Mish Ushakov
d5a382ed67
Bumps both undici dependencies in the js-sdk past the 2026-07-24 security advisories: the required `undici` from `^7.28.0` to `^7.29.0`, and the optional `undici8` (`npm:undici@…`) from 8.8.0 to 8.10.0. Both releases patch one High ([GHSA-4cwx-7wf7-3272](https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272), cache-control parsing / cross-user disclosure) and four Medium advisories, clearing the open Dependabot alerts for undici; 8.10.0 additionally fixes HTTP/2 request settling, refused-stream retries and GOAWAY handling, which we exercise because every dispatcher the SDK builds sets `allowH2: true`. A root `pnpm.overrides` entry (`undici@>=7.0.0 <7.29.0`) is included because miniflare pins undici at exactly 7.28.0, which would otherwise keep a vulnerable copy in the lockfile; with it, the lockfile carries only 7.29.0 and 8.10.0. No code change was needed and there is no user-facing API change — 7.29.0 still requires Node `>=20.18.1` and 8.10.0 still requires `>=22.19.0`, matching the `UNDICI_8_MIN_NODE` gate in `packages/js-sdk/src/undici.ts`, so `getUndiciPackageCandidates()` picks the same package on the same Node versions. `format`, `lint` and `typecheck` pass, `tests/undici.test.ts` is 9/9, and `test:cf` was run to confirm miniflare still boots on the overridden undici. The remaining vitest projects need `E2B_API_KEY`, which isn't available locally, so they're left to CI. A patch changeset for `e2b` is included. Linear: [SDK-317](https://linear.app/e2b/issue/SDK-317/js-sdk-bump-optional-undici8-dependency-to-8100) --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
67 lines
2.3 KiB
JSON
67 lines
2.3 KiB
JSON
{
|
|
"name": "e2b",
|
|
"private": true,
|
|
"scripts": {
|
|
"version": "pnpm changeset version && pnpm run -r postVersion",
|
|
"publish": "pnpm changeset publish && pnpm run -r postPublish",
|
|
"test": "pnpm test --recursive --if-present",
|
|
"rm-node-modules": "find . -name 'node_modules' -type d -prune -exec rm -rf '{}' +",
|
|
"pnpm-install-hack": "cd packages/js-sdk && sed -i '' 's/\"version\": \".*\"/\"version\": \"9.9.9\"/g' package.json && cd ../.. && pnpm i && git checkout -- packages/js-sdk/package.json",
|
|
"fetch:api-spec": "./scripts/fetch-spec.sh api-spec",
|
|
"fetch:envd-spec": "./scripts/fetch-spec.sh envd-spec",
|
|
"fetch:volume-spec": "./scripts/fetch-spec.sh volume-api-spec",
|
|
"lint": "pnpm --if-present --recursive run lint",
|
|
"typecheck": "pnpm --if-present --recursive run typecheck",
|
|
"format": "pnpm --if-present --recursive run format",
|
|
"changeset": "pnpm dlx @changesets/cli"
|
|
},
|
|
"packageManager": "pnpm@10.34.5",
|
|
"dependencies": {
|
|
"@changesets/read": "^0.6.2"
|
|
},
|
|
"devDependencies": {
|
|
"changeset": "^0.2.6",
|
|
"oxlint": "^1.72.0",
|
|
"prettier": "^3.6.2"
|
|
},
|
|
"engines": {
|
|
"pnpm": ">=10.16.0 <11"
|
|
},
|
|
"pnpm": {
|
|
"onlyBuiltDependencies": [
|
|
"esbuild",
|
|
"workerd"
|
|
],
|
|
"ignoredBuiltDependencies": [
|
|
"bufferutil",
|
|
"msw",
|
|
"utf-8-validate"
|
|
],
|
|
"overrides": {
|
|
"rollup@>=4": ">=4.59.0",
|
|
"postcss@<8.5.10": "^8.5.10",
|
|
"vite@>=6.0.0 <6.4.3": "^6.4.3",
|
|
"lodash@<4.18.0": "^4.18.0",
|
|
"brace-expansion@<1.1.13": "^1.1.13",
|
|
"brace-expansion@>=2.0.0 <2.1.2": "^2.1.2",
|
|
"brace-expansion@>=5.0.0 <5.0.6": "^5.0.6",
|
|
"underscore@<1.13.8": "^1.13.8",
|
|
"js-yaml@<3.15.0": "^3.15.0",
|
|
"js-yaml@>=4.0.0 <4.2.0": "^4.2.0",
|
|
"@babel/core@<7.29.6": "^7.29.6",
|
|
"picomatch@<2.3.2": "^2.3.2",
|
|
"picomatch@>=4.0.0 <4.0.4": "^4.0.4",
|
|
"smol-toml@<1.6.1": "^1.6.1",
|
|
"minimatch@<3.1.3": "^3.1.3",
|
|
"minimatch@>=5.0.0 <5.1.8": "^5.1.8",
|
|
"minimatch@>=9.0.0 <9.0.7": "^9.0.7",
|
|
"minimatch@>=10.0.0 <10.2.3": "^10.2.3",
|
|
"undici@>=7.0.0 <7.29.0": "^7.29.0",
|
|
"ws@>=8.0.0 <8.20.1": "^8.20.1",
|
|
"shell-quote@<1.9.0": "^1.9.0",
|
|
"sharp@<0.35.0": "^0.35.0",
|
|
"tar@<7.5.19": "^7.5.19"
|
|
}
|
|
}
|
|
}
|