## Summary
Resolves all 31 open [Dependabot
alerts](https://github.com/e2b-dev/e2b/security/dependabot) across the
workspace.
- **npm** — added range-based `pnpm.overrides` to bump vulnerable
transitive deps to their patched versions: postcss, vite, lodash,
brace-expansion, picomatch (2.x + 4.x), yaml, @tootallnate/once,
smol-toml, flatted, and minimatch (3.x/5.x/9.x/10.x).
- **python-sdk** — bumped dev deps in `poetry.lock`: pytest 7.4 → 9.0.3
(with constraint update in `pyproject.toml`), pytest-asyncio 0.23 → 1.3
(required for pytest 9), python-dotenv 1.2.2, pygments 2.20.0, requests
2.33.1, black 26.3.1; removed 4 now-unused `# ty: ignore` directives
that pytest 9's stricter type signatures made obsolete.
## Test plan
- [x] \`pnpm run typecheck\` passes
- [x] \`pnpm run lint\` passes
- [x] \`pnpm run format\` clean
- [x] CLI tests (80/80) and js-sdk/python-sdk unit tests pass;
integration tests not run locally (need \`E2B_API_KEY\`)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
## Summary
- Resolved 43 type diagnostics reported by ty (Astral's Python type
checker)
- Fixed Self type issues on class singletons
- Added explicit type annotations for shadowed attributes
- Replaced None with UNSET for auto-generated API parameters
- Fixed method signature alignment for protocol matching
- Added targeted type: ignore suppressions for pattern-based limitations
All checks pass: ty check, ruff format, ruff check.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Medium Risk**
> Mostly typing/CI changes, but some adjustments affect sandbox
connect/pause overload dispatch and API response/parameter handling
(`UNSET` vs `None`), which could alter edge-case runtime behavior.
>
> **Overview**
> Fixes Python SDK static typing issues for Astral’s `ty` checker and
wires typechecking into CI.
>
> Adds a new `Typecheck` GitHub Action plus workspace `typecheck`
scripts (TS packages via `tsc`, Python SDK via `make typecheck` running
`ty`), and publishes a patch changeset for `@e2b/python-sdk`.
>
> Across the Python SDK, adjusts type annotations and overloads (e.g.,
`Self`/singleton typing, `connect` overloads, optional
`user`/token/domain handling), tightens API model parsing with
`cast`/`Optional` checks and `UNSET` usage, and adds a few targeted `ty`
ignore comments in tests/protocols to silence checker limitations.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
f66402847c40cee7e44e1aaa7caa97e271ba9978. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
---------
Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
<!-- CURSOR_SUMMARY -->
> [!NOTE]
> **Python version floor raised**
>
> - Require `python ^3.10` in `pyproject.toml` and `.tool-versions`;
update `poetry.lock` metadata and deps to remove 3.9-only
packages/markers
> - Update `Makefile` `datamodel-codegen` to `--target-python-version
3.10`
> - Add changeset entry documenting the drop of Python 3.9 support
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
a75633f2d28fe24e9f33d0605c1059aeea219820. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
- Individual tests must complete in less than 5 minutes
- Add a `make test` option that runs tests
- Upgrade poetry to 2.1.1 (the lock file was generated by this version,
so this just matches what we already expect)
Currently, when you provide a simple folder pattern like `folder/` to
copy() it will not check folders contents for changes (only the folder
metadata itself) which leads to stale caches.
This fix appends ** pattern when no pattern is specified for recursive
hash computation.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> Ensure folder COPY patterns hash contents recursively to fix cache
invalidation, adding a shared file-gathering helper, tests, and a Python
glob dependency.
>
> - **Template hashing (JS + Python SDKs)**:
> - Add `getAllFilesForFilesHash`
(`packages/js-sdk/src/template/utils.ts`) and
`get_all_files_for_files_hash`
(`packages/python-sdk/e2b/template/utils.py`) to collect directories and
nested files using glob patterns and ignores.
> - Update `calculateFilesHash`/`calculate_files_hash` to use the new
helpers, hashing recursive paths, metadata, and file contents; handle
symlinks consistently.
> - **Tests**:
> - Add comprehensive tests for recursive matching, ignore patterns,
sorting, empty dirs, symlinks in
`packages/js-sdk/tests/.../getAllFilesForFilesHash.test.ts` and Python
async/sync tests under
`packages/python-sdk/tests/.../test_get_all_files_for_files_hash.py`.
> - **Dependencies**:
> - Add `wcmatch` in `packages/python-sdk/pyproject.toml` for advanced
globbing.
> - **Release**:
> - Patch bump via `.changeset/green-mice-watch.md`.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
d495427d86ad4e4d5a280567baa63df40a3271fb. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
---------
Co-authored-by: Jakub Dobry <jakub.dobry8@gmail.com>
Mish Ushakov