Commit Graph

4943 Commits

Author SHA1 Message Date
Mish Ushakov 2ac5de2edf feat(js-sdk): support AbortSignal for request cancellation (#1328) e2b@2.21.0 2026-05-15 23:24:16 +02:00
github-actions[bot] 70f0d833f5 [skip ci] Release new versions 2026-05-14 17:36:14 +00:00
Mish Ushakov eaf452a82b feat: add optional name to createSnapshot and return snapshot names (#1327)
## Summary
- Add optional `name` parameter to `createSnapshot` / `create_snapshot`
in the JS and Python SDKs so callers can name the resulting snapshot
template.
- Return the `names` field from the snapshot API on `SnapshotInfo` (both
in `createSnapshot` responses and in `listSnapshots` paginator results)
so callers can discover the namespaced snapshot names.
- Includes a changeset (`patch` for `e2b` and `@e2b/python-sdk`).

## Test plan
- [ ] `pnpm run format`, `pnpm run lint`, `pnpm run typecheck` all pass
locally
- [ ] Integration tests on a sandbox with valid credentials:
`sandbox.createSnapshot({ name: 'my-snap' })` returns non-empty `names`

Resolves https://github.com/e2b-dev/E2B/issues/1249

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
@e2b/python-sdk@2.21.1 e2b@2.20.1
2026-05-14 17:22:31 +00:00
Mish Ushakov 575339b163 test(python-sdk): parallelize async sandbox teardown (#1309)
## Summary
- Replace the sequential `for sandbox in sandboxes: await
sandbox.kill()` teardown in `async_sandbox_factory` with
`asyncio.gather(..., return_exceptions=True)` so a failure on one kill
no longer blocks cleanup of the rest, and teardown runs concurrently.
- Hoist the `_test_failed` check above the loop so the failure log is
printed once per fixture rather than per sandbox.

## Test plan
- [ ] `pnpm run format`, `pnpm run lint`, `pnpm run typecheck`
(python-sdk) all pass
- [ ] `pnpm run test` against affected python async sandbox tests

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-14 13:26:47 +00:00
github-actions[bot] 9e962ae555 [skip ci] Release new versions 2026-05-11 17:38:06 +00:00
Matt Brockman b2a2786707 Bug e2b 2195 throws dynamic usage of require is not eng 4003 (#1323)
Fix the JS SDK envd HTTP/2 transport so it works in Next.js/Turbopack production builds.
e2b@2.20.0
2026-05-11 10:04:19 -07:00
Tomas Virgl ff0db65902 Mark additional files as linguist-generated (#1316) 2026-05-09 09:45:13 -07:00
github-actions[bot] e3092d5719 [skip ci] Release new versions 2026-05-06 00:56:25 +00:00
Matt Brockman f7a97e698e enable http2 for js sdk envd rpc/api traffic (#1311)
Enables HTTP/2 for JS SDK sandbox envd traffic in Node by routing envd
RPC/API requests through undici with an HTTP/2-enabled dispatcher.

Non-Node runtimes continue to use global fetch. Management API and
volume clients are unchanged.

Requires bumping node from >=20 to >= 20.18.1 for undici
@e2b/python-sdk@2.21.0 e2b@2.19.5
2026-05-05 17:24:16 -07:00
Matt Brockman 20ea715252 Enable HTTP/2 for Python SDK transports for sandbox/main api calls (#1310)
switches python sdk to use http2 for calls to main api + sandboxes

doesn't add it to volumes yet - need to test those separately
2026-05-05 17:23:46 -07:00
github-actions[bot] 76f5effde6 [skip ci] Release new versions 2026-04-30 18:04:41 +00:00
Mish Ushakov 7982da9de0 Add changeset generation instructions (#1308)
Added instructions for generating changesets after package updates.
2026-04-30 17:52:59 +00:00
Mish Ushakov ae138767ac chore(js-sdk): add patch changeset for npm-check-updates removal (#1307)
## Summary

Adds a patch changeset for the `e2b` JS SDK to cover #1306 (commit
bd99b23c1), which removed the unused `npm-check-updates` devDependency
to clear the remaining `tar@6` Dependabot security alerts.

The original PR landed without a changeset, so the next release would
skip publishing the SDK despite the `package.json` change. This file
ensures the dependency cleanup gets a proper patch bump.

## Test plan

- [x] `.changeset/drop-npm-check-updates.md` follows the repo's existing
changeset format (frontmatter + summary line)
- [ ] Changesets bot picks up the entry on the PR

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
e2b@2.19.4
2026-04-30 17:40:56 +00:00
Mish Ushakov bd99b23c1c chore(deps): drop unused npm-check-updates devDep to clear tar alerts (#1306)
## Summary

Resolves the remaining 6 high-severity Dependabot alerts for `tar` on
the default branch. `tar@6.2.1` was being pulled in transitively via
`npm-check-updates@16 -> pacote@15 / cacache -> tar@^6`, and
Dependabot's `<= 7.5.10` ranges include 6.x semver-wise. Since
`npm-check-updates` was declared as a `devDependency` but never actually
invoked anywhere (no script, CI workflow, or doc references it),
removing it entirely is cleaner than bumping it — alerts cleared with
zero risk of regression.

After removal, the lock contains only `tar@7.5.12`, which satisfies all
six advisories.

## Test plan

- [x] `pnpm run lint` (js-sdk + cli)
- [x] `pnpm run typecheck` (js-sdk + cli)
- [x] `pnpm run format` (js-sdk + cli)
- [x] tar-related unit tests pass (`tests/template/utils`,
`tests/template/uploadFile` — 54 tests)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-30 19:27:32 +02:00
github-actions[bot] 5ed9c32ea7 [skip ci] Release new versions 2026-04-30 15:15:40 +00:00
Mish Ushakov 55e9e0eb5a chore(deps): resolve Dependabot security alerts across npm and python (#1302)
## Summary

Resolves all 31 open [Dependabot
alerts](https://github.com/e2b-dev/e2b/security/dependabot) across the
workspace.

- **npm** — added range-based `pnpm.overrides` to bump vulnerable
transitive deps to their patched versions: postcss, vite, lodash,
brace-expansion, picomatch (2.x + 4.x), yaml, @tootallnate/once,
smol-toml, flatted, and minimatch (3.x/5.x/9.x/10.x).
- **python-sdk** — bumped dev deps in `poetry.lock`: pytest 7.4 → 9.0.3
(with constraint update in `pyproject.toml`), pytest-asyncio 0.23 → 1.3
(required for pytest 9), python-dotenv 1.2.2, pygments 2.20.0, requests
2.33.1, black 26.3.1; removed 4 now-unused `# ty: ignore` directives
that pytest 9's stricter type signatures made obsolete.

## Test plan

- [x] \`pnpm run typecheck\` passes
- [x] \`pnpm run lint\` passes
- [x] \`pnpm run format\` clean
- [x] CLI tests (80/80) and js-sdk/python-sdk unit tests pass;
integration tests not run locally (need \`E2B_API_KEY\`)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
@e2b/cli@2.10.1 @e2b/python-sdk@2.20.3 e2b@2.19.3
2026-04-30 14:45:19 +00:00
github-actions[bot] 3ff25f784e [skip ci] Release new versions 2026-04-27 21:27:14 +00:00
Mish Ushakov 2c995d4494 refactor(sdk): make octet-stream file upload opt-in via useOctetStream (#1296)
## Summary

- Adds an opt-in `useOctetStream` / `use_octet_stream` flag to sandbox
file write — JS on `FilesystemWriteOpts`, Python keyword on `write` /
`write_files` (async + sync).
- Changes the default upload path to `multipart/form-data` regardless of
envd version. Callers must opt in to `application/octet-stream`
(requires envd 0.5.7 or later).

## Example

JS:

```ts
// Default — multipart/form-data
await sandbox.files.write('hello.txt', 'world')

// Opt in to application/octet-stream (envd >= 0.5.7)
await sandbox.files.writeFiles(
  [{ path: 'a.txt', data: 'a' }, { path: 'b.txt', data: 'b' }],
  { useOctetStream: true },
)
```

Python:

```python
# Default — multipart/form-data
sandbox.files.write('hello.txt', 'world')

# Opt in to application/octet-stream (envd >= 0.5.7)
await sandbox.files.write_files(
    [{'path': 'a.txt', 'data': 'a'}, {'path': 'b.txt', 'data': 'b'}],
    use_octet_stream=True,
)
```

## Test plan

- [ ] JS: `pnpm --filter e2b run lint && pnpm --filter e2b run
typecheck`
- [ ] Python: `cd packages/python-sdk && poetry run make lint && poetry
run make typecheck`
- [ ] Manual write with and without `useOctetStream` /
`use_octet_stream` against envd 0.5.7+.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
@e2b/python-sdk@2.20.2 e2b@2.19.2
2026-04-27 21:16:33 +00:00
github-actions[bot] 557b723cc1 [skip ci] Release new versions 2026-04-24 18:35:47 +00:00
Mish Ushakov 3167e19b4f fix(sdk): buffer template upload to set Content-Length, add regression tests (#1294)
## Summary
Consolidates the fix and tests from #1285 and #1293 into a single PR.

- **js-sdk**: `uploadFile` used to pass a Node `Readable` directly to
`fetch`, causing undici to fall back to `Transfer-Encoding: chunked`. S3
presigned PUT URLs reject chunked with 501 NotImplemented. Fix buffers
the archive first so `Content-Length` is set. Includes:
- Regression test that spins up a local HTTP server and asserts
`Content-Length` is set and matches the body, and `Transfer-Encoding` is
not chunked.
- Type-fix for the CLI's typecheck (cast `Pack` →
`AsyncIterable<Buffer>`).
- Dynamic import of `node:stream/consumers` so the browser bundle
doesn't pull it in.
- **python-sdk**: Adds sync + async regression tests for `upload_file`
that guard against the same class of bug (someone swapping
`tar_buffer.getvalue()` for a stream/generator). No Python code change —
the current implementation already passes bytes to `httpx.put(...,
content=...)`.

Authorship of the original JS fix commit preserved (truffle-dev).

Closes #1243.

## Test plan
- [x] `pnpm run test tests/template/uploadFile.test.ts` — passes
- [x] `pnpm run typecheck` / `lint` clean across js-sdk and cli
- [x] `poetry run pytest tests/sync/template_sync/test_upload_file.py
tests/async/template_async/test_upload_file.py -v` — both pass
- [x] `poetry run make format` / `make lint` / `make typecheck` clean

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: truffle <truffleagent@gmail.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
@e2b/cli@2.10.0 @e2b/python-sdk@2.20.1 e2b@2.19.1
2026-04-24 07:14:54 -07:00
Mish Ushakov b97fd4dfd0 test: remove apt, bun, npm, pip install tests (#1275)
## Summary
- Deletes install test files for apt, bun, npm, and pip in both JS and
Python SDKs
- Removes sync and async variants in Python
- Stacktrace tests for these install methods are kept

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-24 06:27:23 -07:00
Mish Ushakov c2d6eef78d test: reduce test_sbx_metrics flakiness by extending polling window (#1291)
## Summary
- Bumps metrics polling from 15s to 30s in Python async/sync and JS SDK
tests so the backend has enough headroom to populate metrics under load
— this test was the new #1 CI offender (5/9 Python runs and 4/10 JS runs
failed).
- Raises the async Python sandbox timeout from 20s to 60s for parity
with sync, and adds per-test timeout overrides
(`@pytest.mark.timeout(60)` / `{ timeout: 60_000 }`) so polling can
complete under the default 30s pytest/vitest cap.
- Happy path is unchanged: the loop still breaks as soon as metrics
appear.

## Test plan
- [x] `pnpm run format`, `pnpm run lint`, `pnpm run typecheck` pass
- [x] `test_sbx_metrics` (Python async) passed locally in 8.4s
- [x] `test_sbx_metrics` (Python sync) passed locally in 15.6s
- [x] `metrics.test.ts` (JS) passed locally in 20.7s

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-24 06:03:49 -07:00
Matt Brockman a6a1156a76 fix: cli info handles not found without showing error message (#1247)
Handles sandbox not found on cli info
2026-04-21 08:33:07 -07:00
Kagura 2f0ff5f0f7 fix(sdk): prevent shell injection in MCP config via proper escaping (#1276)
## Summary

Fixes #1154

When creating a sandbox with an `mcp` config, the JSON-serialized config
is interpolated directly into a shell command wrapped in single quotes.
Since `json.dumps()` / `JSON.stringify()` do not escape single quotes,
any MCP config value containing a single quote (e.g., API keys, tokens,
URLs) breaks out of shell quoting and allows arbitrary command execution
inside the sandbox.

## Changes

### Python SDK (`sandbox_async/main.py`, `sandbox_sync/main.py`)
- Use `shlex.quote()` to properly escape the JSON config string (4
locations)
- `shlex.quote()` is a stdlib function designed exactly for this purpose

### JS/TS SDK (`sandbox/index.ts`)
- Add a `shellQuote()` helper that escapes single quotes using the
standard `'\'''` pattern (equivalent to Python's `shlex.quote()`)
- Apply it to both MCP config interpolation sites (2 locations)

## Before / After

**Before** (vulnerable):
```
mcp-gateway --config '{"servers": {"test": {"envs": {"KEY": "it's a value"}}}}'
#                                                            ^^ breaks out
```

**After** (safe):
```
mcp-gateway --config '{"servers": {"test": {"envs": {"KEY": "it'\''s a value"}}}}'
#                                                            ^^^^ properly escaped
```

## Testing

Verified escaping behavior for both Python (`shlex.quote`) and JS
(`shellQuote`) with the PoC from the issue — single quotes in config
values are properly escaped and no longer allow shell breakout.

---------

Co-authored-by: Mish Ushakov <10400064+mishushakov@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-21 07:30:14 -07:00
luo jiyin 7695889b7a Fix typos in docs, tests, and helper names (#1282)
## Summary

- fix typos in hand-written docs and comments
- rename typoed helper variables in the CLI
- fix typoed test identifiers and descriptions in the JS SDK tests
- fix typoed credential warning text in the Python SDK

## Testing

- not run

Closes #1281
2026-04-21 06:00:02 -07:00
Mish Ushakov 4065ecd68c feat: allow passing template as option in Sandbox.create() (#1267)
## Summary
- Adds `template` as an optional property on `SandboxOpts` in the JS
SDK, enabling `Sandbox.create({ template: 'my-template' })` syntax
- Updates both `create` and `betaCreate` to check `opts.template` before
falling back to the default template
- Python SDK already supports `Sandbox.create(template='template')` via
named parameters, so no changes needed there

## Test plan
- [ ] Verify `Sandbox.create({ template: 'base' })` works
- [ ] Verify `Sandbox.create('base')` still works (backwards compatible)
- [ ] Verify `Sandbox.create()` still defaults to `'base'`
- [ ] Verify MCP template fallback still works when no template is
specified

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-17 13:18:11 +00:00
Berry f667f335c6 fix: correct write_files docstring about directory auto-creation (#1260)
## Summary
- Fixes the Python SDK `write_files` docstring (both sync and async)
which incorrectly stated that writing to a non-existing directory would
produce an error
- The backend actually auto-creates parent directories, consistent with
the `write()` docstring and existing tests
(`test_write_to_non_existing_directory`)

## Test plan
- [x] Verified behavior with a test script — both `write()` and
`write_files()` auto-create nested directories
- [x] Existing tests pass (`test_write_to_non_existing_directory`,
`writeFiles creates parent directories`)
2026-04-12 15:51:41 +02:00
devin-ai-integration[bot] fcb95c34e2 cli: replace sandbox.kill() with setTimeout(1s) in create command to prevent snapshot deletions (#1256)
## Summary

In the CLI's `sandbox create` command, the `connectSandbox` function's
`finally` block previously called `sandbox.kill()` when the terminal
session ended. This replaces it with `sandbox.setTimeout(1_000)` so the
sandbox expires implicitly after 1 second rather than being explicitly
killed.

The motivation is that an explicit `kill()` can trigger deletion of
historic sandbox snapshots, whereas letting the sandbox time out avoids
that side effect.

### Updates since last revision

Addressed review feedback about a race condition: `clearInterval` stops
future keep-alive ticks but cannot cancel one already in-flight. The
keep-alive callback now stores its promise in a `pendingKeepAlive`
variable, and the `finally` block awaits it (with `.catch(() => {})`)
before setting the 1s shutdown timeout. This ensures an in-flight
`setTimeout(30_000)` cannot silently override the shutdown timeout.

## Review & Testing Checklist for Human

- [ ] **Verify that `sandbox.setTimeout(1_000)` does not trigger
snapshot deletion** — this is the core assumption behind the change.
Confirm that the implicit expiry path in the backend behaves differently
from the explicit `kill()` path with respect to snapshot preservation.
- [ ] **Test `e2b sandbox create` end-to-end**: connect a terminal,
exit, and confirm the sandbox is cleaned up within a few seconds and no
snapshots are lost.
- [ ] **Review the race condition fix**: confirm that `await
pendingKeepAlive.catch(() => {})` correctly serializes against the last
in-flight keep-alive before the 1s timeout is applied. Note that the
interval callback is no longer `async` — it just assigns the promise.
- [ ] **Edge case: what happens if `setTimeout` fails?** The sandbox
would remain alive with its previous 30s keep-alive timeout. Decide if
that's acceptable or if a fallback is needed.

### Notes
- The 1-second timeout value was chosen per the request. Adjust if a
different grace period is preferred.
- The keep-alive interval (`clearInterval`) is still stopped before
awaiting the pending promise, so no new ticks will fire.

Link to Devin session:
https://app.devin.ai/sessions/68081ba06fa54be9b8127ba1d68481ae

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: ben@e2b.dev <ben@e2b.dev>
2026-04-04 01:27:28 +02:00
Mish Ushakov b5f2631141 feat: add gzip content encoding option for file operations (#1252)
## Summary

- Adds optional `gzip` parameter to sandbox file read/write operations
across JS and Python SDKs
- Uploads are gzip-compressed via `CompressionStream` (JS) /
`gzip.compress` (Python) when enabled, downloads request
`Accept-Encoding: gzip`
- Only applies to the octet-stream upload path (envd >= 0.5.7), so older
envd versions are unaffected
- Includes tests for both SDKs covering write+read with gzip, write gzip
+ read plain, multi-file writes, and byte format reads

## Test plan

- [ ] Run JS SDK content encoding tests (`contentEncoding.test.ts`)
- [ ] Run Python async/sync content encoding tests
(`test_content_encoding.py`)
- [ ] Integration test with envd backend supporting `Content-Encoding:
gzip`

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-03 10:17:53 +00:00
github-actions[bot] 58ecd78053 [skip ci] Release new versions 2026-04-02 19:20:43 +00:00
Mish Ushakov cf35f61b44 feat: use application/octet-stream for sandbox file uploads (#1242)
## Summary
- Switches sandbox filesystem file uploads from `multipart/form-data` to
`application/octet-stream` in both the JS and Python SDKs
- Each file is now uploaded as raw binary with the path passed as a
query parameter, matching the `application/octet-stream` content type in
the envd API spec
- Multi-file writes send one request per file sequentially

## Test plan
- [ ] Run JS SDK filesystem write tests (`pnpm run test` in
`packages/js-sdk`)
- [ ] Run Python SDK filesystem write tests (`pytest` in
`packages/python-sdk`)
- [ ] Verify single file write, multi-file write, and various data types
(string, bytes, streams)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
@e2b/python-sdk@2.20.0 e2b@2.19.0
2026-04-02 13:45:22 +02:00
Mish Ushakov ef46004327 feat: increase volume file upload timeout to 1 hour (#1248)
Increases the default timeout for volume `writeFile`/`write_file`
operations from 60 seconds to 1 hour in both the JS and Python SDKs.
Other volume operations retain the existing 60s default. Users can still
override via `requestTimeoutMs` (JS) or `request_timeout` (Python).

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-01 10:31:08 -07:00
Berry 1cc385a767 Link runCode/run_code to docs in READMEs (#1237)
## Summary
- Made `runCode()` and `run_code()` references in READMEs link to the
[code interpreting docs](https://e2b.dev/docs/code-interpreting)
- Updated root README, js-sdk README, and python-sdk README

## Test plan
- [ ] Verify links render correctly on GitHub
- [ ] Confirm docs URL resolves
2026-03-29 15:48:28 +02:00
dependabot[bot] 6a18b4d99f chore(deps): bump handlebars from 4.7.8 to 4.7.9 in the npm_and_yarn group across 1 directory (#1239)
Bumps the npm_and_yarn group with 1 update in the / directory:
[handlebars](https://github.com/handlebars-lang/handlebars.js).

Updates `handlebars` from 4.7.8 to 4.7.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/handlebars-lang/handlebars.js/releases">handlebars's
releases</a>.</em></p>
<blockquote>
<h2>v4.7.9</h2>
<ul>
<li>fix: enable shell mode for spawn to resolve Windows EINVAL issue -
e0137c2</li>
<li>fix type &quot;RuntimeOptions&quot; also accepting string partials -
eab1d14</li>
<li>feat(types): set <code>hash</code> to be a <code>Record&lt;string,
any&gt;</code> - de4414d</li>
<li>fix non-contiguous program indices - 4512766</li>
<li>refactor: rename i to startPartIndex - e497a35</li>
<li>security: fix security issues - 68d8df5
<ul>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2w6w-674q-4c4q">https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2w6w-674q-4c4q</a></li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-3mfm-83xf-c92r">https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-3mfm-83xf-c92r</a></li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xhpv-hc6g-r9c6">https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xhpv-hc6g-r9c6</a></li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xjpj-3mr7-gcpf">https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xjpj-3mr7-gcpf</a></li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-9cx6-37pm-9jff">https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-9cx6-37pm-9jff</a></li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2qvq-rjwj-gvw9">https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2qvq-rjwj-gvw9</a></li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-7rx3-28cr-v5wh">https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-7rx3-28cr-v5wh</a></li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-442j-39wm-28r2">https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-442j-39wm-28r2</a></li>
</ul>
</li>
</ul>
<p><a
href="https://github.com/handlebars-lang/handlebars.js/compare/v4.7.8...v4.7.9">Commits</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md">handlebars's
changelog</a>.</em></p>
<blockquote>
<h2>v4.7.9 - March 26th, 2026</h2>
<ul>
<li>fix: enable shell mode for spawn to resolve Windows EINVAL issue -
e0137c2</li>
<li>fix type &quot;RuntimeOptions&quot; also accepting string partials -
eab1d14</li>
<li>feat(types): set <code>hash</code> to be a <code>Record&lt;string,
any&gt;</code> - de4414d</li>
<li>fix non-contiguous program indices - 4512766</li>
<li>refactor: rename i to startPartIndex - e497a35</li>
<li>security: fix security issues - 68d8df5</li>
</ul>
<p><a
href="https://github.com/handlebars-lang/handlebars.js/compare/v4.7.8...v4.7.9">Commits</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/dce542c9a660048d31f0981ac8a45c08b919bddb"><code>dce542c</code></a>
v4.7.9</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/8a41389ba5b2624b6f43a5463d8e2533b843a562"><code>8a41389</code></a>
Update release notes</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2"><code>68d8df5</code></a>
Fix security issues</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/b2a083136b11e1da9f0f47a11f749a9830a49328"><code>b2a0831</code></a>
Fix browser tests</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/9f98c1629834abf8de5a127caff8a2eab03d2c12"><code>9f98c16</code></a>
Fix release script</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/45443b4290475dfb7cec32a85d344f12ab345eb9"><code>45443b4</code></a>
Revert &quot;Improve partial indenting performance&quot;</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/8841a5f6d35096aee95d68e1e49636a4cb5c661e"><code>8841a5f</code></a>
Fix CI errors with linting</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/e0137c26f2202593bca7cc25184e733e87d54709"><code>e0137c2</code></a>
fix: enable shell mode for spawn to resolve Windows EINVAL issue</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/e914d6037ffb0dd371f7e4823cdb019732ae66d7"><code>e914d60</code></a>
Improve rendering performance</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/7de4b41c344a5d702edca93d1841b59642fa32bd"><code>7de4b41</code></a>
Upgrade GitHub Actions checkout and setup-node on 4.x branch</li>
<li>Additional commits viewable in <a
href="https://github.com/handlebars-lang/handlebars.js/compare/v4.7.8...v4.7.9">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-27 04:12:35 -07:00
Jakub Novák 4e4aa7ba71 chore: update rollup (#1236) 2026-03-27 03:23:22 -07:00
github-actions[bot] c02d11eb58 [skip ci] Release new versions 2026-03-26 01:32:46 +00:00
Mish Ushakov 6d7e72e3bd feat: add Volume CRUD operations to SDKs (#1126)
Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
Co-authored-by: Joe Lombrozo <joe.lombrozo@e2b.dev>
@e2b/python-sdk@2.19.0 e2b@2.18.0
2026-03-25 17:37:46 -07:00
github-actions[bot] 4bee8c54d4 [skip ci] Release new versions 2026-03-25 19:27:39 +00:00
Berry f7f1f2916e Add minor changeset for SDK README updates (#1234)
## Summary
- Adds a minor changeset for both `e2b` (JS SDK) and `@e2b/python-sdk`
(Python SDK) to publish updated READMEs

## Test plan
- [ ] Verify changeset format is correct
- [ ] Confirm version bump triggers on merge
@e2b/python-sdk@2.18.0 e2b@2.17.0
2026-03-25 19:38:24 +01:00
Berry a240f99db5 Default to base e2b SDK in READMEs (#1232)
## Summary
- Updated root README, js-sdk README, and python-sdk README to show base
`e2b` SDK install and usage as the default
- Code-interpreter is now shown as an optional step for when
`runCode()`/`run_code()` is actually needed
- SDK links in descriptions now point to base `e2b` packages on npm/PyPI

## Why
The base `e2b` package covers commands, files, git, networking, and
sandbox lifecycle. Users who don't need code execution shouldn't be
directed to install `@e2b/code-interpreter` / `e2b-code-interpreter` as
their first step.

## Test plan
- [ ] Verify README renders correctly on GitHub
- [ ] Confirm base SDK examples use correct import syntax
- [ ] Confirm code-interpreter section still shows correct usage for
`runCode()`
2026-03-24 21:04:20 +01:00
github-actions[bot] 9710e56bd5 [skip ci] Release new versions 2026-03-23 22:29:10 +00:00
Matt Brockman dcaca733e4 feat (cli): adds info command to get sandbox info (#1214)
CLI now supports the `info` command that mirrors the python/js getInfo()

usage:
```
$ e2b sandbox info xxx --format json
{
  "sandboxId": "xxx",
  "templateId": "xxx",
  "name": "stdin",
  "metadata": {},
  "envdVersion": "0.4.3",
  "startedAt": "2026-03-19T01:32:28.055Z",
  "endAt": "2026-03-19T01:37:28.055Z",
  "state": "running",
  "cpuCount": 2,
  "memoryMB": 1024
}
```

```
$ e2b sandbox info xxx
Sandbox info for xxx:
Sandbox ID: xxx
Template ID: xxx
Alias: stdin
State: running
Started at: 3/18/2026, 6:32:28 PM
End at: 3/18/2026, 6:37:28 PM
vCPUs: 2
RAM MiB: 1024
Envd version: xxx
metadata: {}
```




<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk: adds a new CLI subcommand and an integration test, with no
changes to existing command behavior or auth flows beyond reusing
`ensureAPIKey`.
> 
> **Overview**
> Adds a new `e2b sandbox info <sandboxID>` subcommand (alias `in`) that
calls `Sandbox.getFullInfo`, supports `--format pretty|json`, and strips
`envdAccessToken` from output.
> 
> Registers the command under `sandbox` and adds a backend integration
test asserting the JSON output includes the correct `sandboxId` and
`state`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7dbe8b7655e5a7ce023644a5cd7b422f1d1fc974. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
@e2b/cli@2.9.0 @e2b/python-sdk@2.17.0 e2b@2.16.0
2026-03-23 14:48:12 -07:00
Matt Brockman 7c8d29839a feat (api): Sandbox info lifecycle network (#1213)
extracts the `allow_internet_access`, `lifecycle`, and `network` configs
to the get info responses from the api when present.

Create a sandbox with lifecycle and network rules, check info while
running, pause it, and check info again. Network rules, lifecycle
config, and `allowInternetAccess` all returned while running and paused

```
$ e2b sandbox info xxx --format json

# running
{
  "sandboxId": "xxx",
  "templateId": "xxx",
  "name": "stdin",
  "metadata": {},
  "allowInternetAccess": true,
  "envdVersion": "0.4.3",
  "startedAt": "2026-03-19T01:39:56.238Z",
  "endAt": "2026-03-19T01:44:56.238Z",
  "state": "running",
  "cpuCount": 2,
  "memoryMB": 1024,
  "network": {
    "allowOut": ["api.example.com", "cdn.example.com"],
    "denyOut": ["0.0.0.0/0"],
    "allowPublicTraffic": true
  },
  "lifecycle": {
    "onTimeout": "pause",
    "autoResume": true
  }
}

# paused
{
  "sandboxId": "xxx",
  "templateId": "xxx",
  "metadata": {},
  "allowInternetAccess": true,
  "envdVersion": "0.4.3",
  "startedAt": "2026-03-19T01:39:56.238Z",
  "endAt": "2026-03-19T01:40:27.964Z",
  "state": "paused",
  "cpuCount": 2,
  "memoryMB": 1024,
  "network": {
    "allowOut": ["api.example.com", "cdn.example.com"],
    "denyOut": ["0.0.0.0/0"],
    "allowPublicTraffic": true
  },
  "lifecycle": {
    "onTimeout": "pause",
    "autoResume": true
  }
}
```



<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Updates the public `sandbox info` response shape across OpenAPI, JS,
and Python SDKs, which may impact downstream consumers that assume the
previous schema. Risk is moderate since changes are additive/optional
but touch generated models and response mapping logic.
> 
> **Overview**
> **Sandbox info responses now include network and lifecycle
configuration when present.** The OpenAPI spec and generated JS schema
extend `SandboxDetail` with `allowInternetAccess`, `network`, and a new
`lifecycle` object (with `SandboxOnTimeout` and `SandboxLifecycle`).
> 
> The JS SDK updates `SandboxApi.getFullInfo()` and exported types to
return these fields, introducing `SandboxInfoLifecycle` for info
responses. The Python SDK updates generated client models accordingly,
adds `SandboxLifecycle`/`SandboxOnTimeout` models, and maps
`SandboxDetail.network`/`SandboxDetail.lifecycle` into `SandboxInfo`
(plus exports `SandboxInfoLifecycle`).
> 
> A changeset bumps `@e2b/python-sdk` and `e2b` as minor for the
expanded info payload.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
adb22292c08b1db9c8fe60c702f83fee2695af97. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
2026-03-23 14:48:02 -07:00
Ben Fornefeld 1c55083de0 Fix: Missing default connection config propagation (#1179)
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> **Medium Risk**
> Changes how instance methods merge and forward connection options (api
key/domain/headers/timeouts) to API calls in both JS and Python SDKs,
which can affect request routing and auth headers. Regression tests
reduce risk but behavior changes could impact callers relying on
previous (incorrect) defaults.
> 
> **Overview**
> Fixes **missing propagation of instance `connectionConfig`** when
calling sandbox instance methods (notably `pause`/`betaPause`/`connect`,
plus related methods) so default config is always forwarded and per-call
overrides still win.
> 
> In the JS SDK this centralizes option merging via a new
`resolveApiOpts()` helper and updates multiple `SandboxApi.*` calls to
use it; in the Python SDK it updates `Sandbox.connect()` and
`Sandbox.pause()` (sync + async) to pass
`self.connection_config.get_api_params(**opts)`.
> 
> Adds regression tests in both SDKs to assert defaults are forwarded
and overrides are applied correctly.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
60aa6ca1c386d99613976269106298267d5dbfbe. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
2026-03-23 18:27:29 +01:00
github-actions[bot] fd7fb51474 [skip ci] Release new versions 2026-03-23 16:11:58 +00:00
Jakub Novák 5a673d15c8 chore: distinguish between Sandbox and file not found (#1231)
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> **Medium Risk**
> Changes public error/exception types in both JS and Python SDKs by
introducing new subclasses and remapping 404/NotFound conditions, which
may affect downstream error handling despite deprecation shims.
> 
> **Overview**
> **Distinguishes “sandbox not found” from “file/directory not found”
across the SDKs.** Adds `FileNotFound*` and `SandboxNotFound*`
error/exception types (with `NotFound*` marked deprecated) and updates
sandbox lifecycle APIs to throw `SandboxNotFound*` for
missing/non-running sandboxes.
> 
> Refactors envd HTTP/RPC error handling in both JS and Python to
support overridable status/code→error maps, and wires filesystem
operations to map 404/`NotFound` into `FileNotFound*`. Tests are updated
accordingly, and patch changesets are added for both packages.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
73da92694c02f71355b1f8625845c82865bf3b1d. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
@e2b/cli@2.8.2 @e2b/python-sdk@2.16.0 e2b@2.15.0
2026-03-23 08:59:29 -07:00
dependabot[bot] 1d8431d0df chore(deps): bump tar from 7.5.9 to 7.5.11 in the npm_and_yarn group across 1 directory (#1208)
Bumps the npm_and_yarn group with 1 update in the / directory:
[tar](https://github.com/isaacs/node-tar).

Updates `tar` from 7.5.9 to 7.5.11
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/isaacs/node-tar/commit/bf776f673164215074b62749e0fe80e5834588f4"><code>bf776f6</code></a>
7.5.11</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad"><code>f48b5fa</code></a>
prevent escaping symlinks with drive-relative paths</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/97cff15d3539a37a4095eb3d287147d9d77c2dc3"><code>97cff15</code></a>
docs: more security info</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/2b72abc1d47c3570e1ad95c9ab557fc4c2e6e4b1"><code>2b72abc</code></a>
7.5.10</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f"><code>7bc755d</code></a>
parse root off paths before sanitizing .. parts</li>
<li><a
href="https://github.com/isaacs/node-tar/commit/c8cb84629dee649feedde03f2f4ea48f2e44e778"><code>c8cb846</code></a>
update deps</li>
<li>See full diff in <a
href="https://github.com/isaacs/node-tar/compare/v7.5.9...v7.5.11">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tar&package-manager=npm_and_yarn&previous-version=7.5.9&new-version=7.5.11)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/e2b-dev/E2B/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-23 09:07:30 +00:00
Mish Ushakov 8abfa627cb fix(cli): use latest Template.build API with name parameter (#1209)
## Summary
- Updates `e2b template init` to generate code using the current
Template.build() API with the `name` parameter
- Replaces deprecated `alias` parameter usage throughout build templates
and generator code
- Maintains support for all languages (TypeScript, Python sync/async)

## Changes
- Renamed `alias` to `name` in generator functions and templates (8
files)
- Updated CLI option description and prompts to reference "template
name" consistently
- Added changeset for patch release

## Testing
All 79 template init tests pass, including validation of generated build
files.

🤖 Generated with Claude Code

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk: changes are limited to CLI template-code generation and
user-facing prompts, primarily a rename from deprecated `alias` to
`name` in generated build/README templates.
> 
> **Overview**
> Updates `e2b template init`/`migrate` code generation to pass a `name`
parameter (and `name-dev` for dev builds) instead of the deprecated
`alias`, across the Handlebars generator APIs and the TypeScript/Python
build and README templates.
> 
> Cleans up CLI UX copy to consistently refer to *template name* (option
help text and interactive prompt), and adds a changeset for a patch
release.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
d6e291df259a62efa4e59244b44ef8b4044d26dd. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
2026-03-20 23:43:21 -07:00
Travis Marceau 0b976beedc docs: update self-hosting cloud provider support wording (#1217)
<!-- CURSOR_AGENT_PR_BODY_BEGIN -->
## Summary
- update the self-hosting cloud provider list in `README.md`
- explicitly mark Google Cloud (GCP) as supported
- align provider list formatting/capitalization (`General Linux
machine`)

## Validation
- `pnpm run format`
- `pnpm run lint`
- `pnpm run typecheck`
- `pnpm run test` *(fails in existing python async tests:
`tests/async/sandbox_async/test_create.py::test_auto_pause_without_auto_resume_requires_connect`
with `AsyncApiClient` missing `raise_on_unexpected_status`)*
<!-- CURSOR_AGENT_PR_BODY_END -->

[Slack
Thread](https://e2b-team.slack.com/archives/C080PPTP2DP/p1773953026690659?thread_ts=1773953026.690659&cid=C080PPTP2DP)

<div><a
href="https://cursor.com/agents/bc-3a9b191f-6491-5746-bf8e-ba09a270b1e1"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-web-light.png"><img
alt="Open in Web" width="114" height="28"
src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a>&nbsp;<a
href="https://cursor.com/background-agent?bcId=bc-3a9b191f-6491-5746-bf8e-ba09a270b1e1"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img
alt="Open in Cursor" width="131" height="28"
src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a>&nbsp;</div>

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
2026-03-19 14:35:33 -07:00
Mish Ushakov ca856201f5 feat(templates): add fixMissing option to aptInstall (#1205)
## Summary
- Added `fixMissing` option to `aptInstall()` in JS SDK
- Added `fix_missing` parameter to `apt_install()` in Python SDK
- Enables `--fix-missing` flag for `apt-get install` command

🤖 Generated with Claude Code

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk: adds an optional flag passthrough to the generated `apt-get
install` command in both SDKs, with no behavior change unless explicitly
enabled.
> 
> **Overview**
> Adds an optional `fixMissing` (JS) / `fix_missing` (Python) parameter
to template `apt` install helpers so callers can emit `apt-get install
--fix-missing` when builds hit transient package download issues.
> 
> Updates the JS type definitions/docs accordingly and includes a
changeset bumping `e2b` and `@e2b/python-sdk` as a minor release.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
4c0b897e192c3ec6b880ab4e3f1695f1b1289d7b. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
2026-03-18 14:21:01 +00:00