cursor[bot]
02ba746e9f
Daily dependency vulnerability audit. `pnpm audit` reported 8 findings across 2 packages (3 distinct advisories, all high), and `pip-audit` reported 1 (medium). All 4 have published patches, and every one is applied here. Both ecosystems now report clean. All findings were cross-referenced against the GitHub Advisory Database via `gh api /advisories/<ghsa>` to confirm severity and first-patched version before bumping. ## Advisories fixed | Severity | CVSS | Advisory | Package | Was | Now | | --- | --- | --- | --- | --- | --- | | High | 7.5 | [CVE-2026-14257](https://github.com/advisories/GHSA-mh99-v99m-4gvg) | `brace-expansion` | 1.1.16 / 2.1.2 / 5.0.7 | 1.1.18 / 2.1.4 / 5.0.9 | | High | 7.5 | [CVE-2026-69152](https://github.com/advisories/GHSA-rgw5-rvv9-x895) | `brace-expansion` | 1.1.16 / 2.1.2 / 5.0.7 | 1.1.18 / 2.1.4 / 5.0.9 | | High | 7.5 | [GHSA-5p4m-2wfm-xmqj](https://github.com/advisories/GHSA-5p4m-2wfm-xmqj) (no CVE assigned) | `js-yaml` | 3.15.0 / 4.3.0 | 3.15.1 / 4.3.1 | | Medium | 5.3 | [CVE-2026-71554](https://github.com/advisories/GHSA-6hr6-w5qg-qmwg) | `h2` | 4.3.0 | 4.4.1 | The two `brace-expansion` CVEs are handled together because the second one bypasses the mitigation added for the first, so only the 1.1.18 / 2.1.4 / 5.0.9 line is safe against both. Note that the existing overrides already covered earlier rounds of these same advisories — they were pinning 1.1.13 / 2.1.2 / 5.0.6 and js-yaml 3.15.0 / 4.2.0, which have since been superseded. ## Why each one matters here **`brace-expansion` (high, DoS).** Reachable through `glob > minimatch > brace-expansion`, and `glob` is a *production* dependency of the published `e2b` JS SDK — so this is the one finding that was not dev-only. Worth noting for reviewers: `glob@13.0.6` requires `minimatch@^10.2.2`, which in turn requires `brace-expansion@^5.0.8`, so a fresh `npm install e2b` already resolves the patched 5.0.9 on its own. No `js-sdk` manifest change is needed and end users were not exposed; the override bump is what keeps this repo's own lockfile and CI off the vulnerable versions. **`js-yaml` (high, quadratic CPU in `!!omap`).** Dev-tooling only, via `@changesets/read > ... > read-yaml-file` and `knip`. **`h2` (medium, duplicate `Host` header / request smuggling).** A production dependency of the Python SDK. Bumping `uv.lock` alone would only fix this repo's dev environment, since `uv.lock` does not constrain downstream installs — so the floor in `pyproject.toml` is raised too, which is what actually prevents a consumer from resolving the vulnerable 4.3.0 or 4.4.0. `h2` 4.4.1 declares `requires_python >=3.10`, matching the SDK's own `requires-python`, so no supported Python version is dropped. This is the only user-facing change in the PR and it carries a `patch` changeset. This one is below the high/critical bar the audit normally acts on, and is included because the remediation is a single in-range floor bump on a dependency that ships to users. ## Changes - `package.json` — retarget the `brace-expansion` and `js-yaml` pnpm overrides at the new patched versions. - `pnpm-lock.yaml`, `packages/python-sdk/uv.lock` — regenerated. - `packages/python-sdk/pyproject.toml` — `h2>=4,<5` becomes `h2>=4.4.1,<5`. - `.changeset/bump-h2-4-4-1.md` — `patch` for `@e2b/python-sdk`. No source code changed; this is dependency metadata only. ## Verification All three audits are clean after the change: ```bash pnpm audit # No known vulnerabilities found pnpm audit --prod # No known vulnerabilities found cd packages/python-sdk && uv run --with pip-audit pip-audit # No known vulnerabilities found ``` `pnpm run format`, `pnpm run lint`, and `pnpm run typecheck` all pass with no diff. Tests: 256 Python unit tests, 101 CLI tests, and 345 JS SDK tests pass. The remaining suites could not run in this environment because no `E2B_API_KEY` was available — every one of those failures is an `AuthenticationError: API key is required` / `E2B_API_KEY must be set` from a live-sandbox integration test, and none is related to this diff. **The credential-gated integration suites should be confirmed green in CI before merge.** ```bash cd packages/python-sdk && uv run pytest tests --ignore=tests/async --ignore=tests/sync --ignore=tests/bugs --ignore=tests/shared -q # 256 passed cd packages/cli && npx vitest run # 101 passed | 8 skipped cd packages/js-sdk && npx vitest run --project unit --project connectionConfig --project template # 345 passed; 267 failures, all missing-API-key ``` ## Note on PR structure The audit task asks for one PR per vulnerability. This run was scoped to a single branch, so all 4 advisories are grouped here. That grouping is also the correct shape for the two `brace-expansion` CVEs, which share one fix and cannot be split. If separate PRs are preferred, the three commits on this branch are already split by advisory group and can be cherry-picked apart. <div><a href="https://cursor.com/agents/bc-c4b46d1f-a426-45b9-9c03-46e5decd398d?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/automations/979f8043-9b01-11f1-ba66-0e7d0216e441"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/view-automation-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/view-automation-light.png"><img alt="View Automation" width="141" height="28" src="https://cursor.com/assets/images/view-automation-dark.png"></picture></a> </div> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Mish Ushakov <mishushakov@users.noreply.github.com>
68 lines
2.3 KiB
JSON
68 lines
2.3 KiB
JSON
{
|
|
"name": "e2b",
|
|
"private": true,
|
|
"scripts": {
|
|
"version": "pnpm changeset version && pnpm run -r postVersion",
|
|
"publish": "pnpm changeset publish && pnpm run -r postPublish",
|
|
"test": "pnpm test --recursive --if-present",
|
|
"rm-node-modules": "find . -name 'node_modules' -type d -prune -exec rm -rf '{}' +",
|
|
"pnpm-install-hack": "cd packages/js-sdk && sed -i '' 's/\"version\": \".*\"/\"version\": \"9.9.9\"/g' package.json && cd ../.. && pnpm i && git checkout -- packages/js-sdk/package.json",
|
|
"fetch:api-spec": "./scripts/fetch-spec.sh api-spec",
|
|
"fetch:envd-spec": "./scripts/fetch-spec.sh envd-spec",
|
|
"fetch:volume-spec": "./scripts/fetch-spec.sh volume-api-spec",
|
|
"lint": "pnpm --if-present --recursive run lint",
|
|
"typecheck": "pnpm --if-present --recursive run typecheck",
|
|
"format": "pnpm --if-present --recursive run format",
|
|
"changeset": "pnpm dlx @changesets/cli"
|
|
},
|
|
"packageManager": "pnpm@10.34.5",
|
|
"dependencies": {
|
|
"@changesets/read": "^0.6.2"
|
|
},
|
|
"devDependencies": {
|
|
"changeset": "^0.2.6",
|
|
"oxlint": "^1.72.0",
|
|
"prettier": "^3.6.2"
|
|
},
|
|
"engines": {
|
|
"pnpm": ">=10.16.0 <11"
|
|
},
|
|
"pnpm": {
|
|
"onlyBuiltDependencies": [
|
|
"esbuild",
|
|
"workerd"
|
|
],
|
|
"ignoredBuiltDependencies": [
|
|
"bufferutil",
|
|
"msw",
|
|
"utf-8-validate"
|
|
],
|
|
"overrides": {
|
|
"rollup@>=4": ">=4.59.0",
|
|
"postcss@<8.5.10": "^8.5.10",
|
|
"vite@>=6.0.0 <6.4.3": "^6.4.3",
|
|
"lodash@<4.18.0": "^4.18.0",
|
|
"brace-expansion@<1.1.18": "^1.1.18",
|
|
"brace-expansion@>=2.0.0 <2.1.4": "^2.1.4",
|
|
"brace-expansion@>=3.0.0 <3.0.6": "^3.0.6",
|
|
"brace-expansion@>=4.0.0 <5.0.9": "^5.0.9",
|
|
"underscore@<1.13.8": "^1.13.8",
|
|
"js-yaml@<3.15.1": "^3.15.1",
|
|
"js-yaml@>=4.0.0 <4.3.1": "^4.3.1",
|
|
"@babel/core@<7.29.6": "^7.29.6",
|
|
"picomatch@<2.3.2": "^2.3.2",
|
|
"picomatch@>=4.0.0 <4.0.4": "^4.0.4",
|
|
"smol-toml@<1.6.1": "^1.6.1",
|
|
"minimatch@<3.1.3": "^3.1.3",
|
|
"minimatch@>=5.0.0 <5.1.8": "^5.1.8",
|
|
"minimatch@>=9.0.0 <9.0.7": "^9.0.7",
|
|
"minimatch@>=10.0.0 <10.2.3": "^10.2.3",
|
|
"undici@>=7.0.0 <7.29.0": "^7.29.0",
|
|
"ws@>=8.0.0 <8.20.1": "^8.20.1",
|
|
"shell-quote@<1.9.0": "^1.9.0",
|
|
"sharp@<0.35.0": "^0.35.0",
|
|
"tar@<7.5.19": "^7.5.19"
|
|
}
|
|
}
|
|
}
|