Mish Ushakov
9ffb104456
## Summary Fixes Dependabot alert [#304](https://github.com/e2b-dev/E2B/security/dependabot/304) (critical, [CVE-2026-9277](https://nvd.nist.gov/vuln/detail/CVE-2026-9277) / [GHSA-w7jw-789q-3m8p](https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p)). `shell-quote` is a transitive dependency (pulled in via `npm-run-all`). Versions `< 1.8.4` are vulnerable to a command-injection issue: `quote()` did not escape line terminators (`\n`, `\r`, U+2028, U+2029) in object `.op` values, allowing content after a newline to execute as a separate shell command. This adds a pnpm override forcing `shell-quote` to `^1.8.4`, consistent with the existing security-override pattern in the root `package.json`. The lockfile now resolves `shell-quote@1.8.4`. ## Changes - `package.json`: add `"shell-quote@<1.8.4": "^1.8.4"` to `pnpm.overrides` - `pnpm-lock.yaml`: regenerated — `shell-quote` 1.8.3 → 1.8.4 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
52 lines
1.8 KiB
JSON
52 lines
1.8 KiB
JSON
{
|
|
"name": "e2b",
|
|
"private": true,
|
|
"scripts": {
|
|
"version": "pnpm changeset version && pnpm run -r postVersion",
|
|
"publish": "pnpm changeset publish && pnpm run -r postPublish",
|
|
"test": "pnpm test --recursive --if-present",
|
|
"rm-node-modules": "find . -name 'node_modules' -type d -prune -exec rm -rf '{}' +",
|
|
"pnpm-install-hack": "cd packages/js-sdk && sed -i '' 's/\"version\": \".*\"/\"version\": \"9.9.9\"/g' package.json && cd ../.. && pnpm i && git checkout -- packages/js-sdk/package.json",
|
|
"lint": "pnpm --if-present --recursive run lint",
|
|
"typecheck": "pnpm --if-present --recursive run typecheck",
|
|
"format": "pnpm --if-present --recursive run format",
|
|
"changeset": "pnpm dlx @changesets/cli"
|
|
},
|
|
"packageManager": "pnpm@9.15.5",
|
|
"dependencies": {
|
|
"@changesets/read": "^0.6.2"
|
|
},
|
|
"devDependencies": {
|
|
"@typescript-eslint/eslint-plugin": "^6.7.2",
|
|
"@typescript-eslint/parser": "^6.7.2",
|
|
"changeset": "^0.2.6",
|
|
"eslint": "^8.57.1",
|
|
"eslint-plugin-unused-imports": "^3.0.0"
|
|
},
|
|
"engines": {
|
|
"pnpm": ">=9.0.0 <10"
|
|
},
|
|
"pnpm": {
|
|
"overrides": {
|
|
"@next/eslint-plugin-next>glob@*": "10.5.0",
|
|
"rollup@>=4": ">=4.59.0",
|
|
"postcss@<8.5.10": "^8.5.10",
|
|
"vite@>=6.0.0 <6.4.2": "^6.4.2",
|
|
"lodash@<4.18.0": "^4.18.0",
|
|
"brace-expansion@>=2.0.0 <2.0.3": "^2.0.3",
|
|
"picomatch@<2.3.2": "^2.3.2",
|
|
"picomatch@>=4.0.0 <4.0.4": "^4.0.4",
|
|
"yaml@>=2.0.0 <2.8.3": "^2.8.3",
|
|
"@tootallnate/once@<3.0.1": "^3.0.1",
|
|
"smol-toml@<1.6.1": "^1.6.1",
|
|
"flatted@<3.4.2": "^3.4.2",
|
|
"minimatch@<3.1.3": "^3.1.3",
|
|
"minimatch@>=5.0.0 <5.1.8": "^5.1.8",
|
|
"minimatch@>=9.0.0 <9.0.7": "^9.0.7",
|
|
"minimatch@>=10.0.0 <10.2.3": "^10.2.3",
|
|
"ws@>=8.0.0 <8.20.1": "^8.20.1",
|
|
"shell-quote@<1.8.4": "^1.8.4"
|
|
}
|
|
}
|
|
}
|