github-featured/e2b-dev--e2b
2
0
Fork 0
Code Issues Pull Requests Deployments Models Agent Notes Packages Projects Releases Wiki Activity
4,872 Commits 148 Branches 691 Tags
@e2b/python-sdk@2.29.0
Commit Graph

4872 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Mish Ushakov 9ffb104456 fix(deps): override shell-quote to ^1.8.4 (CVE-2026-9277) (#1432) 
## Summary

Fixes Dependabot alert
[#304](https://github.com/e2b-dev/E2B/security/dependabot/304)
(critical,
[CVE-2026-9277](https://nvd.nist.gov/vuln/detail/CVE-2026-9277) /
[GHSA-w7jw-789q-3m8p](https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p)).

`shell-quote` is a transitive dependency (pulled in via `npm-run-all`).
Versions `< 1.8.4` are vulnerable to a command-injection issue:
`quote()` did not escape line terminators (`\n`, `\r`, U+2028, U+2029)
in object `.op` values, allowing content after a newline to execute as a
separate shell command.

This adds a pnpm override forcing `shell-quote` to `^1.8.4`, consistent
with the existing security-override pattern in the root `package.json`.
The lockfile now resolves `shell-quote@1.8.4`.

## Changes

- `package.json`: add `"shell-quote@<1.8.4": "^1.8.4"` to
`pnpm.overrides`
- `pnpm-lock.yaml`: regenerated — `shell-quote` 1.8.3 → 1.8.4

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
@e2b/python-sdk@2.29.0 e2b@2.30.0 		2026-06-15 15:55:32 +02:00
Mish Ushakov e873ee94b6 feat(sdk): add allowNetworkMounts option to filesystem watch (#1420) 
Client-side counterpart to
[e2b-dev/infra#2982](https://github.com/e2b-dev/infra/pull/2982): adds
an `allowNetworkMounts`/`allow_network_mounts` option to filesystem
directory watching across the JS and Python (sync + async) SDKs, so
clients can explicitly opt into watching paths on network filesystem
mounts (NFS, CIFS, SMB, FUSE), which envd rejects by default. Events on
network mounts may be unreliable or not delivered at all, hence the
explicit opt-in.

This regenerates the filesystem proto code from the updated spec and
threads the flag through `watchDir`/`watch_dir` (streaming `WatchDir`
and polling `CreateWatcher`). The option requires envd 0.6.4 (shipped by
the infra PR); using it against an older sandbox throws a
`TemplateError`/`TemplateException`. Default behavior is unchanged.

Includes new watch tests for all three SDKs and a minor-bump changeset
for `e2b` and `@e2b/python-sdk`.

> Note: the new tests exercise the flag on a regular directory (a
network mount can't be set up from SDK tests) and require envd 0.6.4, so
this should land with/after the infra deploy. All pre-existing watch
tests pass; the new ones currently fail with the expected
`TemplateError` against the deployed envd.

### Usage

**JavaScript**
```ts
const handle = await sandbox.files.watchDir(
  '/mnt/nfs-share/my-dir',
  (event) => console.log(event.type, event.name),
  { allowNetworkMounts: true }
)
```

**Python (async)**
```python
handle = await sandbox.files.watch_dir(
    "/mnt/nfs-share/my-dir",
    on_event=lambda e: print(e.type, e.name),
    allow_network_mounts=True,
)
```

**Python (sync)**
```python
handle = sandbox.files.watch_dir("/mnt/nfs-share/my-dir", allow_network_mounts=True)
for e in handle.get_new_events():
    print(e.type, e.name)
```

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
 2026-06-15 15:34:02 +02:00
Mish Ushakov cab59caa0b fix(js-sdk): pass getMetrics start/end as query params (#1427) 
## Description

`Sandbox.getMetrics()` in the JS SDK passed the `start` and `end`
options as path parameters instead of query parameters, so openapi-fetch
never serialized them and the requested time range was silently ignored.
They are now sent under `query`, matching the OpenAPI spec; the Python
SDKs already passed them correctly. The metrics tests across JS and
Python (sync/async) now assert that returned metrics fall within the
requested window (with slack for 5s metric-bucket alignment) and that a
window from before the sandbox existed returns no metrics, which would
have caught this regression.

## Usage

```ts
const start = new Date(Date.now() - 60_000)
const metrics = await sandbox.getMetrics({ start, end: new Date() })
// metrics are now actually limited to the requested time range
```

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
 2026-06-14 00:18:04 -07:00
Mish Ushakov 32880d6e96 fix(python-sdk): key async transport caches by loop object, not id(loop) (#1434) 
## Description

The per-event-loop caches for `AsyncHTTPTransport`s and
`httpx.AsyncClient`s (Sandbox API, envd, and volume clients) were keyed
by `id(asyncio.get_running_loop())`, but CPython reuses object ids of
dead loops almost immediately — so sequential loops could inherit a
transport bound to a previous, closed loop and fail. The caches are now
`weakref.WeakKeyDictionary`s keyed by the loop object itself, which
makes stale id collisions impossible and releases entries when their
loop is garbage collected (fixing a leak where dead-loop entries
accumulated forever). Added regression tests covering the
sequential-loop scenario for all three caches.

This pattern no longer breaks:

```python
# e.g. a worker or test harness running repeated event loops
for job in jobs:
    asyncio.run(process_with_sandbox(job))  # each run previously risked
                                            # inheriting a closed loop's transport
```

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
 2026-06-12 22:18:20 +02:00
Mish Ushakov 0b0c728fe8 Fix volume SDK issues: transports, timeouts, empty files, eager stream errors (#1431) 
Fixes a batch of review findings in the JS and Python volume SDKs,
aligning behavior between the two. Python now caches `AsyncVolume` HTTP
transports per event loop and proxy (sync per thread) instead of a
process-wide singleton, applies the 60s default `request_timeout` to
metadata operations that previously ran with httpx timeouts disabled, no
longer falls back to `E2B_ACCESS_TOKEN` for volume content auth, and no
longer mutates the caller's `headers` dict. JS `Volume.readFile` now
returns empty values instead of `undefined` for empty files, and volume
content requests get the documented 60s default request timeout. All
changes are covered by new mock-based unit tests (no live API needed)
plus changesets for both SDKs.

## Usage examples

```python
volume = await AsyncVolume.connect(volume_id)

# Times out after 60s by default (previously could hang indefinitely)
entries = await volume.list("/")
```

```ts
const volume = await Volume.connect(volumeId)

// Returns an empty Blob / ReadableStream for empty files (previously undefined)
const blob = await volume.readFile('empty.txt', { format: 'blob' })

// Times out after the documented 60s by default; pass 0 to disable
await volume.getInfo('file.txt', { requestTimeoutMs: 0 })
```

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
 2026-06-12 19:17:11 +00:00
Mish Ushakov 91e84d9186 fix(js-sdk): raise errors for non-2xx API and envd responses with empty bodies (#1430) 
## Description

`handleApiError` and `handleEnvdApiError` used the presence of an error
body as the failure signal, but openapi-fetch returns `error: undefined`
for non-2xx responses with `Content-Length: 0` (and `error: ''` for
empty bodies without that header), so such failures were silently
treated as success — e.g. `sandbox.isRunning()` returned `true` for a
failing `/health` endpoint. Both handlers now gate on `response.ok` and
fall back to the status text when no error message is available. Volumes
go through the same shared handler, so they inherit the fix. Regression
tests cover both handlers and the volume path, including a
500-with-empty-body case that fails against the old code.

## Example

```ts
// Before: a 500 response with Content-Length: 0 was treated as success
await Volume.create('my-volume') // resolved with 'Response data is missing'

// After: the failure surfaces as the proper SDK error
await Volume.create('my-volume') // throws VolumeError('500: Internal Server Error')
```

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
 2026-06-12 18:58:34 +00:00
Mish Ushakov feb2d452fa fix(js-sdk): return boolean from Sandbox.kill() instance method (#1426) 
## Description

The `Sandbox.kill()` instance method discarded the boolean result of the
static `SandboxApi.kill()`, returning `Promise<void>` — inconsistent
with the static method and with both Python SDKs (sync and async), which
return `bool` from both variants. It now returns `Promise<boolean>`
(`true` if the sandbox was killed, `false` if it was not found),
including `true` in debug mode to match the other implementations.
Non-breaking: `void` → `boolean` is additive for existing callers. The
kill test now asserts the return value.

## Usage

```ts
const sandbox = await Sandbox.create()
const killed = await sandbox.kill()
console.log(killed) // true if killed, false if the sandbox was not found
```

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
 2026-06-12 13:56:33 +00:00
Weilu JIa 1328d9fe44 fix(python): Retry connections on HTTP/2 API transports (#1425) 2026-06-12 11:17:27 +00:00
github-actions[bot] de47dfd6b1 [skip ci] Release new versions 2026-06-12 00:18:17 +00:00
Matt Brockman 82d6e323fc Use dedicated clients for Python template uploads (#1424) @e2b/python-sdk@2.28.2 2026-06-11 17:10:58 -07:00
Matt Brockman 554dc88bd1 Deduplicate sync thread-local client setup (#1423) 2026-06-11 16:05:38 -07:00
github-actions[bot] b9e131ad88 [skip ci] Release new versions 2026-06-11 20:00:01 +00:00
Matt Brockman 44c1e9f575 Fix/python sync thread local envd (#1422) 
safer threading handling
@e2b/python-sdk@2.28.1 e2b@2.29.1 		2026-06-11 19:39:33 +00:00
Mish Ushakov 1d5259ca1d fix(sdks): transport proxy caching, request timeout, and option handling (#1421) 
Fixes a batch of connection-handling bugs found in review, with unit
tests for each and a changeset for both SDKs.

- **Python**: cached HTTP transports are now keyed on the configured
proxy, so clients with different (or no) proxy settings no longer
silently reuse the transport built for the first proxy seen.
- **Python**: `request_timeout` now applies to control-plane API
requests — the underlying httpx client was previously built with no
timeout at all (`request_timeout=0` still disables it).
- **Python**: the server-stream parser no longer stalls or drops the
final envelope when the remaining payload is shorter than the 5-byte
envelope header; also removed the no-op `@_retry` decorators from the
streaming RPC methods to avoid confusion.
- **JS + Python**: an explicit `debug=False` / `debug: false` now
overrides `E2B_DEBUG=true` instead of being ignored.
- **JS**: the RPC logger no longer crashes requests with a `TypeError`
when a response contains protobuf int64 (`bigint`) fields (e.g.
`EntryInfo.size` returned by `files.list()`/`stat()` and `includeEntry`
watch events); they are logged as strings.

## Usage examples

```ts
// JS: logging RPCs whose responses carry int64 fields no longer throws
const sbx = await Sandbox.create({ logger: console })
await sbx.files.list('/')

// JS: force-disable debug mode even when E2B_DEBUG=true is set
const sbx2 = await Sandbox.create({ debug: false })
```

```python
# Python: per-call API timeout is now actually enforced
Sandbox.list(request_timeout=10)

# Python: clients with different proxies get their own transports
Sandbox.create(proxy="http://127.0.0.1:8080")
Sandbox.create()  # no longer routed through the proxy above
```

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
 2026-06-11 19:12:47 +00:00
github-actions[bot] d23ad659a4 [skip ci] Release new versions 2026-06-10 17:33:36 +00:00
Mish Ushakov da85b1e33c feat(sdk): add includeEntry option to filesystem watch (#1385) 
Client-side counterpart to
[e2b-dev/infra#2930](https://github.com/e2b-dev/infra/pull/2930): adds
an `includeEntry`/`include_entry` option to filesystem directory
watching across the JS and Python (sync + async) SDKs, so each
`FilesystemEvent` can carry the affected entry's `EntryInfo`
(best-effort — unset for remove/rename-away events where the path no
longer exists). This regenerates the filesystem proto code from the
updated spec, threads the flag through `watchDir`/`watch_dir` (streaming
`WatchDir` and polling `CreateWatcher`), maps the new `entry` field onto
the event, and extracts a shared entry-mapping helper reused by
`list`/`getInfo`/`rename`. The option degrades gracefully: older
sandboxes (< envd 0.6.2) ignore it and leave `entry` unset, so there's
no hard version gate. Includes new watch tests for all three SDKs and a
minor-bump changeset for `e2b` and `@e2b/python-sdk`.

> Note: the entry-info tests require envd 0.6.2 (shipped by the infra
PR), so this should land with/after that deploy.

### Usage

**JavaScript**
```ts
const handle = await sandbox.files.watchDir(
  'my-dir',
  (event) => {
    console.log(event.type, event.name, event.entry?.path, event.entry?.type)
  },
  { includeEntry: true }
)
```

**Python (async)**
```python
def on_event(e):
    print(e.type, e.name, e.entry.path if e.entry else None)

handle = await sandbox.files.watch_dir("my-dir", on_event=on_event, include_entry=True)
```

**Python (sync)**
```python
handle = sandbox.files.watch_dir("my-dir", include_entry=True)
for e in handle.get_new_events():
    print(e.type, e.name, e.entry.path if e.entry else None)
```

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
@e2b/cli@2.11.1 @e2b/python-sdk@2.28.0 e2b@2.29.0 		2026-06-10 19:02:09 +02:00
Mish Ushakov 961ffbae84 feat(sdks): expose user-defined file metadata on sandbox.files (#1383) 
Adds a `metadata` option to file uploads and surfaces persisted metadata
on every `EntryInfo` / `WriteInfo` returned by `getInfo`, `list`,
`rename`, and write responses, across the JS and Python (sync + async)
SDKs.

Metadata is sent as `X-Metadata-<key>: <value>` request headers and
persisted by envd as `user.e2b.*` extended attributes; the same map is
applied to every file in a multi-file upload. Keys and values must be
printable US-ASCII and keys are lowercased by the sandbox, so they may
differ in case when read back. Requires **envd 0.6.2 or later**.

This syncs the envd OpenAPI spec and filesystem proto with
[infra#2732](https://github.com/e2b-dev/infra/pull/2732) and regenerates
the JS/Python clients.

## Usage

**JavaScript / TypeScript**
```ts
// Single file
const info = await sandbox.files.write('report.txt', 'hello', {
  metadata: { author: 'mish', purpose: 'demo' },
})
console.log(info.metadata) // { author: 'mish', purpose: 'demo' }

// Multiple files (same metadata applied to each)
await sandbox.files.writeFiles(
  [
    { path: 'a.txt', data: 'A' },
    { path: 'b.txt', data: 'B' },
  ],
  { metadata: { source: 'import' } }
)

// Read it back
const stat = await sandbox.files.getInfo('report.txt')
console.log(stat.metadata) // { author: 'mish', purpose: 'demo' }
```

**Python**
```python
# Single file
info = sandbox.files.write("report.txt", "hello", metadata={"author": "mish"})
print(info.metadata)  # {"author": "mish"}

# Multiple files (same metadata applied to each)
sandbox.files.write_files(
    [
        WriteEntry(path="a.txt", data="A"),
        WriteEntry(path="b.txt", data="B"),
    ],
    metadata={"source": "import"},
)

# Read it back
stat = sandbox.files.get_info("report.txt")
print(stat.metadata)  # {"author": "mish"}
```

The async Python API is identical with `await`.

## Tests

Integration tests cover the round-trip across `write` / `getInfo` /
`list` / `rename`, octet-stream uploads, multi-file uploads,
overwrite-clears-stale-metadata, and metadata written directly as
`user.e2b.*` xattrs via `sandbox.commands.run` surfacing in `getInfo`.
They require a sandbox running envd 0.6.2+.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-10 16:05:34 +00:00
Mish Ushakov 7dc861f899 fix: align behavior and API surface between the JS and Python SDKs (#1411) 
Aligns several behavioral and API-surface discrepancies between the JS
and Python SDKs found during a cross-SDK audit. **Python:**
`commands.send_stdin`/`CommandHandle.send_stdin` now accept `bytes`
(plus `request_timeout` on the handle), `git.reset` gets a typed
`GitResetMode` with JS-matching validation, `sandbox_url` is threaded
through `get_api_params` (and the dead `SandboxOpts` key removed), and
`from_image` requires both `username` and `password` when credentials
are given. **JS:** `getFullInfo` was removed in favor of a single
`getInfo` that now includes `sandboxDomain` (matching Python's
`get_info`), `fromImage` requires both credentials, `getBuildStatus`
defaults `logsOffset` to `0`, `getMetrics`/`kill` short-circuit
consistently in debug mode (instance + static), and `requestTimeoutMs:
0` explicitly disables the request timeout. Tests were added on both
sides (git-arg validation, stdin bytes, credential validation,
timeout-0, connection config) and the CLI's `sandbox info` now uses
`getInfo`. See the changeset for the full per-SDK list.

## Usage examples

```ts
// JS: registry credentials now require both fields
Template().fromImage('registry.example.com/img:latest', { username: 'u', password: 'p' })

// JS: getInfo now exposes sandboxDomain (getFullInfo removed)
const info = await Sandbox.getInfo(sandboxId)
console.log(info.sandboxDomain)

// JS: disable the request timeout
await Sandbox.create({ requestTimeoutMs: 0 })
```

```python
# Python: send raw bytes to stdin
sandbox.commands.send_stdin(cmd.pid, b"hello")

# Python: typed git reset mode (validated)
sandbox.git.reset(repo, mode="hard")

# Python: registry credentials require both fields
Template().from_image("registry.example.com/img:latest", username="u", password="p")
```

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-10 13:40:22 +00:00
Matt Brockman f90f35dbc4 Add sandbox lifecycle create option (#1404) 
adds the lifecycle for autoresume/autopause and timeout to the cli

---------

Co-authored-by: Mish Ushakov <10400064+mishushakov@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-10 10:23:28 +00:00
Mish Ushakov f63efeb76d test(sdk): add pty.kill coverage for JS and Python sync/async (#1412) 
Adds the previously-missing test coverage for `pty.kill()`, which was
untested across all three SDK implementations despite the rest of the
PTY API (create/connect/sendInput/resize) being well covered.

Each suite gets two tests covering both return paths of `kill()`:
- **Kill a live PTY** — asserts `kill()` returns `true`, then confirms
the process is gone via `kill -0 <pid>` (throws
`ProcessExitError`/`CommandExitException`).
- **Kill a non-existent PID** — asserts `kill()` returns `false`,
matching the documented not-found behavior.

The tests mirror the style of the existing `commands.kill` tests and
were verified to lint cleanly and be discovered by vitest/pytest (full
runs require a live sandbox).

## Files
- `packages/js-sdk/tests/sandbox/pty/kill.test.ts`
- `packages/python-sdk/tests/sync/sandbox_sync/pty/test_pty_kill.py`
- `packages/python-sdk/tests/async/sandbox_async/pty/test_pty_kill.py`

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-10 12:03:27 +02:00
Matt Brockman 8747e53caa Document fresh E2B CLI install (#1405) 2026-06-09 20:03:41 -07:00
Matt Brockman bb6676f36c chore(cli): tighten up sandbox exec piping tests (#1129) 2026-06-09 19:24:04 -07:00
Matt Brockman 5df3805803 Fix Stripe Projects E2B credential instructions (#1414) 
improved instructions
 2026-06-09 23:38:39 +00:00
github-actions[bot] a6dca9a31e [skip ci] Release new versions 2026-06-09 17:26:37 +00:00
Mish Ushakov 4e16cffc2f feat(js-sdk): add proxy connection param (#1386) 
Adds a `proxy` connection parameter to the JS SDK, mirroring the Python
SDK. When set, requests are routed through the given HTTP proxy via an
undici `ProxyAgent` dispatcher (fetchers are cached per-proxy so
non-proxy traffic is unaffected). It applies to control-plane API
requests, all requests made to the returned sandbox (REST plus
filesystem/commands/pty RPC), and volume requests. Behavior is unchanged
when no proxy is provided, and unit tests cover both the API and envd
fetch paths.

## Usage

```ts
import { Sandbox } from 'e2b'

// Routes API + all sandbox requests through the proxy
const sandbox = await Sandbox.create({
  proxy: 'http://user:pass@127.0.0.1:8080',
})
await sandbox.files.write('/hello.txt', 'world')

// Also works when connecting to an existing sandbox
const sbx = await Sandbox.connect(sandboxId, { proxy: 'http://127.0.0.1:8080' })
```

> Proxying relies on the optional `undici` package and the Node runtime;
in browser/edge runtimes requests use global `fetch`, which has no proxy
support (same as the existing HTTP/2 dispatcher).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
@e2b/python-sdk@2.27.1 e2b@2.28.2 		2026-06-09 18:29:16 +02:00
github-actions[bot] 26ca87c3f1 [skip ci] Release new versions 2026-06-09 12:34:31 +00:00
Mish Ushakov d86368a11e fix(python-sdk): align sync and async implementations (#1403) 
Reconciles divergences found while auditing the sync and async Python
SDK trees, keeping behavior equivalent across both.

- **Parameter ordering:** aligned `_create` and `Commands._start`
signatures to the public API and to each other, and reordered the
`Commands.connect` rpc args (`headers` before `timeout`) to match the
`_start` convention.
- **`pause` return:** the public `pause()` / `beta_pause()` are now
annotated `-> str` and actually return the sandbox ID (matching
`_cls_pause` and the class-method form, which already returned it)
instead of `-> None`; the `:return:` docstrings are restored.
- **Exceptions:** the internal "Body of the request is None" guard in
`sandbox_api` now consistently raises a bare `Exception` (matching the
volume client) instead of mixing `Exception`/`SandboxException` between
sync and async.
- **Misc:** async `Filesystem.write` now passes keyword args; the async
constructor reuses the cached `envd_api_url` property instead of
recomputing the sandbox URL; async pty `resize` gains a `-> None`
annotation.
- **Docstrings:** aligned the deprecation marker and
`get_metrics`/`write_files`/`kill` wording across sync/async, and fixed
a `**seconds**s` typo.

These are alignment/consistency fixes only; the deeper architectural
async-vs-sync splits (streaming-vs-polling `watch_dir`, pty `on_data`,
command output callbacks) are intentional and left untouched.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@e2b/cli@2.11.0 @e2b/python-sdk@2.27.0 e2b@2.28.1 		2026-06-09 14:15:15 +02:00
Mish Ushakov 7296b2c55d fix(python-sdk): drop envd headers from control-plane connect request (#1402) 
`Sandbox.connect` was attaching the data-plane envd headers
(`E2b-Sandbox-Id`, `E2b-Sandbox-Port`) to the control-plane `POST
/sandboxes/{id}/connect` call in both the sync and async SDKs. These
headers belong only on data-plane (filesystem/commands/pty) requests, so
this aligns the Python SDK with the JS SDK, which never sends them on
the connect call.

## Usage

No API change — `Sandbox.connect(sandbox_id)` (and the async equivalent)
behaves the same, just without the spurious headers on the control-plane
request.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-09 12:43:54 +02:00
Mish Ushakov f2550fa999 chore(python-sdk): mark packages as typed (PEP 561) (#1363) 
## Summary

Add empty `py.typed` markers to the `e2b` and `e2b_connect` packages so
mypy/Pyright honor the inline annotations on `Sandbox`, `AsyncSandbox`,
and other public APIs instead of treating imports as `Any`. Includes a
patch changeset for `@e2b/python-sdk`.

## Test plan
- [ ] `pip install` the built wheel in a fresh env and confirm `mypy` no
longer reports `e2b` as untyped without `--follow-untyped-imports`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
 2026-06-09 12:36:06 +02:00
Mish Ushakov ca18220da8 refactor(sdk): import API types via components instead of paths (#1362) 
## Summary
- Replace verbose
`paths['/route']['method']['responses'|'requestBody'][...]` traversal
with direct `components['schemas'][...]` references in
`packages/js-sdk/src/template/buildApi.ts` and
`packages/cli/src/commands/template/build.ts`.
- Matches the existing convention used throughout `sandboxApi.ts` and
reads at a glance.

## Test plan
- [x] `pnpm run format` / `lint` / `typecheck` pass for `e2b` and
`@e2b/cli`

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
 2026-06-09 12:13:42 +02:00
Matt Brockman b813dc57bb Update Stripe Projects E2B skill guidance (#1408) 
updated instructions for projects with agent
 2026-06-09 01:04:12 -07:00
Mish Ushakov f1516d5c6e refactor(cli): remove ensureAccessToken from template create (#1400) 
## Summary

Removes the `ensureAccessToken()` call (and its now-unused import) from
`e2b template create`. The command authenticates solely via the API key
(`ensureAPIKey()`), so the access-token check was redundant.

## Changes

- Drop `ensureAccessToken` import and call in
`packages/cli/src/commands/template/create.ts`.
- Add a patch changeset for `@e2b/cli`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-08 20:21:38 +02:00
Matt Brockman 6c04e31f68 fix(python-sdk): use thread-local API transports (#1399) 
makes the sync python python API http transport cache thread-local to
handle unsafe usage of the shared transport under pressure (e.g.
concurrent template builds). uses the same logic that we were using for
envd.

test
`test_sync_api_transport_cache_reuses_within_thread_and_isolates_across_threads`
fails on main, passes on branch.
 2026-06-08 12:36:11 +02:00
Mish Ushakov 08012eeb4a feat: add sendStdin/closeStdin to CommandHandle (#1397) 
Adds `sendStdin`/`send_stdin` and `closeStdin`/`close_stdin` directly on
the command handle (JS, Python sync, and Python async) so background
commands can be fed stdin and signalled EOF without reaching back to
`sandbox.commands` with the PID. The handle delegates to the existing
`Commands` methods via closures, mirroring how `kill` is wired, and also
adds the previously-missing `close_stdin`/`aclose_stdin` to the Python
`Commands` class (version-gated on `ENVD_ENVD_CLOSE`, matching JS).
PTY-created handles don't support these and raise a clear error, and the
existing PID-based `Commands.sendStdin` methods are untouched, so the
change is fully backward-compatible. Includes handle-based tests across
all three SDKs and a changeset bumping `e2b` and `@e2b/python-sdk` at
patch.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-08 10:51:39 +02:00
Mish Ushakov f188891e1c feat(cli): fully deprecate template build command (v1) (#1390) 
## Summary

- Strips all v1 build logic from \`e2b template build\` (\`bd\`): Docker
build/push, API calls, config-loading, and retry/proxy handling are
removed
- The command now only displays the existing yellow deprecation warning
(pointing to the v2 migration guide) and exits with code 1
- Deletes \`buildWithProxy.ts\` which is no longer referenced anywhere
- Moves \`getDockerfile\` helper (used by \`template create\` and
\`template migrate\`) to a new shared \`dockerfile.ts\` module, leaving
\`build.ts\` as a clean stub

## Test plan

- [ ] Run \`e2b template build\` — confirm deprecation warning is shown
and the command exits immediately
- [ ] Run \`e2b template create\` and \`e2b template migrate\` — confirm
they still work (both use the moved \`getDockerfile\` helper)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-08 10:50:40 +02:00
github-actions[bot] c892017cb6 [skip ci] Release new versions 2026-06-06 06:44:16 +00:00
Tomas Valenta 073661a8b5 feat(sdk): add API-only header options (#1395) 
## Summary
- Adds `apiHeaders` / `api_headers` for API-only custom headers.
- Deprecates the existing `headers` option in favor of the explicit API
header option.

## Usage
```ts
await Sandbox.create({ apiHeaders: { Authorization: 'Bearer ...' } })
```

```python
sandbox = Sandbox.create(api_headers={"Authorization": "Bearer ..."})
```

## Tests
- Python syntax checks passed for touched files.
- IDE lints and `git diff --check` passed.

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
@e2b/cli@2.10.4 @e2b/python-sdk@2.26.0 e2b@2.28.0 		2026-06-05 23:25:21 -07:00
Matt Brockman bc84290b5d add skill.md for stripe-projects (#1393) 2026-06-05 18:22:11 -07:00
Mish Ushakov e7a82ea9eb chore: remove unused dead code across SDK packages (#1388) 
Removes internal symbols with zero references, found via knip
(js-sdk/cli) and vulture (python-sdk) and verified with repo-wide greps:
`wait` (js-sdk),
`asSandboxTemplate`/`asHeadline`/`selectOption`/`basicDockerfile` (cli),
and `format_execution_timeout_error` (python-sdk). No public API changes
— only dead, unexported-from-index or unreferenced code is dropped.
`format`, `lint`, and `typecheck` pass for all touched packages, and a
patch changeset is included for the three published packages.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-05 19:50:13 +02:00
Mish Ushakov 5b2bb941de fix(sdk): consistent rate limit error for envd 429 responses (#1387) 
## Summary

The main API client already raised `RateLimitError` (JS) /
`RateLimitException` (Python) for HTTP 429, but the lower-level **envd**
HTTP and RPC layers fell through to a generic sandbox error, so the same
rate-limit condition surfaced as a different type depending on which
request path hit it. This maps envd 429 (and the equivalent gRPC
`ResourceExhausted` code) to the dedicated rate-limit error consistently
across the JS SDK and the Python sync/async SDKs. The JS RPC layer was
also missing the `ResourceExhausted` mapping entirely, which is now
added for parity with Python.

## Changes
- `js-sdk/src/envd/api.ts`, `python-sdk/e2b/envd/api.py` — envd HTTP 429
→ `RateLimitError`/`RateLimitException`
- `js-sdk/src/envd/rpc.ts` — added gRPC `Code.ResourceExhausted` →
`RateLimitError`
- Added unit tests for both the envd HTTP and RPC error mappers in JS
and Python
- Changeset (`e2b`: patch)

## Usage example
```ts
import { Sandbox, RateLimitError } from 'e2b'

try {
  await sandbox.files.write('/tmp/file.txt', 'data')
} catch (err) {
  if (err instanceof RateLimitError) {
    // now reliably caught regardless of which request path was rate limited
  }
}
```

```python
from e2b import RateLimitException

try:
    sandbox.files.write("/tmp/file.txt", "data")
except RateLimitException:
    ...
```

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-05 10:44:27 -07:00
dependabot[bot] 33009eb307 chore(deps): bump idna from 3.11 to 3.15 in /packages/python-sdk in the pip group across 1 directory (#1379) 
Bumps the pip group with 1 update in the /packages/python-sdk directory:
[idna](https://github.com/kjd/idna).

Updates `idna` from 3.11 to 3.15
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/kjd/idna/blob/master/HISTORY.md">idna's
changelog</a>.</em></p>
<blockquote>
<h2>3.15 (2026-05-12)</h2>
<ul>
<li>Enforce DNS-length cap on individual labels early in
<code>check_label</code>,
short-circuiting contextual-rule processing for oversized input
while staying compatible with UTS 46 usage.</li>
<li>Tidy core helpers: hoist bidi category sets to module-level
frozensets (avoiding per-codepoint list construction), simplify
length checks, and reuse the shared <code>_unicode_dots_re</code> from
<code>idna.core</code> in the codec module.</li>
<li>Use <code>raise ... from err</code> for proper exception chaining
and
switch internal string formatting to f-strings.</li>
<li>Allow <code>flit_core</code> 4.x in the build backend.</li>
<li>Expand the ruff lint set (flake8-bugbear, flake8-simplify,
pyupgrade, perflint) and apply the surfaced fixes; pin lint CI
to Python 3.14.</li>
<li>Add Dependabot configuration for GitHub Actions.</li>
<li>Convert README and HISTORY from reStructuredText to Markdown.</li>
<li>Reference CVE-2026-45409 for the 3.14 advisory in place of the
initial GHSA identifier.</li>
</ul>
<p>Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for
contributions to this release.</p>
<h2>3.14 (2026-05-10)</h2>
<ul>
<li>Removed opportunity to process long inputs into quadratic
time by rejecting oversize inputs up-front. Closes a bypass
of the CVE-2024-3651 mitigation. [CVE-2026-45409]</li>
</ul>
<p>Thanks to Stan Ulbrych for reporting the issue.</p>
<h2>3.13 (2026-04-22)</h2>
<ul>
<li>Correct classification error for codepoint U+A7F1</li>
</ul>
<h2>3.12 (2026-04-21)</h2>
<ul>
<li>Update to Unicode 17.0.0.</li>
<li>Issue a deprecation warning for the transitional argument.</li>
<li>Added lazy-loading to provide some performance improvements.</li>
<li>Removed vestiges of code related to Python 2 support, including
segmentation of data structures specific to Jython.</li>
</ul>
<p>Thanks to Rodrigo Nogueira for contributions to this release.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8"><code>af30a09</code></a>
Release 3.15</li>
<li><a
href="https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2"><code>30314d4</code></a>
Pre-release 3.15rc0</li>
<li><a
href="https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9"><code>05d4b21</code></a>
Merge pull request <a
href="https://redirect.github.com/kjd/idna/issues/237">#237</a> from
kjd/convert-docs-to-markdown</li>
<li><a
href="https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee"><code>2987fdb</code></a>
Convert README and HISTORY from reStructuredText to Markdown</li>
<li><a
href="https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c"><code>59fa800</code></a>
Merge pull request <a
href="https://redirect.github.com/kjd/idna/issues/236">#236</a> from
kjd/dependabot/github_actions/actions-f3e34333ea</li>
<li><a
href="https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2"><code>def6983</code></a>
Merge branch 'master' into
dependabot/github_actions/actions-f3e34333ea</li>
<li><a
href="https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631"><code>bbd8004</code></a>
Merge pull request <a
href="https://redirect.github.com/kjd/idna/issues/234">#234</a> from
StanFromIreland/patch-1</li>
<li><a
href="https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc"><code>edd07c0</code></a>
Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions
group</li>
<li><a
href="https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123"><code>5557db0</code></a>
Merge branch 'master' into patch-1</li>
<li><a
href="https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d"><code>f11746c</code></a>
Merge pull request <a
href="https://redirect.github.com/kjd/idna/issues/235">#235</a> from
StanFromIreland/patch-2</li>
<li>Additional commits viewable in <a
href="https://github.com/kjd/idna/compare/v3.11...v3.15">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=idna&package-manager=pip&previous-version=3.11&new-version=3.15)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/e2b-dev/E2B/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Mish Ushakov <10400064+mishushakov@users.noreply.github.com>
 2026-06-05 06:18:40 -07:00
Mish Ushakov 5e6d78fbc8 fix(deps): bump ws to >=8.20.1 (CVE-2026-45736) (#1382) 
Resolves Dependabot alert #300 (GHSA-58qx-3vcg-4xpx / CVE-2026-45736),
an uninitialized memory disclosure in `ws`. Adds a pnpm override forcing
`ws` to `^8.20.1`, which bumps the transitive resolution (pulled in via
`@vitest/browser`) from `8.19.0` to `8.21.0`. This follows the existing
override pattern in the root `package.json` for prior CVE bumps. No
changeset needed since only root dev tooling is affected.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-05 10:40:52 +00:00
Mish Ushakov 3379af97d2 Update CLAUDE.md (#1384) 
Added PR guidance for Claude
 2026-06-04 19:37:25 +02:00
github-actions[bot] 8625c631d7 [skip ci] Release new versions 2026-06-03 10:49:36 +00:00
Sebastion 8374033875 fix(cli): restrict ~/.e2b/config.json permissions to owner-only (#1320) 
## Summary

The CLI stores credentials (E2B access token and team API key) in
plaintext at `~/.e2b/config.json`. Today the file is created with the
process default umask, which on most Linux distributions and macOS
results in mode `0644` — readable by every other local user and by any
process running as a different UID on the same machine.

This PR routes all three write sites through a single
`writeUserConfig()` helper that creates `~/.e2b` as `0700` and
`config.json` as `0600`, matching the convention used by the AWS CLI
(`~/.aws/credentials`), `kubectl` (`~/.kube/config`), and `gh`
(`~/.config/gh/hosts.yml`).

- **CWE:** CWE-312 (Cleartext Storage of Sensitive Information) —
partial mitigation. The file remains plaintext on disk (the existing `//
TODO` in `user.ts` already acknowledges that keychain storage is the
proper long-term fix); this change reduces exposure to other local users
/ less-privileged processes, which is the standard industry mitigation
while plaintext storage remains.
- **Affected file:** `packages/cli/src/user.ts` and the three writers in
`packages/cli/src/commands/`.
- **Severity:** Moderate on shared / multi-user machines (CI runners,
dev VMs, jump boxes); low on single-user workstations.

## What's in `~/.e2b/config.json`

```ts
{
  email, accessToken,           // user access token
  teamName, teamId, teamApiKey  // team API key
}
```

`accessToken` authenticates the user against the E2B control plane;
`teamApiKey` authorizes sandbox creation against the team. Either is
sufficient to impersonate the user / spend on the team's account.

## Fix

A new helper in `packages/cli/src/user.ts`:

```ts
export function writeUserConfig(configPath: string, config: UserConfig): void {
  const dir = path.dirname(configPath)
  fs.mkdirSync(dir, { recursive: true, mode: 0o700 })
  fs.chmodSync(dir, 0o700)
  fs.writeFileSync(configPath, JSON.stringify(config, null, 2), { mode: 0o600 })
  fs.chmodSync(configPath, 0o600)
}
```

The explicit `chmodSync` calls are intentional: `mkdirSync({ mode })`
and `writeFileSync({ mode })` only set permissions when the path is
created. If the directory or file already exists with looser permissions
(the common case for users upgrading), `chmodSync` corrects them on the
next write.

Call sites updated:
- `packages/cli/src/commands/auth/login.ts`
- `packages/cli/src/commands/auth/configure.ts`
- `packages/cli/src/commands/template/buildWithProxy.ts`

`logout` uses `unlinkSync` and is unaffected. I grep'd the package for
any other writers to `USER_CONFIG_PATH` — these three are the complete
set.

Behavior on Windows: `chmodSync` only manipulates the read-only bit on
Windows, which is consistent with how the AWS/kubectl/gh CLIs behave.
ACL hardening on Windows is out of scope for this change.

## Tests

Added `packages/cli/tests/user_config_permissions.test.ts`, which writes
a config to a temporary path and asserts the resulting directory is
`0700` and file is `0600`, plus that the JSON round-trips correctly.

Manually verified before/after on Linux:

```
# before this PR
$ ls -l ~/.e2b/config.json
-rw-r--r-- 1 user user 234 ... config.json
# after
$ ls -l ~/.e2b/config.json
-rw------- 1 user user 234 ... config.json
```

## Why this is worth fixing

The exploitable scenario is a multi-tenant or shared-account host:
another local user (or a process running as `nobody`, a CI worker UID, a
sandboxed app, etc.) can `cat ~/<victim>/.e2b/config.json` and lift live
credentials. No privilege escalation, no race, no special tooling — the
file is simply world-readable today.

Before submitting, I tried to disprove the finding: I checked whether
E2B sets a restrictive umask anywhere in the CLI bootstrap (it doesn't),
whether the tokens are short-lived enough to make disclosure low-impact
(the access token isn't visibly rotated and the team API key is
long-lived), and whether the directory itself was being created
restrictively elsewhere (it wasn't — `mkdirSync` was called with default
mode). None of those mitigations are in place, so the permission
tightening is doing real work.

This doesn't close out CWE-312 — that requires moving the secrets out of
plaintext entirely, which the existing TODO acknowledges. It does close
the "any local user can read it" gap, which is the cheap, high-value
half of the mitigation.

_Submitted by Sebastion — autonomous open-source security research from
[Foundation Machines](https://foundationmachines.ai). Free for public
repos via the [Sebastion AI GitHub
App](https://github.com/marketplace/sebastion-ai)._

---------

Co-authored-by: Mish Ushakov <10400064+mishushakov@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
@e2b/cli@2.10.3 		2026-06-02 23:07:58 -07:00
github-actions[bot] dead38a396 [skip ci] Release new versions 2026-06-02 14:24:33 +00:00
Yizuki_Ame ad377962dc fix: await async callbacks in CommandHandle.wait() (#1261) 
Fixes #1259

## Problem

The `CommandHandle.wait()` method fires `onStdout`, `onStderr`, and
`onPty` callbacks without `await`, so async callbacks run as
fire-and-forget microtasks. If a callback performs I/O (e.g. writing to
a file, sending over network), `wait()` can resolve before the callback
finishes, leading to lost data or race conditions.

## Fix

Add `await` before each optional-chain callback invocation:

```diff
-this.onStdout?.(stdout)
+await this.onStdout?.(stdout)
```

This is fully backwards compatible — `await`-ing a sync function's
return value is a no-op.

## Tests

3 parameterized test cases (`stdout`, `stderr`, `pty`) verify that
`wait()` does not resolve until an async callback's promise settles.

_This fix was developed with AI assistance and reviewed by a human._
e2b@2.27.1 		2026-06-02 06:44:20 -07:00
dependabot[bot] 13f63dcd37 chore(deps-dev): bump the npm_and_yarn group across 3 directories with 1 update (#1376) 
Bumps the npm_and_yarn group with 1 update in the / directory:
[vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).
Bumps the npm_and_yarn group with 1 update in the /packages/cli
directory:
[vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).
Bumps the npm_and_yarn group with 1 update in the /packages/js-sdk
directory:
[vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).

Updates `vitest` from 3.2.4 to 4.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitest-dev/vitest/releases">vitest's
releases</a>.</em></p>
<blockquote>
<h2>v4.1.0</h2>
<p>Vitest 4.1 is out!</p>
<p>This release page lists all changes made to the project during the
4.1 beta. To get a review of all the new features, read our <a
href="https://vitest.dev/blog/vitest-4-1">blog post</a>.</p>
<h3>   🚀 Features</h3>
<ul>
<li>Return a disposable from doMock()  -  by <a
href="https://github.com/kirkwaiblinger"><code>@​kirkwaiblinger</code></a>
in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9332">vitest-dev/vitest#9332</a>
<a href="https://github.com/vitest-dev/vitest/commit/e3e659a96"><!-- raw
HTML omitted -->(e3e65)<!-- raw HTML omitted --></a></li>
<li>Added chai style assertions  -  by <a
href="https://github.com/ronnakamoto"><code>@​ronnakamoto</code></a> and
<a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a>
in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/8842">vitest-dev/vitest#8842</a>
<a href="https://github.com/vitest-dev/vitest/commit/841df9ac5"><!-- raw
HTML omitted -->(841df)<!-- raw HTML omitted --></a></li>
<li>Update to sinon/fake-timers v15 and add <code>setTickMode</code> to
timer controls  -  by <a
href="https://github.com/atscott"><code>@​atscott</code></a> and <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/8726">vitest-dev/vitest#8726</a>
<a href="https://github.com/vitest-dev/vitest/commit/4b480aaed"><!-- raw
HTML omitted -->(4b480)<!-- raw HTML omitted --></a></li>
<li>Expose matcher types  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9448">vitest-dev/vitest#9448</a>
<a href="https://github.com/vitest-dev/vitest/commit/3e4b913b1"><!-- raw
HTML omitted -->(3e4b9)<!-- raw HTML omitted --></a></li>
<li>Add <code>toTestSpecification</code> to reported tasks  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9464">vitest-dev/vitest#9464</a>
<a href="https://github.com/vitest-dev/vitest/commit/1a4705da9"><!-- raw
HTML omitted -->(1a470)<!-- raw HTML omitted --></a></li>
<li>Show a warning if <code>vi.mock</code> or <code>vi.hoisted</code>
are declared outside of top level of the module  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9387">vitest-dev/vitest#9387</a>
<a href="https://github.com/vitest-dev/vitest/commit/5db54a468"><!-- raw
HTML omitted -->(5db54)<!-- raw HTML omitted --></a></li>
<li>Track and display expectedly failed tests (.fails) in UI and CLI  - 
by <a href="https://github.com/Copilot"><code>@​Copilot</code></a>,
<strong>sheremet-va</strong> and <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9476">vitest-dev/vitest#9476</a>
<a href="https://github.com/vitest-dev/vitest/commit/77d75fd34"><!-- raw
HTML omitted -->(77d75)<!-- raw HTML omitted --></a></li>
<li>Support tags  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9478">vitest-dev/vitest#9478</a>
<a href="https://github.com/vitest-dev/vitest/commit/de7c8a521"><!-- raw
HTML omitted -->(de7c8)<!-- raw HTML omitted --></a></li>
<li>Implement <code>aroundEach</code> and <code>aroundAll</code> hooks
 -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9450">vitest-dev/vitest#9450</a>
<a href="https://github.com/vitest-dev/vitest/commit/2a8cb9dc2"><!-- raw
HTML omitted -->(2a8cb)<!-- raw HTML omitted --></a></li>
<li>Stabilize experimental features  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9529">vitest-dev/vitest#9529</a>
<a href="https://github.com/vitest-dev/vitest/commit/b5fd2a16a"><!-- raw
HTML omitted -->(b5fd2)<!-- raw HTML omitted --></a></li>
<li>Accept <code>new</code> or <code>all</code> in <code>--update</code>
flag  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9543">vitest-dev/vitest#9543</a>
<a href="https://github.com/vitest-dev/vitest/commit/a5acf28a5"><!-- raw
HTML omitted -->(a5acf)<!-- raw HTML omitted --></a></li>
<li>Support <code>meta</code> in test options  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9535">vitest-dev/vitest#9535</a>
<a href="https://github.com/vitest-dev/vitest/commit/7d622e3d1"><!-- raw
HTML omitted -->(7d622)<!-- raw HTML omitted --></a></li>
<li>Support type inference with a new <code>test.extend</code> syntax
 -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9550">vitest-dev/vitest#9550</a>
<a href="https://github.com/vitest-dev/vitest/commit/e53854fcc"><!-- raw
HTML omitted -->(e5385)<!-- raw HTML omitted --></a></li>
<li>Support vite 8 beta, fix type issues in the config with different
vite versions  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9587">vitest-dev/vitest#9587</a>
<a href="https://github.com/vitest-dev/vitest/commit/990281dfd"><!-- raw
HTML omitted -->(99028)<!-- raw HTML omitted --></a></li>
<li>Add assertion helper to hide internal stack traces  -  by <a
href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> and
<strong>Claude Opus 4.6</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9594">vitest-dev/vitest#9594</a>
<a href="https://github.com/vitest-dev/vitest/commit/eeb0ae2f8"><!-- raw
HTML omitted -->(eeb0a)<!-- raw HTML omitted --></a></li>
<li>Store failure screenshots using artifacts API  -  by <a
href="https://github.com/macarie"><code>@​macarie</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9588">vitest-dev/vitest#9588</a>
<a href="https://github.com/vitest-dev/vitest/commit/24603e3c4"><!-- raw
HTML omitted -->(24603)<!-- raw HTML omitted --></a></li>
<li>Allow <code>vitest list</code> to statically collect tests instead
of running files to collect them  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9630">vitest-dev/vitest#9630</a>
<a href="https://github.com/vitest-dev/vitest/commit/7a8e7fc20"><!-- raw
HTML omitted -->(7a8e7)<!-- raw HTML omitted --></a></li>
<li>Add <code>--detect-async-leaks</code>  -  by <a
href="https://github.com/AriPerkkio"><code>@​AriPerkkio</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9528">vitest-dev/vitest#9528</a>
<a href="https://github.com/vitest-dev/vitest/commit/c594d4af3"><!-- raw
HTML omitted -->(c594d)<!-- raw HTML omitted --></a></li>
<li>Implement <code>mockThrow</code> and <code>mockThrowOnce</code>  - 
by <a
href="https://github.com/thor-juhasz"><code>@​thor-juhasz</code></a> and
<a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a>
in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9512">vitest-dev/vitest#9512</a>
<a href="https://github.com/vitest-dev/vitest/commit/619179fb7"><!-- raw
HTML omitted -->(61917)<!-- raw HTML omitted --></a></li>
<li>Support <code>update: &quot;none&quot;</code> and add docs about
snapshots behavior on CI  -  by <a
href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9700">vitest-dev/vitest#9700</a>
<a href="https://github.com/vitest-dev/vitest/commit/05f1854e2"><!-- raw
HTML omitted -->(05f18)<!-- raw HTML omitted --></a></li>
<li>Support playwright <code>launchOptions</code> with
<code>connectOptions</code>  -  by <a
href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9702">vitest-dev/vitest#9702</a>
<a href="https://github.com/vitest-dev/vitest/commit/f0ff1b2a0"><!-- raw
HTML omitted -->(f0ff1)<!-- raw HTML omitted --></a></li>
<li>Add <code>page/locator.mark</code> API to enhance playwright trace
 -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>
in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9652">vitest-dev/vitest#9652</a>
<a href="https://github.com/vitest-dev/vitest/commit/d0ee546fe"><!-- raw
HTML omitted -->(d0ee5)<!-- raw HTML omitted --></a></li>
<li><strong>api</strong>:
<ul>
<li>Support tests starting or ending with <code>test</code> in
<code>experimental_parseSpecification</code>  -  by <a
href="https://github.com/jgillick"><code>@​jgillick</code></a> and
<strong>Jeremy Gillick</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9235">vitest-dev/vitest#9235</a>
<a href="https://github.com/vitest-dev/vitest/commit/2f367fad3"><!-- raw
HTML omitted -->(2f367)<!-- raw HTML omitted --></a></li>
<li>Add filters to <code>createSpecification</code>  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9336">vitest-dev/vitest#9336</a>
<a href="https://github.com/vitest-dev/vitest/commit/c8e6c7fbf"><!-- raw
HTML omitted -->(c8e6c)<!-- raw HTML omitted --></a></li>
<li>Expose <code>runTestFiles</code> as alternative to
<code>runTestSpecifications</code>  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9443">vitest-dev/vitest#9443</a>
<a href="https://github.com/vitest-dev/vitest/commit/43d761821"><!-- raw
HTML omitted -->(43d76)<!-- raw HTML omitted --></a></li>
<li>Add <code>allowWrite</code> and <code>allowExec</code> options to
<code>api</code>  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9350">vitest-dev/vitest#9350</a>
<a href="https://github.com/vitest-dev/vitest/commit/20e00ef78"><!-- raw
HTML omitted -->(20e00)<!-- raw HTML omitted --></a></li>
<li>Allow passing down test cases to <code>toTestSpecification</code>
 -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9627">vitest-dev/vitest#9627</a>
<a href="https://github.com/vitest-dev/vitest/commit/6f17d5ddf"><!-- raw
HTML omitted -->(6f17d)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>browser</strong>:
<ul>
<li>Add <code>userEvent.wheel</code> API  -  by <a
href="https://github.com/macarie"><code>@​macarie</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9188">vitest-dev/vitest#9188</a>
<a href="https://github.com/vitest-dev/vitest/commit/660801979"><!-- raw
HTML omitted -->(66080)<!-- raw HTML omitted --></a></li>
<li>Add <code>filterNode</code> option to prettyDOM for filtering
browser assertion error output  -  by <a
href="https://github.com/Copilot"><code>@​Copilot</code></a>,
<strong>sheremet-va</strong> and <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9475">vitest-dev/vitest#9475</a>
<a href="https://github.com/vitest-dev/vitest/commit/d3220fcd8"><!-- raw
HTML omitted -->(d3220)<!-- raw HTML omitted --></a></li>
<li>Support playwright persistent context  -  by <a
href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>,
<strong>Claude Opus 4.6</strong> and <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9229">vitest-dev/vitest#9229</a>
<a href="https://github.com/vitest-dev/vitest/commit/f865d2ba4"><!-- raw
HTML omitted -->(f865d)<!-- raw HTML omitted --></a></li>
<li>Added <code>detailsPanelPosition</code> option and button  -  by <a
href="https://github.com/shairez"><code>@​shairez</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9525">vitest-dev/vitest#9525</a>
<a href="https://github.com/vitest-dev/vitest/commit/c8a31147c"><!-- raw
HTML omitted -->(c8a31)<!-- raw HTML omitted --></a></li>
<li>Use BlazeDiff instead of pixelmatch  -  by <a
href="https://github.com/macarie"><code>@​macarie</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9514">vitest-dev/vitest#9514</a>
<a href="https://github.com/vitest-dev/vitest/commit/309362089"><!-- raw
HTML omitted -->(30936)<!-- raw HTML omitted --></a></li>
<li>Add <code>findElement</code> and enable strict mode in webdriverio
and preview  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9677">vitest-dev/vitest#9677</a>
<a href="https://github.com/vitest-dev/vitest/commit/c3f37721c"><!-- raw
HTML omitted -->(c3f37)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>cli</strong>:
<ul>
<li>Add <a href="https://github.com/bomb"><code>@​bomb</code></a>.sh/tab
completions  -  by <a
href="https://github.com/AmirSa12"><code>@​AmirSa12</code></a> and <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/8639">vitest-dev/vitest#8639</a>
<a href="https://github.com/vitest-dev/vitest/commit/200f31704"><!-- raw
HTML omitted -->(200f3)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>coverage</strong>:
<ul>
<li>Support <code>ignore start/stop</code> ignore hints  -  by <a
href="https://github.com/AriPerkkio"><code>@​AriPerkkio</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9204">vitest-dev/vitest#9204</a>
<a href="https://github.com/vitest-dev/vitest/commit/e59c94ba6"><!-- raw
HTML omitted -->(e59c9)<!-- raw HTML omitted --></a></li>
<li>Add <code>coverage.changed</code> option to report only changed
files  -  by <a
href="https://github.com/kykim00"><code>@​kykim00</code></a> and <a
href="https://github.com/AriPerkkio"><code>@​AriPerkkio</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9521">vitest-dev/vitest#9521</a>
<a href="https://github.com/vitest-dev/vitest/commit/1d9392c67"><!-- raw
HTML omitted -->(1d939)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>experimental</strong>:
<ul>
<li>Add <code>onModuleRunner</code> hook to <code>worker.init</code>  - 
by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9286">vitest-dev/vitest#9286</a>
<a href="https://github.com/vitest-dev/vitest/commit/e977f3deb"><!-- raw
HTML omitted -->(e977f)<!-- raw HTML omitted --></a></li>
<li>Option to disable the module runner  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> and
<a href="https://github.com/AriPerkkio"><code>@​AriPerkkio</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9210">vitest-dev/vitest#9210</a>
<a href="https://github.com/vitest-dev/vitest/commit/9be6121ee"><!-- raw
HTML omitted -->(9be61)<!-- raw HTML omitted --></a></li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitest-dev/vitest/commit/4150b913171bda3971a4a4c47c633c26d0c6ae45"><code>4150b91</code></a>
chore: release v4.1.0</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/1de0aa22dd6311a93546a75a3c58a6be519c1baf"><code>1de0aa2</code></a>
fix: correctly identify concurrent test during static analysis (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9846">#9846</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/c3cac1c1b5a91d921942e9391fbd94841717363f"><code>c3cac1c</code></a>
fix: use isAgent check, not just TTY, for watch mode (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9841">#9841</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/eab68ba2b8ea6f89717c0b885c573579659d7c3b"><code>eab68ba</code></a>
chore(deps): update all non-major dependencies (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9824">#9824</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/031f02a89be34491c441b4da9c4e2bacb7db71df"><code>031f02a</code></a>
fix: allow catch/finally for async assertion (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9827">#9827</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/3e9e096a231fa0ec6475da82e36cbd6fcc9bc8f9"><code>3e9e096</code></a>
feat(reporters): add <code>agent</code> reporter to reduce ai agent
token usage (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9779">#9779</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/0c2c01361a95dd26d0d7fd7bc38bcca8dbc6e5d2"><code>0c2c013</code></a>
chore: release v4.1.0-beta.6</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/8181e06e765f4d043818b244c76795022fa78ff6"><code>8181e06</code></a>
fix: <code>hideSkippedTests</code> should not hide
<code>test.todo</code> (fix <a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9562">#9562</a>)
(<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9781">#9781</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/a8216b0014b83612e40ef49f919d5293b68717b3"><code>a8216b0</code></a>
fix: manual and redirect mock shouldn't <code>load</code> or
<code>transform</code> original module...</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/689a22a1b8c79595f6f4ae82d2b43c895d7f1c50"><code>689a22a</code></a>
fix(browser): types of <code>getCDPSession</code> and <code>cdp()</code>
(<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9716">#9716</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vitest-dev/vitest/commits/v4.1.0/packages/vitest">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for vitest since your current version.</p>
</details>
<br />

Updates `vitest` from 3.2.4 to 4.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitest-dev/vitest/releases">vitest's
releases</a>.</em></p>
<blockquote>
<h2>v4.1.0</h2>
<p>Vitest 4.1 is out!</p>
<p>This release page lists all changes made to the project during the
4.1 beta. To get a review of all the new features, read our <a
href="https://vitest.dev/blog/vitest-4-1">blog post</a>.</p>
<h3>   🚀 Features</h3>
<ul>
<li>Return a disposable from doMock()  -  by <a
href="https://github.com/kirkwaiblinger"><code>@​kirkwaiblinger</code></a>
in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9332">vitest-dev/vitest#9332</a>
<a href="https://github.com/vitest-dev/vitest/commit/e3e659a96"><!-- raw
HTML omitted -->(e3e65)<!-- raw HTML omitted --></a></li>
<li>Added chai style assertions  -  by <a
href="https://github.com/ronnakamoto"><code>@​ronnakamoto</code></a> and
<a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a>
in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/8842">vitest-dev/vitest#8842</a>
<a href="https://github.com/vitest-dev/vitest/commit/841df9ac5"><!-- raw
HTML omitted -->(841df)<!-- raw HTML omitted --></a></li>
<li>Update to sinon/fake-timers v15 and add <code>setTickMode</code> to
timer controls  -  by <a
href="https://github.com/atscott"><code>@​atscott</code></a> and <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/8726">vitest-dev/vitest#8726</a>
<a href="https://github.com/vitest-dev/vitest/commit/4b480aaed"><!-- raw
HTML omitted -->(4b480)<!-- raw HTML omitted --></a></li>
<li>Expose matcher types  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9448">vitest-dev/vitest#9448</a>
<a href="https://github.com/vitest-dev/vitest/commit/3e4b913b1"><!-- raw
HTML omitted -->(3e4b9)<!-- raw HTML omitted --></a></li>
<li>Add <code>toTestSpecification</code> to reported tasks  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9464">vitest-dev/vitest#9464</a>
<a href="https://github.com/vitest-dev/vitest/commit/1a4705da9"><!-- raw
HTML omitted -->(1a470)<!-- raw HTML omitted --></a></li>
<li>Show a warning if <code>vi.mock</code> or <code>vi.hoisted</code>
are declared outside of top level of the module  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9387">vitest-dev/vitest#9387</a>
<a href="https://github.com/vitest-dev/vitest/commit/5db54a468"><!-- raw
HTML omitted -->(5db54)<!-- raw HTML omitted --></a></li>
<li>Track and display expectedly failed tests (.fails) in UI and CLI  - 
by <a href="https://github.com/Copilot"><code>@​Copilot</code></a>,
<strong>sheremet-va</strong> and <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9476">vitest-dev/vitest#9476</a>
<a href="https://github.com/vitest-dev/vitest/commit/77d75fd34"><!-- raw
HTML omitted -->(77d75)<!-- raw HTML omitted --></a></li>
<li>Support tags  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9478">vitest-dev/vitest#9478</a>
<a href="https://github.com/vitest-dev/vitest/commit/de7c8a521"><!-- raw
HTML omitted -->(de7c8)<!-- raw HTML omitted --></a></li>
<li>Implement <code>aroundEach</code> and <code>aroundAll</code> hooks
 -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9450">vitest-dev/vitest#9450</a>
<a href="https://github.com/vitest-dev/vitest/commit/2a8cb9dc2"><!-- raw
HTML omitted -->(2a8cb)<!-- raw HTML omitted --></a></li>
<li>Stabilize experimental features  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9529">vitest-dev/vitest#9529</a>
<a href="https://github.com/vitest-dev/vitest/commit/b5fd2a16a"><!-- raw
HTML omitted -->(b5fd2)<!-- raw HTML omitted --></a></li>
<li>Accept <code>new</code> or <code>all</code> in <code>--update</code>
flag  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9543">vitest-dev/vitest#9543</a>
<a href="https://github.com/vitest-dev/vitest/commit/a5acf28a5"><!-- raw
HTML omitted -->(a5acf)<!-- raw HTML omitted --></a></li>
<li>Support <code>meta</code> in test options  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9535">vitest-dev/vitest#9535</a>
<a href="https://github.com/vitest-dev/vitest/commit/7d622e3d1"><!-- raw
HTML omitted -->(7d622)<!-- raw HTML omitted --></a></li>
<li>Support type inference with a new <code>test.extend</code> syntax
 -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9550">vitest-dev/vitest#9550</a>
<a href="https://github.com/vitest-dev/vitest/commit/e53854fcc"><!-- raw
HTML omitted -->(e5385)<!-- raw HTML omitted --></a></li>
<li>Support vite 8 beta, fix type issues in the config with different
vite versions  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9587">vitest-dev/vitest#9587</a>
<a href="https://github.com/vitest-dev/vitest/commit/990281dfd"><!-- raw
HTML omitted -->(99028)<!-- raw HTML omitted --></a></li>
<li>Add assertion helper to hide internal stack traces  -  by <a
href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> and
<strong>Claude Opus 4.6</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9594">vitest-dev/vitest#9594</a>
<a href="https://github.com/vitest-dev/vitest/commit/eeb0ae2f8"><!-- raw
HTML omitted -->(eeb0a)<!-- raw HTML omitted --></a></li>
<li>Store failure screenshots using artifacts API  -  by <a
href="https://github.com/macarie"><code>@​macarie</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9588">vitest-dev/vitest#9588</a>
<a href="https://github.com/vitest-dev/vitest/commit/24603e3c4"><!-- raw
HTML omitted -->(24603)<!-- raw HTML omitted --></a></li>
<li>Allow <code>vitest list</code> to statically collect tests instead
of running files to collect them  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9630">vitest-dev/vitest#9630</a>
<a href="https://github.com/vitest-dev/vitest/commit/7a8e7fc20"><!-- raw
HTML omitted -->(7a8e7)<!-- raw HTML omitted --></a></li>
<li>Add <code>--detect-async-leaks</code>  -  by <a
href="https://github.com/AriPerkkio"><code>@​AriPerkkio</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9528">vitest-dev/vitest#9528</a>
<a href="https://github.com/vitest-dev/vitest/commit/c594d4af3"><!-- raw
HTML omitted -->(c594d)<!-- raw HTML omitted --></a></li>
<li>Implement <code>mockThrow</code> and <code>mockThrowOnce</code>  - 
by <a
href="https://github.com/thor-juhasz"><code>@​thor-juhasz</code></a> and
<a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a>
in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9512">vitest-dev/vitest#9512</a>
<a href="https://github.com/vitest-dev/vitest/commit/619179fb7"><!-- raw
HTML omitted -->(61917)<!-- raw HTML omitted --></a></li>
<li>Support <code>update: &quot;none&quot;</code> and add docs about
snapshots behavior on CI  -  by <a
href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9700">vitest-dev/vitest#9700</a>
<a href="https://github.com/vitest-dev/vitest/commit/05f1854e2"><!-- raw
HTML omitted -->(05f18)<!-- raw HTML omitted --></a></li>
<li>Support playwright <code>launchOptions</code> with
<code>connectOptions</code>  -  by <a
href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9702">vitest-dev/vitest#9702</a>
<a href="https://github.com/vitest-dev/vitest/commit/f0ff1b2a0"><!-- raw
HTML omitted -->(f0ff1)<!-- raw HTML omitted --></a></li>
<li>Add <code>page/locator.mark</code> API to enhance playwright trace
 -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>
in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9652">vitest-dev/vitest#9652</a>
<a href="https://github.com/vitest-dev/vitest/commit/d0ee546fe"><!-- raw
HTML omitted -->(d0ee5)<!-- raw HTML omitted --></a></li>
<li><strong>api</strong>:
<ul>
<li>Support tests starting or ending with <code>test</code> in
<code>experimental_parseSpecification</code>  -  by <a
href="https://github.com/jgillick"><code>@​jgillick</code></a> and
<strong>Jeremy Gillick</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9235">vitest-dev/vitest#9235</a>
<a href="https://github.com/vitest-dev/vitest/commit/2f367fad3"><!-- raw
HTML omitted -->(2f367)<!-- raw HTML omitted --></a></li>
<li>Add filters to <code>createSpecification</code>  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9336">vitest-dev/vitest#9336</a>
<a href="https://github.com/vitest-dev/vitest/commit/c8e6c7fbf"><!-- raw
HTML omitted -->(c8e6c)<!-- raw HTML omitted --></a></li>
<li>Expose <code>runTestFiles</code> as alternative to
<code>runTestSpecifications</code>  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9443">vitest-dev/vitest#9443</a>
<a href="https://github.com/vitest-dev/vitest/commit/43d761821"><!-- raw
HTML omitted -->(43d76)<!-- raw HTML omitted --></a></li>
<li>Add <code>allowWrite</code> and <code>allowExec</code> options to
<code>api</code>  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9350">vitest-dev/vitest#9350</a>
<a href="https://github.com/vitest-dev/vitest/commit/20e00ef78"><!-- raw
HTML omitted -->(20e00)<!-- raw HTML omitted --></a></li>
<li>Allow passing down test cases to <code>toTestSpecification</code>
 -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9627">vitest-dev/vitest#9627</a>
<a href="https://github.com/vitest-dev/vitest/commit/6f17d5ddf"><!-- raw
HTML omitted -->(6f17d)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>browser</strong>:
<ul>
<li>Add <code>userEvent.wheel</code> API  -  by <a
href="https://github.com/macarie"><code>@​macarie</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9188">vitest-dev/vitest#9188</a>
<a href="https://github.com/vitest-dev/vitest/commit/660801979"><!-- raw
HTML omitted -->(66080)<!-- raw HTML omitted --></a></li>
<li>Add <code>filterNode</code> option to prettyDOM for filtering
browser assertion error output  -  by <a
href="https://github.com/Copilot"><code>@​Copilot</code></a>,
<strong>sheremet-va</strong> and <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9475">vitest-dev/vitest#9475</a>
<a href="https://github.com/vitest-dev/vitest/commit/d3220fcd8"><!-- raw
HTML omitted -->(d3220)<!-- raw HTML omitted --></a></li>
<li>Support playwright persistent context  -  by <a
href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>,
<strong>Claude Opus 4.6</strong> and <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9229">vitest-dev/vitest#9229</a>
<a href="https://github.com/vitest-dev/vitest/commit/f865d2ba4"><!-- raw
HTML omitted -->(f865d)<!-- raw HTML omitted --></a></li>
<li>Added <code>detailsPanelPosition</code> option and button  -  by <a
href="https://github.com/shairez"><code>@​shairez</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9525">vitest-dev/vitest#9525</a>
<a href="https://github.com/vitest-dev/vitest/commit/c8a31147c"><!-- raw
HTML omitted -->(c8a31)<!-- raw HTML omitted --></a></li>
<li>Use BlazeDiff instead of pixelmatch  -  by <a
href="https://github.com/macarie"><code>@​macarie</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9514">vitest-dev/vitest#9514</a>
<a href="https://github.com/vitest-dev/vitest/commit/309362089"><!-- raw
HTML omitted -->(30936)<!-- raw HTML omitted --></a></li>
<li>Add <code>findElement</code> and enable strict mode in webdriverio
and preview  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9677">vitest-dev/vitest#9677</a>
<a href="https://github.com/vitest-dev/vitest/commit/c3f37721c"><!-- raw
HTML omitted -->(c3f37)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>cli</strong>:
<ul>
<li>Add <a href="https://github.com/bomb"><code>@​bomb</code></a>.sh/tab
completions  -  by <a
href="https://github.com/AmirSa12"><code>@​AmirSa12</code></a> and <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/8639">vitest-dev/vitest#8639</a>
<a href="https://github.com/vitest-dev/vitest/commit/200f31704"><!-- raw
HTML omitted -->(200f3)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>coverage</strong>:
<ul>
<li>Support <code>ignore start/stop</code> ignore hints  -  by <a
href="https://github.com/AriPerkkio"><code>@​AriPerkkio</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9204">vitest-dev/vitest#9204</a>
<a href="https://github.com/vitest-dev/vitest/commit/e59c94ba6"><!-- raw
HTML omitted -->(e59c9)<!-- raw HTML omitted --></a></li>
<li>Add <code>coverage.changed</code> option to report only changed
files  -  by <a
href="https://github.com/kykim00"><code>@​kykim00</code></a> and <a
href="https://github.com/AriPerkkio"><code>@​AriPerkkio</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9521">vitest-dev/vitest#9521</a>
<a href="https://github.com/vitest-dev/vitest/commit/1d9392c67"><!-- raw
HTML omitted -->(1d939)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>experimental</strong>:
<ul>
<li>Add <code>onModuleRunner</code> hook to <code>worker.init</code>  - 
by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9286">vitest-dev/vitest#9286</a>
<a href="https://github.com/vitest-dev/vitest/commit/e977f3deb"><!-- raw
HTML omitted -->(e977f)<!-- raw HTML omitted --></a></li>
<li>Option to disable the module runner  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> and
<a href="https://github.com/AriPerkkio"><code>@​AriPerkkio</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9210">vitest-dev/vitest#9210</a>
<a href="https://github.com/vitest-dev/vitest/commit/9be6121ee"><!-- raw
HTML omitted -->(9be61)<!-- raw HTML omitted --></a></li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitest-dev/vitest/commit/4150b913171bda3971a4a4c47c633c26d0c6ae45"><code>4150b91</code></a>
chore: release v4.1.0</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/1de0aa22dd6311a93546a75a3c58a6be519c1baf"><code>1de0aa2</code></a>
fix: correctly identify concurrent test during static analysis (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9846">#9846</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/c3cac1c1b5a91d921942e9391fbd94841717363f"><code>c3cac1c</code></a>
fix: use isAgent check, not just TTY, for watch mode (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9841">#9841</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/eab68ba2b8ea6f89717c0b885c573579659d7c3b"><code>eab68ba</code></a>
chore(deps): update all non-major dependencies (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9824">#9824</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/031f02a89be34491c441b4da9c4e2bacb7db71df"><code>031f02a</code></a>
fix: allow catch/finally for async assertion (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9827">#9827</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/3e9e096a231fa0ec6475da82e36cbd6fcc9bc8f9"><code>3e9e096</code></a>
feat(reporters): add <code>agent</code> reporter to reduce ai agent
token usage (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9779">#9779</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/0c2c01361a95dd26d0d7fd7bc38bcca8dbc6e5d2"><code>0c2c013</code></a>
chore: release v4.1.0-beta.6</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/8181e06e765f4d043818b244c76795022fa78ff6"><code>8181e06</code></a>
fix: <code>hideSkippedTests</code> should not hide
<code>test.todo</code> (fix <a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9562">#9562</a>)
(<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9781">#9781</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/a8216b0014b83612e40ef49f919d5293b68717b3"><code>a8216b0</code></a>
fix: manual and redirect mock shouldn't <code>load</code> or
<code>transform</code> original module...</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/689a22a1b8c79595f6f4ae82d2b43c895d7f1c50"><code>689a22a</code></a>
fix(browser): types of <code>getCDPSession</code> and <code>cdp()</code>
(<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9716">#9716</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vitest-dev/vitest/commits/v4.1.0/packages/vitest">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for vitest since your current version.</p>
</details>
<br />

Updates `vitest` from 3.2.4 to 4.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitest-dev/vitest/releases">vitest's
releases</a>.</em></p>
<blockquote>
<h2>v4.1.0</h2>
<p>Vitest 4.1 is out!</p>
<p>This release page lists all changes made to the project during the
4.1 beta. To get a review of all the new features, read our <a
href="https://vitest.dev/blog/vitest-4-1">blog post</a>.</p>
<h3>   🚀 Features</h3>
<ul>
<li>Return a disposable from doMock()  -  by <a
href="https://github.com/kirkwaiblinger"><code>@​kirkwaiblinger</code></a>
in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9332">vitest-dev/vitest#9332</a>
<a href="https://github.com/vitest-dev/vitest/commit/e3e659a96"><!-- raw
HTML omitted -->(e3e65)<!-- raw HTML omitted --></a></li>
<li>Added chai style assertions  -  by <a
href="https://github.com/ronnakamoto"><code>@​ronnakamoto</code></a> and
<a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a>
in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/8842">vitest-dev/vitest#8842</a>
<a href="https://github.com/vitest-dev/vitest/commit/841df9ac5"><!-- raw
HTML omitted -->(841df)<!-- raw HTML omitted --></a></li>
<li>Update to sinon/fake-timers v15 and add <code>setTickMode</code> to
timer controls  -  by <a
href="https://github.com/atscott"><code>@​atscott</code></a> and <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/8726">vitest-dev/vitest#8726</a>
<a href="https://github.com/vitest-dev/vitest/commit/4b480aaed"><!-- raw
HTML omitted -->(4b480)<!-- raw HTML omitted --></a></li>
<li>Expose matcher types  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9448">vitest-dev/vitest#9448</a>
<a href="https://github.com/vitest-dev/vitest/commit/3e4b913b1"><!-- raw
HTML omitted -->(3e4b9)<!-- raw HTML omitted --></a></li>
<li>Add <code>toTestSpecification</code> to reported tasks  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9464">vitest-dev/vitest#9464</a>
<a href="https://github.com/vitest-dev/vitest/commit/1a4705da9"><!-- raw
HTML omitted -->(1a470)<!-- raw HTML omitted --></a></li>
<li>Show a warning if <code>vi.mock</code> or <code>vi.hoisted</code>
are declared outside of top level of the module  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9387">vitest-dev/vitest#9387</a>
<a href="https://github.com/vitest-dev/vitest/commit/5db54a468"><!-- raw
HTML omitted -->(5db54)<!-- raw HTML omitted --></a></li>
<li>Track and display expectedly failed tests (.fails) in UI and CLI  - 
by <a href="https://github.com/Copilot"><code>@​Copilot</code></a>,
<strong>sheremet-va</strong> and <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9476">vitest-dev/vitest#9476</a>
<a href="https://github.com/vitest-dev/vitest/commit/77d75fd34"><!-- raw
HTML omitted -->(77d75)<!-- raw HTML omitted --></a></li>
<li>Support tags  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9478">vitest-dev/vitest#9478</a>
<a href="https://github.com/vitest-dev/vitest/commit/de7c8a521"><!-- raw
HTML omitted -->(de7c8)<!-- raw HTML omitted --></a></li>
<li>Implement <code>aroundEach</code> and <code>aroundAll</code> hooks
 -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9450">vitest-dev/vitest#9450</a>
<a href="https://github.com/vitest-dev/vitest/commit/2a8cb9dc2"><!-- raw
HTML omitted -->(2a8cb)<!-- raw HTML omitted --></a></li>
<li>Stabilize experimental features  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9529">vitest-dev/vitest#9529</a>
<a href="https://github.com/vitest-dev/vitest/commit/b5fd2a16a"><!-- raw
HTML omitted -->(b5fd2)<!-- raw HTML omitted --></a></li>
<li>Accept <code>new</code> or <code>all</code> in <code>--update</code>
flag  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9543">vitest-dev/vitest#9543</a>
<a href="https://github.com/vitest-dev/vitest/commit/a5acf28a5"><!-- raw
HTML omitted -->(a5acf)<!-- raw HTML omitted --></a></li>
<li>Support <code>meta</code> in test options  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9535">vitest-dev/vitest#9535</a>
<a href="https://github.com/vitest-dev/vitest/commit/7d622e3d1"><!-- raw
HTML omitted -->(7d622)<!-- raw HTML omitted --></a></li>
<li>Support type inference with a new <code>test.extend</code> syntax
 -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9550">vitest-dev/vitest#9550</a>
<a href="https://github.com/vitest-dev/vitest/commit/e53854fcc"><!-- raw
HTML omitted -->(e5385)<!-- raw HTML omitted --></a></li>
<li>Support vite 8 beta, fix type issues in the config with different
vite versions  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9587">vitest-dev/vitest#9587</a>
<a href="https://github.com/vitest-dev/vitest/commit/990281dfd"><!-- raw
HTML omitted -->(99028)<!-- raw HTML omitted --></a></li>
<li>Add assertion helper to hide internal stack traces  -  by <a
href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> and
<strong>Claude Opus 4.6</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9594">vitest-dev/vitest#9594</a>
<a href="https://github.com/vitest-dev/vitest/commit/eeb0ae2f8"><!-- raw
HTML omitted -->(eeb0a)<!-- raw HTML omitted --></a></li>
<li>Store failure screenshots using artifacts API  -  by <a
href="https://github.com/macarie"><code>@​macarie</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9588">vitest-dev/vitest#9588</a>
<a href="https://github.com/vitest-dev/vitest/commit/24603e3c4"><!-- raw
HTML omitted -->(24603)<!-- raw HTML omitted --></a></li>
<li>Allow <code>vitest list</code> to statically collect tests instead
of running files to collect them  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9630">vitest-dev/vitest#9630</a>
<a href="https://github.com/vitest-dev/vitest/commit/7a8e7fc20"><!-- raw
HTML omitted -->(7a8e7)<!-- raw HTML omitted --></a></li>
<li>Add <code>--detect-async-leaks</code>  -  by <a
href="https://github.com/AriPerkkio"><code>@​AriPerkkio</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9528">vitest-dev/vitest#9528</a>
<a href="https://github.com/vitest-dev/vitest/commit/c594d4af3"><!-- raw
HTML omitted -->(c594d)<!-- raw HTML omitted --></a></li>
<li>Implement <code>mockThrow</code> and <code>mockThrowOnce</code>  - 
by <a
href="https://github.com/thor-juhasz"><code>@​thor-juhasz</code></a> and
<a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a>
in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9512">vitest-dev/vitest#9512</a>
<a href="https://github.com/vitest-dev/vitest/commit/619179fb7"><!-- raw
HTML omitted -->(61917)<!-- raw HTML omitted --></a></li>
<li>Support <code>update: &quot;none&quot;</code> and add docs about
snapshots behavior on CI  -  by <a
href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9700">vitest-dev/vitest#9700</a>
<a href="https://github.com/vitest-dev/vitest/commit/05f1854e2"><!-- raw
HTML omitted -->(05f18)<!-- raw HTML omitted --></a></li>
<li>Support playwright <code>launchOptions</code> with
<code>connectOptions</code>  -  by <a
href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9702">vitest-dev/vitest#9702</a>
<a href="https://github.com/vitest-dev/vitest/commit/f0ff1b2a0"><!-- raw
HTML omitted -->(f0ff1)<!-- raw HTML omitted --></a></li>
<li>Add <code>page/locator.mark</code> API to enhance playwright trace
 -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>
in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9652">vitest-dev/vitest#9652</a>
<a href="https://github.com/vitest-dev/vitest/commit/d0ee546fe"><!-- raw
HTML omitted -->(d0ee5)<!-- raw HTML omitted --></a></li>
<li><strong>api</strong>:
<ul>
<li>Support tests starting or ending with <code>test</code> in
<code>experimental_parseSpecification</code>  -  by <a
href="https://github.com/jgillick"><code>@​jgillick</code></a> and
<strong>Jeremy Gillick</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9235">vitest-dev/vitest#9235</a>
<a href="https://github.com/vitest-dev/vitest/commit/2f367fad3"><!-- raw
HTML omitted -->(2f367)<!-- raw HTML omitted --></a></li>
<li>Add filters to <code>createSpecification</code>  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9336">vitest-dev/vitest#9336</a>
<a href="https://github.com/vitest-dev/vitest/commit/c8e6c7fbf"><!-- raw
HTML omitted -->(c8e6c)<!-- raw HTML omitted --></a></li>
<li>Expose <code>runTestFiles</code> as alternative to
<code>runTestSpecifications</code>  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9443">vitest-dev/vitest#9443</a>
<a href="https://github.com/vitest-dev/vitest/commit/43d761821"><!-- raw
HTML omitted -->(43d76)<!-- raw HTML omitted --></a></li>
<li>Add <code>allowWrite</code> and <code>allowExec</code> options to
<code>api</code>  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9350">vitest-dev/vitest#9350</a>
<a href="https://github.com/vitest-dev/vitest/commit/20e00ef78"><!-- raw
HTML omitted -->(20e00)<!-- raw HTML omitted --></a></li>
<li>Allow passing down test cases to <code>toTestSpecification</code>
 -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9627">vitest-dev/vitest#9627</a>
<a href="https://github.com/vitest-dev/vitest/commit/6f17d5ddf"><!-- raw
HTML omitted -->(6f17d)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>browser</strong>:
<ul>
<li>Add <code>userEvent.wheel</code> API  -  by <a
href="https://github.com/macarie"><code>@​macarie</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9188">vitest-dev/vitest#9188</a>
<a href="https://github.com/vitest-dev/vitest/commit/660801979"><!-- raw
HTML omitted -->(66080)<!-- raw HTML omitted --></a></li>
<li>Add <code>filterNode</code> option to prettyDOM for filtering
browser assertion error output  -  by <a
href="https://github.com/Copilot"><code>@​Copilot</code></a>,
<strong>sheremet-va</strong> and <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9475">vitest-dev/vitest#9475</a>
<a href="https://github.com/vitest-dev/vitest/commit/d3220fcd8"><!-- raw
HTML omitted -->(d3220)<!-- raw HTML omitted --></a></li>
<li>Support playwright persistent context  -  by <a
href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>,
<strong>Claude Opus 4.6</strong> and <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9229">vitest-dev/vitest#9229</a>
<a href="https://github.com/vitest-dev/vitest/commit/f865d2ba4"><!-- raw
HTML omitted -->(f865d)<!-- raw HTML omitted --></a></li>
<li>Added <code>detailsPanelPosition</code> option and button  -  by <a
href="https://github.com/shairez"><code>@​shairez</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9525">vitest-dev/vitest#9525</a>
<a href="https://github.com/vitest-dev/vitest/commit/c8a31147c"><!-- raw
HTML omitted -->(c8a31)<!-- raw HTML omitted --></a></li>
<li>Use BlazeDiff instead of pixelmatch  -  by <a
href="https://github.com/macarie"><code>@​macarie</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9514">vitest-dev/vitest#9514</a>
<a href="https://github.com/vitest-dev/vitest/commit/309362089"><!-- raw
HTML omitted -->(30936)<!-- raw HTML omitted --></a></li>
<li>Add <code>findElement</code> and enable strict mode in webdriverio
and preview  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9677">vitest-dev/vitest#9677</a>
<a href="https://github.com/vitest-dev/vitest/commit/c3f37721c"><!-- raw
HTML omitted -->(c3f37)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>cli</strong>:
<ul>
<li>Add <a href="https://github.com/bomb"><code>@​bomb</code></a>.sh/tab
completions  -  by <a
href="https://github.com/AmirSa12"><code>@​AmirSa12</code></a> and <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/8639">vitest-dev/vitest#8639</a>
<a href="https://github.com/vitest-dev/vitest/commit/200f31704"><!-- raw
HTML omitted -->(200f3)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>coverage</strong>:
<ul>
<li>Support <code>ignore start/stop</code> ignore hints  -  by <a
href="https://github.com/AriPerkkio"><code>@​AriPerkkio</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9204">vitest-dev/vitest#9204</a>
<a href="https://github.com/vitest-dev/vitest/commit/e59c94ba6"><!-- raw
HTML omitted -->(e59c9)<!-- raw HTML omitted --></a></li>
<li>Add <code>coverage.changed</code> option to report only changed
files  -  by <a
href="https://github.com/kykim00"><code>@​kykim00</code></a> and <a
href="https://github.com/AriPerkkio"><code>@​AriPerkkio</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/9521">vitest-dev/vitest#9521</a>
<a href="https://github.com/vitest-dev/vitest/commit/1d9392c67"><!-- raw
HTML omitted -->(1d939)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>experimental</strong>:
<ul>
<li>Add <code>onModuleRunner</code> hook to <code>worker.init</code>  - 
by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9286">vitest-dev/vitest#9286</a>
<a href="https://github.com/vitest-dev/vitest/commit/e977f3deb"><!-- raw
HTML omitted -->(e977f)<!-- raw HTML omitted --></a></li>
<li>Option to disable the module runner  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> and
<a href="https://github.com/AriPerkkio"><code>@​AriPerkkio</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/9210">vitest-dev/vitest#9210</a>
<a href="https://github.com/vitest-dev/vitest/commit/9be6121ee"><!-- raw
HTML omitted -->(9be61)<!-- raw HTML omitted --></a></li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitest-dev/vitest/commit/4150b913171bda3971a4a4c47c633c26d0c6ae45"><code>4150b91</code></a>
chore: release v4.1.0</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/1de0aa22dd6311a93546a75a3c58a6be519c1baf"><code>1de0aa2</code></a>
fix: correctly identify concurrent test during static analysis (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9846">#9846</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/c3cac1c1b5a91d921942e9391fbd94841717363f"><code>c3cac1c</code></a>
fix: use isAgent check, not just TTY, for watch mode (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9841">#9841</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/eab68ba2b8ea6f89717c0b885c573579659d7c3b"><code>eab68ba</code></a>
chore(deps): update all non-major dependencies (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9824">#9824</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/031f02a89be34491c441b4da9c4e2bacb7db71df"><code>031f02a</code></a>
fix: allow catch/finally for async assertion (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9827">#9827</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/3e9e096a231fa0ec6475da82e36cbd6fcc9bc8f9"><code>3e9e096</code></a>
feat(reporters): add <code>agent</code> reporter to reduce ai agent
token usage (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9779">#9779</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/0c2c01361a95dd26d0d7fd7bc38bcca8dbc6e5d2"><code>0c2c013</code></a>
chore: release v4.1.0-beta.6</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/8181e06e765f4d043818b244c76795022fa78ff6"><code>8181e06</code></a>
fix: <code>hideSkippedTests</code> should not hide
<code>test.todo</code> (fix <a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9562">#9562</a>)
(<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9781">#9781</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/a8216b0014b83612e40ef49f919d5293b68717b3"><code>a8216b0</code></a>
fix: manual and redirect mock shouldn't <code>load</code> or
<code>transform</code> original module...</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/689a22a1b8c79595f6f4ae82d2b43c895d7f1c50"><code>689a22a</code></a>
fix(browser): types of <code>getCDPSession</code> and <code>cdp()</code>
(<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9716">#9716</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vitest-dev/vitest/commits/v4.1.0/packages/vitest">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for vitest since your current version.</p>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/e2b-dev/E2B/network/alerts).

</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jakub Novak <jakub@e2b.dev>
 2026-06-02 02:36:24 -07:00
Mish Ushakov 6e3b699072 chore: add issue template config (#1377) 
Adds `.github/ISSUE_TEMPLATE/config.yml` to disable blank issues,
forcing users to pick an existing template. Also adds contact links to
the E2B Docs and the E2B Discord (reusing the invite already referenced
in `CONTRIBUTING.md`).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-01 17:25:27 +00:00
dependabot[bot] 6e3a469a8c chore(deps-dev): bump urllib3 from 2.6.3 to 2.7.0 in /packages/python-sdk in the pip group across 1 directory (#1324) 
Bumps the pip group with 1 update in the /packages/python-sdk directory:
[urllib3](https://github.com/urllib3/urllib3).

Updates `urllib3` from 2.6.3 to 2.7.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/releases">urllib3's
releases</a>.</em></p>
<blockquote>
<h2>2.7.0</h2>
<h2>🚀 urllib3 is fundraising for HTTP/2 support</h2>
<p><a
href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3
is raising ~$40,000 USD</a> to release HTTP/2 support and ensure
long-term sustainable maintenance of the project after a sharp decline
in financial support. If your company or organization uses Python and
would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and
thousands of other projects <a
href="https://opencollective.com/urllib3">please consider contributing
financially</a> to ensure HTTP/2 support is developed sustainably and
maintained for the long-haul.</p>
<p>Thank you for your support.</p>
<h2>Security</h2>
<p>Addressed high-severity security issues. Impact was limited to
specific use cases detailed in the accompanying advisories; overall user
exposure was estimated to be marginal.</p>
<ul>
<li>
<p>Decompression-bomb safeguards of the streaming API were bypassed:</p>
<ol>
<li>When <code>HTTPResponse.drain_conn()</code> was called after the
response had been read and decompressed partially. (Reported by <a
href="https://github.com/Cycloctane"><code>@​Cycloctane</code></a>)</li>
<li>During the second <code>HTTPResponse.read(amt=N)</code> or
<code>HTTPResponse.stream(amt=N)</code> call when the response was
decompressed using the official <a
href="https://pypi.org/project/brotli/">Brotli</a> library. (Reported by
<a
href="https://github.com/kimkou2024"><code>@​kimkou2024</code></a>)</li>
</ol>
<p>See GHSA-mf9v-mfxr-j63j for details.</p>
</li>
<li>
<p>HTTP pools created using
<code>ProxyManager.connection_from_url</code> did not strip sensitive
headers specified in <code>Retry.remove_headers_on_redirect</code> when
redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by <a
href="https://github.com/christos-spearbit"><code>@​christos-spearbit</code></a>)</p>
</li>
</ul>
<h2>Deprecations and Removals</h2>
<ul>
<li>Used <code>FutureWarning</code> instead of
<code>DeprecationWarning</code> for better visibility of existing
deprecation notices. Rescheduled the removal of deprecated features to
version 3.0. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3763">urllib3/urllib3#3763</a>)</li>
<li>Removed support for end-of-life Python 3.9. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3720">urllib3/urllib3#3720</a>)</li>
<li>Removed support for end-of-life PyPy3.10. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4979">urllib3/urllib3#4979</a>)</li>
<li>Bumped the minimum supported pyOpenSSL version to 19.0.0. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3777">urllib3/urllib3#3777</a>)</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>Fixed a bug where <code>HTTPResponse.read(amt=None)</code> was
ignoring decompressed data buffered from previous partial reads. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3636">urllib3/urllib3#3636</a>)</li>
<li>Fixed a bug where <code>HTTPResponse.read()</code> could cache only
part of the response after a partial read when
<code>cache_content=True</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4967">urllib3/urllib3#4967</a>)</li>
<li>Fixed <code>HTTPResponse.stream()</code> and
<code>HTTPResponse.read_chunked()</code> to handle <code>amt=0</code>.
(<a
href="https://redirect.github.com/urllib3/urllib3/issues/3793">urllib3/urllib3#3793</a>)</li>
<li>Updated <code>_TYPE_BODY</code> type alias to include missing
<code>Iterable[str]</code>, matching the documented and runtime behavior
of chunked request bodies. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3798">urllib3/urllib3#3798</a>)</li>
<li>Fixed <code>LocationParseError</code> when paths resembling
schemeless URIs were passed to
<code>HTTPConnectionPool.urlopen()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3352">urllib3/urllib3#3352</a>)</li>
<li>Fixed <code>BaseHTTPResponse.readinto()</code> type annotation to
accept <code>memoryview</code> in addition to <code>bytearray</code>,
matching the <code>io.RawIOBase.readinto</code> contract and enabling
use with <code>io.BufferedReader</code> without type errors. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3764">urllib3/urllib3#3764</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's
changelog</a>.</em></p>
<blockquote>
<h1>2.7.0 (2026-05-07)</h1>
<h2>Security</h2>
<p>Addressed high-severity security issues.
Impact was limited to specific use cases detailed in the accompanying
advisories; overall user exposure was estimated to be marginal.</p>
<ul>
<li>
<p>Decompression-bomb safeguards of the streaming API were bypassed:</p>
<ol>
<li>When <code>HTTPResponse.drain_conn()</code> was called after the
response had been
read and decompressed partially.</li>
<li>During the second <code>HTTPResponse.read(amt=N)</code> or
<code>HTTPResponse.stream(amt=N)</code> call when the response was
decompressed
using the official <code>Brotli
&lt;https://pypi.org/project/brotli/&gt;</code>__ library.</li>
</ol>
<p>See <code>GHSA-mf9v-mfxr-j63j
&lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j&gt;</code>__
for details.</p>
</li>
<li>
<p>HTTP pools created using
<code>ProxyManager.connection_from_url</code> did not strip
sensitive headers specified in
<code>Retry.remove_headers_on_redirect</code> when
redirecting to a different host.
(<code>GHSA-qccp-gfcp-xxvc
&lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc&gt;</code>__)</p>
</li>
</ul>
<h2>Deprecations and Removals</h2>
<ul>
<li>Used <code>FutureWarning</code> instead of
<code>DeprecationWarning</code> for better
visibility of existing deprecation notices. Rescheduled the removal of
deprecated features to version 3.0.
(<code>[#3763](https://github.com/urllib3/urllib3/issues/3763)
&lt;https://github.com/urllib3/urllib3/issues/3763&gt;</code>__)</li>
<li>Removed support for end-of-life Python 3.9.
(<code>[#3720](https://github.com/urllib3/urllib3/issues/3720)
&lt;https://github.com/urllib3/urllib3/issues/3720&gt;</code>__)</li>
<li>Removed support for end-of-life PyPy3.10.
(<code>[#4979](https://github.com/urllib3/urllib3/issues/4979)
&lt;https://github.com/urllib3/urllib3/issues/4979&gt;</code>__)</li>
<li>Bumped the minimum supported pyOpenSSL version to 19.0.0.
(<code>[#3777](https://github.com/urllib3/urllib3/issues/3777)
&lt;https://github.com/urllib3/urllib3/issues/3777&gt;</code>__)</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>Fixed a bug where <code>HTTPResponse.read(amt=None)</code> was
ignoring decompressed
data buffered from previous partial reads.
(<code>[#3636](https://github.com/urllib3/urllib3/issues/3636)
&lt;https://github.com/urllib3/urllib3/issues/3636&gt;</code>__)</li>
<li>Fixed a bug where <code>HTTPResponse.read()</code> could cache only
part of the
response after a partial read when <code>cache_content=True</code>.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/urllib3/urllib3/commit/9a950b92d999f906b6020bb2d1076ee56cddd5d2"><code>9a950b9</code></a>
Release 2.7.0</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc"><code>5ec0de4</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a"><code>2bdcc44</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/f45b0df09d8620ac6ed0491eb9362c8c87b7bc2c"><code>f45b0df</code></a>
Fix a misleading example for <code>ProxyManager</code> (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4970">#4970</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/577193ca029872384f82c133449e0935f6d8a64b"><code>577193c</code></a>
Switch to nightly PyPy3.11 in CI for now (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4984">#4984</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/e90af45bb006c3a452a3a21644a2681523f5c7fc"><code>e90af45</code></a>
Avoid infinite loop in <code>HTTPResponse.read_chunked</code> when
<code>amt=0</code> (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4974">#4974</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/67ed74fdaec6659a6534621ec8e3aaaa6f976210"><code>67ed74f</code></a>
Bump dev dependencies (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4972">#4972</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/3abd481097b54d87b574ac7ea593c3f40938a84d"><code>3abd481</code></a>
Upgrade mypy to version 1.20.2 (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4978">#4978</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/2b8725dfcac4f21d4d93cc0cc3a64a33af08f890"><code>2b8725d</code></a>
Drop support for EOL PyPy3.10 (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4979">#4979</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/2944b2a0a6c573f5548a39cfd17196f98ee21b33"><code>2944b2a</code></a>
Upgrade <code>setup-chrome</code> and <code>setup-firefox</code> to fix
warnings (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4973">#4973</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/urllib3/urllib3/compare/2.6.3...2.7.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=urllib3&package-manager=pip&previous-version=2.6.3&new-version=2.7.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/e2b-dev/E2B/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jakub Novák <jakub@e2b.dev>
 2026-06-01 18:57:09 +02:00