compose an HTTP
response with
virtually unlimited links in the <code>Content-Encoding</code> header,
potentially
leading to a denial of service (DoS) attack by exhausting system
resources
during decoding. The number of allowed chained encodings is now limited
to 5.
(<code>GHSA-gm62-xv2j-4w53
<https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53></code>__)</li>
</ul>
<p>.. caution::</p>
<ul>
<li>
<p>If urllib3 is not installed with the optional
<code>urllib3[brotli]</code> extra, but
your environment contains a Brotli/brotlicffi/brotlipy package anyway,
make
sure to upgrade it to at least Brotli 1.2.0 or brotlicffi 1.2.0.0 to
benefit from the security fixes and avoid warnings. Prefer using
<code>urllib3[brotli]</code> to install a compatible Brotli package
automatically.</p>
</li>
<li>
<p>If you use custom decompressors, please make sure to update them to
respect the changed API of
<code>urllib3.response.ContentDecoder</code>.</p>
</li>
</ul>
<h2>Features</h2>
<ul>
<li>Enabled retrieval, deletion, and membership testing in
<code>HTTPHeaderDict</code> using bytes keys.
(<code>[#3653](https://github.com/urllib3/urllib3/issues/3653)
<https://github.com/urllib3/urllib3/issues/3653></code>__)</li>
<li>Added host and port information to string representations of
<code>HTTPConnection</code>.
(<code>[#3666](https://github.com/urllib3/urllib3/issues/3666)
<https://github.com/urllib3/urllib3/issues/3666></code>__)</li>
<li>Added support for Python 3.14 free-threading builds explicitly.
(<code>[#3696](https://github.com/urllib3/urllib3/issues/3696)
<https://github.com/urllib3/urllib3/issues/3696></code>__)</li>
</ul>
<h2>Removals</h2>
<ul>
<li>Removed the <code>HTTPResponse.getheaders()</code> method in favor
of <code>HTTPResponse.headers</code>.
Removed the <code>HTTPResponse.getheader(name, default)</code> method in
favor of <code>HTTPResponse.headers.get(name, default)</code>.
(<code>[#3622](https://github.com/urllib3/urllib3/issues/3622)
<https://github.com/urllib3/urllib3/issues/3622></code>__)</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>Fixed redirect handling in <code>urllib3.PoolManager</code> when an
integer is passed
for the retries parameter.
(<code>[#3649](https://github.com/urllib3/urllib3/issues/3649)
<https://github.com/urllib3/urllib3/issues/3649></code>__)</li>
<li>Fixed <code>HTTPConnectionPool</code> when used in Emscripten with
no explicit port.
(<code>[#3664](https://github.com/urllib3/urllib3/issues/3664)
<https://github.com/urllib3/urllib3/issues/3664></code>__)</li>
<li>Fixed handling of <code>SSLKEYLOGFILE</code> with expandable
variables.
(<code>[#3700](https://github.com/urllib3/urllib3/issues/3700)
<https://github.com/urllib3/urllib3/issues/3700></code>__)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/urllib3/urllib3/commit/720f484b605f18887a48eef448d0084e2b76902d"><code>720f484</code></a>
Release 2.6.0</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8"><code>24d7b67</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7"><code>c19571d</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/816fcf04528bc0f89672e13398eb813dcc892490"><code>816fcf0</code></a>
Bump actions/setup-python from 6.0.0 to 6.1.0 (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3725">#3725</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/18af0a10efc4c99dd028f7ad5a461470b9a8b0fd"><code>18af0a1</code></a>
Improve speed of <code>BytesQueueBuffer.get()</code> by using memoryview
(<a
href="https://redirect.github.com/urllib3/urllib3/issues/3711">#3711</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/1f6abac3e6d426c3939b8a17cf4afa099e691ab2"><code>1f6abac</code></a>
Bump versions of pre-commit hooks (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3716">#3716</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/1c8fbf787b8e6ed151842c5d6874c9d5bdbf1d0b"><code>1c8fbf7</code></a>
Bump actions/checkout from 5.0.0 to 6.0.0 (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3722">#3722</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/7784b9eee95b7c90802c02b111e98df70259ae4f"><code>7784b9e</code></a>
Add Python 3.15 to CI (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3717">#3717</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/0241c9e7286d3008e3cce18effc13b40dc633385"><code>0241c9e</code></a>
Updated docs to reflect change in optional zstd dependency from
<code>zstandard</code> t...</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/7afcabb6489d9a8ea95a40e5afcb46463af17351"><code>7afcabb</code></a>
Expand environment variable of SSLKEYLOGFILE (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3705">#3705</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/urllib3/urllib3/compare/2.5.0...2.6.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/e2b-dev/E2B/network/alerts).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
What was happening is that the following snippet:
```dockerfile
CMD ["sleep", "20"]
```
Was incorrectly converted to:
```
sleep, 20
```
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> Fixes parsing of Dockerfile CMD/ENTRYPOINT array syntax to a proper
start command and updates tests accordingly.
>
> - **Python SDK**:
> - `e2b/template/dockerfile_parser.py`: Parse CMD/ENTRYPOINT JSON array
(e.g., `["sleep", "20"]`) into a space-joined command (`sleep 20`) and
set as `start_cmd`.
> - **Tests**:
> - JS SDK and Python (sync/async): Add ENTRYPOINT case and assert
`startCmd`/`_start_cmd` equals `sleep 20`.
> - **Release**:
> - Changeset: patch bump for `@e2b/python-sdk`.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
ed257ab11e618ece3e5fe70f232a3265fd857ad4. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> Caches Playwright binaries in JS CI and refactors JS/Python template
tests to use API mocks and aliases, add Dockerfile tests, and update
install APIs to single-package calls.
>
> - **CI**:
> - Cache Playwright binaries on `ubuntu-22.04` and `windows-latest` in
`.github/workflows/js_sdk_tests.yml` to speed JS SDK tests.
> - **JS SDK Tests**:
> - Extend `buildTemplate` options to accept `alias` in
`tests/setup.ts`.
> - Add `fromDockerfile` tests and switch some builds to
`fromBaseImage`; add build-from-base-template test.
> - Update install method tests to single-package calls for
`aptInstall`, `npmInstall`, `bunInstall`, `pipInstall`.
> - Tweak `makeSymlink` test order to ensure overwrite behavior.
> - Overhaul stacktrace tests to use `msw` server mocks and alias-based
failure mapping.
> - **Python SDK Tests**:
> - `build`/`async_build` fixtures accept optional `alias`.
> - Add `from_dockerfile` tests (sync/async); use base image/base
template where applicable.
> - Update install method tests to single-package calls.
> - Rewrite stacktrace tests to monkeypatch API calls with alias-based
failure mapping.
> - **Dependencies**:
> - Add dev dependency `msw` to `packages/js-sdk/package.json`.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
1b7f84f4ce692f664c3ce4cdb345f4c3a028b17a. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> Add Windows to CI matrices and make JS/Python utils and tests
cross-platform via path handling updates.
>
> - **CI**:
> - Add Windows to test matrices in `cli_tests.yml`, `js_sdk_tests.yml`,
`python_sdk_tests.yml`; set bash shell/workdirs; disable fail-fast for
some jobs.
> - Python CI runs `pytest -n 4` via Poetry.
> - **JS SDK**:
> - Path normalization for globbing (`normalizePath`) and use of
`Path.relativePosix()` in hashing and tar creation in
`src/template/utils.ts`.
> - **Python SDK**:
> - Add `normalize_path` and use forward-slash glob patterns in
`e2b/template/utils.py`.
> - **Tests**:
> - Make stack trace parsing robust to Windows paths; use `basename` in
file assertions; adjust Python tar tests tempdir fixture handling.
> - **Changeset**: add patch note for windows-related fixes.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
1b8dbe4a1af642dbcb86500837e93f7998b223f6. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
---------
Co-authored-by: Joseph Lombrozo <joe.lombrozo@e2b.dev>
Fixes issue https://github.com/e2b-dev/E2B/issues/1032
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> Preserve Dockerfile USER/WORKDIR when provided and only apply E2B
defaults if absent, with tests and CLI fixtures updated accordingly.
>
> - **Dockerfile parsing (SDKs)**:
> - **JS (`packages/js-sdk/src/template/dockerfileParser.ts`)**: Track
`USER`/`WORKDIR` usage and only set E2B defaults (`user`, `/home/user`)
if not specified; keep Docker defaults (`root`, `/`) initially.
> - **Python
(`packages/python-sdk/e2b/template/dockerfile_parser.py`)**: Same
behavior—preserve explicit `USER`/`WORKDIR`, fallback to defaults only
when absent.
> - **Tests**:
> - **JS**: Add tests for default vs. custom `USER`/`WORKDIR` in
`fromMethods.test.ts`.
> - **Python (async/sync)**: Add analogous tests in
`test_from_methods.py`.
> - **CLI template fixtures**:
> - Update expected outputs to remove redundant
`.set_user('user')`/`.set_workdir('/home/user')` when already specified;
minor ordering tweak for `.setStartCmd` in TS fixture.
> - **Changeset**:
> - Minor version bumps for `@e2b/python-sdk` and `e2b`; note: keep
Docker `WORKDIR` and `USER` if specified.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
1ce66362501932308292cef87b5d8a73012ee5f2. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
- removed machine, os, processor, release default headers (these do not
occur in the JS version)
- particularly, "processor" header was causing issues on Windows due to
incorrect formatting/escape.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> Removes unnecessary default headers from the Python SDK API client and
adds a patch changeset.
>
> - **Python SDK**:
> - Trim `default_headers` in `packages/python-sdk/e2b/api/metadata.py`
by removing `machine`, `os`, `processor`, and `release`.
> - **Release**:
> - Add changeset to publish a patch for `@e2b/python-sdk`.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
9a5ef769ee2eb0b9a05649c20a00dfd507984931. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
This takes some shortcuts in order to keep backwards compatibility.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> Reuses a singleton httpx transport/client across the SDK, introduces a
generic retry decorator for connect calls, and refactors code/tests to
use the shared clients and fixtures.
>
> - **SDK (transport/client reuse)**
> - Add global `limits` (configurable via `E2B_*` env vars) and switch
`ApiClient` to accept `transport` instead of `limits`.
> - Introduce `e2b.api.client_async/client_sync` with `get_transport()`
(singleton) and `get_api_client()`; update `Sandbox`/`AsyncSandbox`,
paginators, and sandbox APIs to use them.
> - Remove per-class `_limits` from `SandboxBase`/`TemplateBase`; merge
extra headers correctly; pass `E2b-Sandbox-Port` as string.
> - Template build flows (sync/async) now reuse the API client's
underlying httpx client for file uploads.
> - **Connect client** (`e2b_connect/client.py`)
> - Add `_retry` decorator and apply to unary/server-stream methods;
simplify reconnection logic; minor typing/headers cleanups.
> - **Tests**
> - Add retry unit tests; introduce
`sandbox_factory`/`async_sandbox_factory` and a session `event_loop`;
refactor tests to use factories and shared transports; adjust tar
archive expectations.
> - **Misc**
> - Add `.editorconfig`, CLI `.envrc`, and changeset entries.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
1d359231b63dc21b6c8d797886f7d6a77c9ed6b7. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
---------
Co-authored-by: Tomas Valenta <valenta.and.thomas@gmail.com>
Co-authored-by: Mish <10400064+mishushakov@users.noreply.github.com>
This requires [infra#1448](https://github.com/e2b-dev/infra/pull/1448)
first.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> Adds support to override the sandbox API URL (E2B_SANDBOX_URL) across
JS/Python SDKs, centralizes sandbox host/url logic with headers, and
updates CI to build the SDK before CLI.
>
> - **SDKs (JS & Python)**
> - Add `sandboxUrl` support in `ConnectionConfig` (env var
`E2B_SANDBOX_URL`), with new helpers `getSandboxUrl`/`getHost` and
shared `envdPort`.
> - Refactor sandbox initialization to use
`ConnectionConfig.getSandboxUrl(...)` and `getHost(...)`.
> - Always attach sandbox headers `E2b-Sandbox-Id` and
`E2b-Sandbox-Port` to sandbox and connect requests.
> - Python: thread `sandbox_url` through opts; update async/sync connect
calls to pass headers; minor fix to default `headers=None` in
`e2b_connect.client.Client` stream prep.
> - **CI**
> - Build `packages/js-sdk` before `packages/cli`; set step
`working-directory` for build/test.
> - **Dependencies**
> - Point `e2b` dependency in lockfile to local `../js-sdk` link.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
5dc58171af6c170f8640f49d736dbe9c571f2b21. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
---------
Co-authored-by: Mish <10400064+mishushakov@users.noreply.github.com>
- Individual tests must complete in less than 5 minutes
- Add a `make test` option that runs tests
- Upgrade poetry to 2.1.1 (the lock file was generated by this version,
so this just matches what we already expect)
- adopted from https://github.com/sindresorhus/callsites
- ~wip: have to test whether same trick works on Bun~
works on bun
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> Replaces regex-based path extraction with `callsites` for
`getCallerDirectory`, fixing Windows path handling and removing the old
helper and its tests.
>
> - **Template utils (`packages/js-sdk/src/template/utils.ts`)**:
> - Replace regex-based extraction with `callsites` and update
`getCallerDirectory` to use `CallSite.getFileName()` and `path.dirname`.
> - Remove `matchFileDir` helper.
> - **Tests**:
> - Delete `packages/js-sdk/tests/template/utils/matchFileDir.test.ts`.
> - **Changeset**:
> - Add patch note: fixes default context directory for Windows paths.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
effab6d61739fea336f6d443a29e712663d8607b. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
I have added tests, but here also a screenshot from Windows machine
correctly matching current directory from the caller:
<img width="1097" height="501" alt="Screenshot 2025-11-07 at 19 37 41"
src="https://github.com/user-attachments/assets/95e3f7e2-efd2-44f9-867e-6de54400c07a"
/>
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> Enhances `matchFileDir` to parse Windows and file:// stack trace paths
and adds tests; include changeset for patch release.
>
> - **packages/js-sdk**:
> - **Template utils (`src/template/utils.ts`)**:
> - Update `matchFileDir` regex and normalization to support Windows
drive letters, backslashes, and `file:///` URIs; strip `:line:column`
and trailing `)`.
> - **Tests (`tests/template/utils/matchFileDir.test.ts`)**:
> - Add cases for Windows paths (with/without anonymous), `file:///`
URIs, and paths containing parentheses.
> - **Release**:
> - Add changeset (`.changeset/every-wolves-brake.md`) marking a patch
for `e2b`.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
eb5303399e051878a125cef4ee6e92e21edd1867. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> Ensure file uploads honor ignore patterns (incl. .dockerignore),
refactor file discovery/tar streaming in JS/Python SDKs, and add
comprehensive tests.
>
> - **File upload behavior**:
> - JS/TS and Python uploads now pass `ignorePatterns` (merged from
`fileIgnorePatterns` and `.dockerignore`) to tar creation, ensuring
ignored files aren’t uploaded.
> - **Refactor/Utilities**:
> - Rename `getAllFilesForFilesHash` -> `getAllFilesInPath` with
optional directory inclusion in both SDKs.
> - Implement `tar_file_stream` (JS and Python) to build archives from
`getAllFilesInPath`, with `noDirRecurse` and symlink control.
> - Hashing functions updated to use `getAllFilesInPath`.
> - Type tweak: allow `None` in Python `stack_traces` during build wait.
> - **Integration**:
> - JS `uploadFile` and Python async/sync `upload_file` now use tar
streaming with ignore patterns; JS `Template` wires ignore patterns into
uploads.
> - **Tests**:
> - Add extensive tests for `getAllFilesInPath` and `tar_file_stream` in
JS and Python, covering ignore patterns, directories, sorting, and
symlinks.
> - Remove obsolete tests relying on old function names.
> - **Meta**:
> - Changeset entries for `@e2b/python-sdk` and `e2b` (patch).
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
2f83444f9006393f33e8c346bec1998b3a06044d. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> Upgrades CLI prompting deps (inquirer v12, @inquirer/prompts v7.9) and
switches release scripts to use pnpm/pnpx changeset; lockfile updated
accordingly.
>
> - **CLI**:
> - Upgrade `inquirer` to `^12.10.0` and `@inquirer/prompts` to `^7.9.0`
in `packages/cli/package.json`.
> - **Tooling/Release Scripts**:
> - Change root `package.json` scripts to use `pnpm changeset ...` and
add `changeset` script via `pnpx @changesets/cli`.
> - Remove direct root dependency on `@changesets/cli`.
> - **Lockfile**:
> - Refresh `pnpm-lock.yaml` to reflect dependency upgrades and
removals.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
0596c189ae264d795de4168a2d2497121ae0d72d. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Currently, when you provide a simple folder pattern like `folder/` to
copy() it will not check folders contents for changes (only the folder
metadata itself) which leads to stale caches.
This fix appends ** pattern when no pattern is specified for recursive
hash computation.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> Ensure folder COPY patterns hash contents recursively to fix cache
invalidation, adding a shared file-gathering helper, tests, and a Python
glob dependency.
>
> - **Template hashing (JS + Python SDKs)**:
> - Add `getAllFilesForFilesHash`
(`packages/js-sdk/src/template/utils.ts`) and
`get_all_files_for_files_hash`
(`packages/python-sdk/e2b/template/utils.py`) to collect directories and
nested files using glob patterns and ignores.
> - Update `calculateFilesHash`/`calculate_files_hash` to use the new
helpers, hashing recursive paths, metadata, and file contents; handle
symlinks consistently.
> - **Tests**:
> - Add comprehensive tests for recursive matching, ignore patterns,
sorting, empty dirs, symlinks in
`packages/js-sdk/tests/.../getAllFilesForFilesHash.test.ts` and Python
async/sync tests under
`packages/python-sdk/tests/.../test_get_all_files_for_files_hash.py`.
> - **Dependencies**:
> - Add `wcmatch` in `packages/python-sdk/pyproject.toml` for advanced
globbing.
> - **Release**:
> - Patch bump via `.changeset/green-mice-watch.md`.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
d495427d86ad4e4d5a280567baa63df40a3271fb. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
---------
Co-authored-by: Jakub Dobry <jakub.dobry8@gmail.com>
Jakub Novák
