Repository navigation
chore(deps): bump the npm_and_yarn group across 2 directories with 1 update - #2069
Conversation
…update Bumps the npm_and_yarn group with 1 update in the / directory: [glob](https://github.com/isaacs/node-glob). Bumps the npm_and_yarn group with 1 update in the /packages/js-sdk directory: [glob](https://github.com/isaacs/node-glob). Updates `glob` from 13.0.6 to 14.0.2 - [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md) - [Commits](isaacs/node-glob@v13.0.6...v14.0.2) Updates `glob` from 13.0.6 to 14.0.2 - [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md) - [Commits](isaacs/node-glob@v13.0.6...v14.0.2) --- updated-dependencies: - dependency-name: glob dependency-version: 14.0.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: glob dependency-version: 14.0.2 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
the
dependencies
🦋 Changeset detectedLatest commit: a08a283 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
|
I added a The PR bumps |
Package ArtifactsBuilt from 7aadecb. Download artifacts from this workflow run. JS SDK ( npm install ./e2b-dockerfile-utils-0.1.2-dependabot-npm-and-yarn-npm-and-yarn-f99baf4362.0.tgz ./e2b-2.62.1-dependabot-npm-and-yarn-npm-and-yarn-f99baf4362.0.tgzCLI ( npm install ./e2b-cli-2.23.1-dependabot-npm-and-yarn-npm-and-yarn-f99baf4362.0.tgzCode Interpreter JS SDK ( npm install ./e2b-code-interpreter-2.9.1-dependabot-npm-and-yarn-npm-and-yarn-f99baf4362.0.tgzDesktop JS SDK ( npm install ./e2b-desktop-2.5.1-dependabot-npm-and-yarn-npm-and-yarn-f99baf4362.0.tgzPython SDK ( pip install ./e2b_dockerfile_utils-0.1.1+dependabot.npm.and.yarn.npm.and.yarn.f99baf4362-py3-none-any.whl ./e2b-2.62.0+dependabot.npm.and.yarn.npm.and.yarn.f99baf4362-py3-none-any.whlCode Interpreter Python SDK ( pip install ./e2b_code_interpreter-2.11.6+dependabot.npm.and.yarn.npm.and.yarn.f99baf4362-py3-none-any.whlDesktop Python SDK ( pip install ./e2b_desktop-2.7.2+dependabot.npm.and.yarn.npm.and.yarn.f99baf4362-py3-none-any.whl |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
There was a problem hiding this comment.
🔍 Devin Review: 1 flag
Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.
Besides the inline finding, I checked two other things and neither is affected. First, glob 14 changes how string ignore patterns work (patterns starting with / and windowsPathsNoEscape). The SDK doesn't pass strings: it passes its own IgnoreLike object (createIgnoreMatcher in packages/js-sdk/src/template/utils.ts). Second, the SDK requires Node >=22.19.0, which is inside the 18 || 20 || >=22 range that glob 14, minimatch 11 and path-scurry 3 support.
Extended reasoning...
This PR bumps the js-sdk runtime dependency glob from 13 to 14 and regenerates pnpm-lock.yaml. It touches no security-sensitive code. The SDK uses glob only in template file collection, and it builds its own ignore matcher instead of passing glob's string ignore patterns. A finding was already posted inline, so this note only records what else was checked.
| "chalk": "^5.6.2", | ||
| "compare-versions": "^6.1.1", | ||
| "glob": "^13.0.6", | ||
| "glob": "^14.0.2", |
There was a problem hiding this comment.
🟡 (optional) No changeset is included, so SDK users get a new major glob in the next e2b release with no release-note mention. That release can change which files Template.copy() picks up and their cache hashes. glob 14 swaps RegExp matching for minimatch 11 Matchers, which the changelog says differ from 13 in some edge cases. getAllFilesInPath (src/template/utils.ts:214, :261) passes the user's src pattern straight to glob(). Fix: add a patch changeset for e2b saying glob moved to 14. It should note that copy() pattern matching may differ in edge cases.
Why this was flagged
The runtime dependency at packages/js-sdk/package.json:96 moves from ^13.0.6 to ^14.0.2, and the diff adds no file under .changeset/. Template builds call getAllFilesInPath (packages/js-sdk/src/template/utils.ts:204). It runs glob(src, { ignore, withFileTypes: true, dot: true, cwd: contextPath }) at :214 and glob(dirPattern, ...) at :261. Both now match through minimatch 11, which by glob's own changelog behaves differently in some edge cases. The matched set feeds the files hash used for cache invalidation and the uploaded tar, so an edge-case pattern could match different files or invalidate the cache after an upgrade. On base, glob 13 / minimatch 10 behaviour is unchanged. CLAUDE.md:6 asks for a changeset when packages/js-sdk's public surface changes. Without one, the shipped dependency and behaviour change are missing from the release notes. The custom IgnoreLike in createIgnoreMatcher (:167-194) shields .dockerignore handling from glob's ignore-option changes, but not the src pattern.
Verification: Severity: nit. The diff changes only packages/js-sdk/package.json:96 ("glob": "^13.0.6" to "glob": "^14.0.2") and pnpm-lock.yaml, adding nothing under .changeset/. getAllFilesInPath passes the user's src pattern unchanged to glob() at packages/js-sdk/src/template/utils.ts:214, so the next e2b release ships glob 14 matching with no changelog entry.
Bumps the npm_and_yarn group with 1 update in the / directory: glob.
Bumps the npm_and_yarn group with 1 update in the /packages/js-sdk directory: glob.
Updates
globfrom 13.0.6 to 14.0.2Changelog
Sourced from glob's changelog.
... (truncated)
Commits
93957bf14.0.24682e8cfix: do not continue walking after signal abort668a66914.0.16ff2314allow const/readonly string[] for ignore, patternsbbe1e5d14.0.0d9586aduse actual published deps, not symlinks8b16637handle long unc forms5bcdc65extglobs cannot contain /d8b40c2handle root in platform-independent way, for ignores and patterns7d1c45aadd native fs glob test (todo on failure)Updates
globfrom 13.0.6 to 14.0.2Changelog
Sourced from glob's changelog.
... (truncated)
Commits
93957bf14.0.24682e8cfix: do not continue walking after signal abort668a66914.0.16ff2314allow const/readonly string[] for ignore, patternsbbe1e5d14.0.0d9586aduse actual published deps, not symlinks8b16637handle long unc forms5bcdc65extglobs cannot contain /d8b40c2handle root in platform-independent way, for ignores and patterns7d1c45aadd native fs glob test (todo on failure)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.