## Summary
- `e2b auth login` previously crashed on headless machines (no
`xdg-open`) with an unhandled `error` event from the spawned browser
process.
- Attach an `error` listener (and `.catch`) to the `open` call; on
failure, print the login URL so the user can open it manually.
- Added a changeset for `@e2b/cli` (patch).
## Test plan
- [ ] On a headless Linux box without `xdg-open`, run `e2b auth login`
and confirm the CLI prints the manual URL instead of crashing.
- [ ] On macOS/Linux with a desktop, confirm the browser still opens
automatically and login completes.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Enables HTTP/2 for JS SDK sandbox envd traffic in Node by routing envd
RPC/API requests through undici with an HTTP/2-enabled dispatcher.
Non-Node runtimes continue to use global fetch. Management API and
volume clients are unchanged.
Requires bumping node from >=20 to >= 20.18.1 for undici
## Summary
Resolves the remaining 6 high-severity Dependabot alerts for `tar` on
the default branch. `tar@6.2.1` was being pulled in transitively via
`npm-check-updates@16 -> pacote@15 / cacache -> tar@^6`, and
Dependabot's `<= 7.5.10` ranges include 6.x semver-wise. Since
`npm-check-updates` was declared as a `devDependency` but never actually
invoked anywhere (no script, CI workflow, or doc references it),
removing it entirely is cleaner than bumping it — alerts cleared with
zero risk of regression.
After removal, the lock contains only `tar@7.5.12`, which satisfies all
six advisories.
## Test plan
- [x] `pnpm run lint` (js-sdk + cli)
- [x] `pnpm run typecheck` (js-sdk + cli)
- [x] `pnpm run format` (js-sdk + cli)
- [x] tar-related unit tests pass (`tests/template/utils`,
`tests/template/uploadFile` — 54 tests)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
## Summary
Resolves all 31 open [Dependabot
alerts](https://github.com/e2b-dev/e2b/security/dependabot) across the
workspace.
- **npm** — added range-based `pnpm.overrides` to bump vulnerable
transitive deps to their patched versions: postcss, vite, lodash,
brace-expansion, picomatch (2.x + 4.x), yaml, @tootallnate/once,
smol-toml, flatted, and minimatch (3.x/5.x/9.x/10.x).
- **python-sdk** — bumped dev deps in `poetry.lock`: pytest 7.4 → 9.0.3
(with constraint update in `pyproject.toml`), pytest-asyncio 0.23 → 1.3
(required for pytest 9), python-dotenv 1.2.2, pygments 2.20.0, requests
2.33.1, black 26.3.1; removed 4 now-unused `# ty: ignore` directives
that pytest 9's stricter type signatures made obsolete.
## Test plan
- [x] \`pnpm run typecheck\` passes
- [x] \`pnpm run lint\` passes
- [x] \`pnpm run format\` clean
- [x] CLI tests (80/80) and js-sdk/python-sdk unit tests pass;
integration tests not run locally (need \`E2B_API_KEY\`)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
## Summary
Replaced `update-notifier` v6 with `simple-update-notifier` v2 to fix
the bundled CLI.
`update-notifier` v6 is ESM-only and spawns a child process (`check.js`)
using `import.meta.url`. When tsup bundles the CLI into a single CJS
file, these file paths become invalid and the update check silently
fails. `simple-update-notifier` is CJS-compatible, checks inline without
spawning, and has an identical API surface.
## Test plan
- ✓ All 79 existing CLI tests pass
- ✓ TypeScript, linting, and formatting checks pass
- ✓ Update check banner still displays with same interval
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Low Risk**
> Low risk: swaps the CLI update-check library and tweaks startup flow
to run the check asynchronously; behavior should be equivalent but could
affect when/if the banner prints.
>
> **Overview**
> Fixes the CLI update banner by replacing `update-notifier` with
`simple-update-notifier`, dropping the old dependency (and its types)
and adding the new one.
>
> Updates the CLI entrypoint to use `parseAsync()` and run the update
check via an async `main()` function after argument parsing, and adds a
changeset bumping `@e2b/cli` as a patch release.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
a2ddaeec0b4d0324f388d088916a9fcc7ba17432. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
---------
Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> **Medium Risk**
> Medium risk because it deletes a large subtree (`apps/web`) and
removes SDK-reference generation/commit steps from the package publish
workflow, which may affect downstream docs/release expectations.
>
> **Overview**
> **Removes the docs web app and generated SDK reference content.** The
PR deletes `apps/web` configs/scripts (Next.js/MDX setup, Sentry config,
prebuild/sitemap generation) and removes the committed `sdk-reference`
MDX pages.
>
> **Simplifies repo automation and ownership.** The package publish
workflow no longer generates/clones/commits SDK reference docs,
`CODEOWNERS` drops web/docs ownership entries, and the root ESLint
config removes `@stylistic/ts` in favor of the built-in `semi` rule.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
4158d777b5f3d3fa30b538e434d34ce0e697d473. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> **Medium Risk**
> Primarily dependency/lockfile updates across the JS monorepo; risk
comes from transitive runtime changes and potential build/lint behavior
shifts after the version bumps.
>
> **Overview**
> Updates JS dependencies across the repo and refreshes the
`pnpm-lock.yaml` to match.
>
> Also bumps tooling-related versions (notably `pnpm` via
`packageManager` and the ESLint/TypeScript ESLint toolchain) and
adds/keeps a `pnpm.overrides` pin for `@next/eslint-plugin-next`'s
`glob` dependency.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
eceea9624f031c7d3ba74000018f01c71cfc510e. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> **Low Risk**
> Low risk dependency-only change; behavior should be unchanged aside
from upstream `tar` bugfixes/patches that could subtly affect archive
creation in the JS SDK.
>
> **Overview**
> Updates the JS SDK dependency on `tar` from `^7.5.4` to `^7.5.9` in
`packages/js-sdk/package.json`.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
664f95865263fe5f42b60bc3516240bb89fb879e. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> **Low Risk**
> Only build tooling/dependency metadata changes; no runtime or product
code paths are modified.
>
> **Overview**
> Removes the `update-deps` script and `npm-check-updates` dev
dependency from both `packages/cli` and `packages/js-sdk`.
>
> Updates `pnpm-lock.yaml` to drop `npm-check-updates` and its
transitive dependency set, reducing lockfile size and dependency surface
area.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
61529b6b5303ce1a5ecafa1e3adb65fea4facae2. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> Upgrade `e2b` to 2.8.4 in CLI, update `eslint-config-next` to 14.2.35
in web app, add pnpm override for `@next/eslint-plugin-next>glob`, and
refresh lockfile.
>
> - **Dependencies**:
> - **CLI**: Bump `e2b` from `^2.7.0` to `^2.8.4` in
`packages/cli/package.json`.
> - **Web**: Update `eslint-config-next` from `14.2.21` to `14.2.35` in
`apps/web/package.json`.
> - **Tooling/Config**:
> - Add pnpm override to force `@next/eslint-plugin-next>glob@*` to
`10.5.0` in root `package.json`.
> - **Lockfile**:
> - Regenerate `pnpm-lock.yaml` reflecting the above upgrades and
transitive dependency adjustments (e.g.,
`@next/eslint-plugin-next@14.2.35`, `glob@10.5.0`).
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
b143ae8745bb90ff83a0332364ee5052f76db3fb. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> Caches Playwright binaries in JS CI and refactors JS/Python template
tests to use API mocks and aliases, add Dockerfile tests, and update
install APIs to single-package calls.
>
> - **CI**:
> - Cache Playwright binaries on `ubuntu-22.04` and `windows-latest` in
`.github/workflows/js_sdk_tests.yml` to speed JS SDK tests.
> - **JS SDK Tests**:
> - Extend `buildTemplate` options to accept `alias` in
`tests/setup.ts`.
> - Add `fromDockerfile` tests and switch some builds to
`fromBaseImage`; add build-from-base-template test.
> - Update install method tests to single-package calls for
`aptInstall`, `npmInstall`, `bunInstall`, `pipInstall`.
> - Tweak `makeSymlink` test order to ensure overwrite behavior.
> - Overhaul stacktrace tests to use `msw` server mocks and alias-based
failure mapping.
> - **Python SDK Tests**:
> - `build`/`async_build` fixtures accept optional `alias`.
> - Add `from_dockerfile` tests (sync/async); use base image/base
template where applicable.
> - Update install method tests to single-package calls.
> - Rewrite stacktrace tests to monkeypatch API calls with alias-based
failure mapping.
> - **Dependencies**:
> - Add dev dependency `msw` to `packages/js-sdk/package.json`.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
1b7f84f4ce692f664c3ce4cdb345f4c3a028b17a. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Mish Ushakov