Skip to content

chore(deps): bump the npm_and_yarn group across 2 directories with 1 update #2069

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mishushakov merged 2 commits into from
Nov 2, 2026
Merged

chore(deps): bump the npm_and_yarn group across 2 directories with 1 update #2069

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6080605
chore(deps): bump the npm_and_yarn group across 2 directories with 1 …
dependabot[bot] Oct 30, 2026
a08a283
chore: add changeset for glob bump
devin-ai-integration[bot] Oct 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changeset/bump-glob-v14.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
'e2b': patch
---

Update the `glob` dependency to v14.
2 changes: 1 addition & 1 deletion packages/js-sdk/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,7 @@
"@e2b/dockerfile-utils": "workspace:^",
"chalk": "^5.6.2",
"compare-versions": "^6.1.1",
"glob": "^13.0.6",
"glob": "^14.0.2",

@claude claude Bot Oct 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 (optional) No changeset is included, so SDK users get a new major glob in the next e2b release with no release-note mention. That release can change which files Template.copy() picks up and their cache hashes. glob 14 swaps RegExp matching for minimatch 11 Matchers, which the changelog says differ from 13 in some edge cases. getAllFilesInPath (src/template/utils.ts:214, :261) passes the user's src pattern straight to glob(). Fix: add a patch changeset for e2b saying glob moved to 14. It should note that copy() pattern matching may differ in edge cases.

Why this was flagged

The runtime dependency at packages/js-sdk/package.json:96 moves from ^13.0.6 to ^14.0.2, and the diff adds no file under .changeset/. Template builds call getAllFilesInPath (packages/js-sdk/src/template/utils.ts:204). It runs glob(src, { ignore, withFileTypes: true, dot: true, cwd: contextPath }) at :214 and glob(dirPattern, ...) at :261. Both now match through minimatch 11, which by glob's own changelog behaves differently in some edge cases. The matched set feeds the files hash used for cache invalidation and the uploaded tar, so an edge-case pattern could match different files or invalidate the cache after an upgrade. On base, glob 13 / minimatch 10 behaviour is unchanged. CLAUDE.md:6 asks for a changeset when packages/js-sdk's public surface changes. Without one, the shipped dependency and behaviour change are missing from the release notes. The custom IgnoreLike in createIgnoreMatcher (:167-194) shields .dockerignore handling from glob's ignore-option changes, but not the src pattern.

Verification: Severity: nit. The diff changes only packages/js-sdk/package.json:96 ("glob": "^13.0.6" to "glob": "^14.0.2") and pnpm-lock.yaml, adding nothing under .changeset/. getAllFilesInPath passes the user's src pattern unchanged to glob() at packages/js-sdk/src/template/utils.ts:214, so the next e2b release ships glob 14 matching with no changelog entry.

"openapi-fetch": "^0.17.0",
"platform": "^1.3.6",
"tar": "^7.5.22",
Expand Down
Loading
Loading