From 390f1bae6a100b15a3a0bd04dc60902336d9aefc Mon Sep 17 00:00:00 2001 From: Mish Ushakov <10400064+mishushakov@users.noreply.github.com> Date: Thu, 6 Aug 2026 16:03:42 +0200 Subject: [PATCH 1/2] chore(js-sdk): bump optional `undici8` to 8.10.0 Co-Authored-By: Claude Opus 5 (1M context) --- .changeset/bump-undici8-8-10-0.md | 5 +++++ packages/js-sdk/package.json | 2 +- pnpm-lock.yaml | 10 +++++----- 3 files changed, 11 insertions(+), 6 deletions(-) create mode 100644 .changeset/bump-undici8-8-10-0.md diff --git a/.changeset/bump-undici8-8-10-0.md b/.changeset/bump-undici8-8-10-0.md new file mode 100644 index 0000000000..12f0c2f142 --- /dev/null +++ b/.changeset/bump-undici8-8-10-0.md @@ -0,0 +1,5 @@ +--- +'e2b': patch +--- + +Bump the optional `undici8` dependency (`npm:undici@…`) from 8.8.0 to 8.10.0. The pin stays exact and the Node floor is unchanged — undici 8.10.0 still declares `engines.node >= 22.19.0`, matching the SDK's `UNDICI_8_MIN_NODE` gate, so which package `loadUndici()` picks on a given Node version does not change. diff --git a/packages/js-sdk/package.json b/packages/js-sdk/package.json index 047271a005..9c06203b50 100644 --- a/packages/js-sdk/package.json +++ b/packages/js-sdk/package.json @@ -105,7 +105,7 @@ "undici": "^7.28.0" }, "optionalDependencies": { - "undici8": "npm:undici@8.8.0" + "undici8": "npm:undici@8.10.0" }, "engines": { "node": ">=20.18.1 <21 || >=22" diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 3fed247ffd..4dd12bedea 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -250,8 +250,8 @@ importers: version: 4.113.0(@types/node@20.19.43)(bufferutil@4.0.8)(utf-8-validate@6.0.3) optionalDependencies: undici8: - specifier: npm:undici@8.8.0 - version: undici@8.8.0 + specifier: npm:undici@8.10.0 + version: undici@8.10.0 packages/python-sdk: {} @@ -3757,8 +3757,8 @@ packages: resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==} engines: {node: '>=20.18.1'} - undici@8.8.0: - resolution: {integrity: sha512-ubshXMXwF3MQIMF1y/WxZdNBnjEKeSg2wF5mcGUtU55YTw34tnVVpKRlLf7ruDXZ5344KokPVX4RBx1wJm64Bw==} + undici@8.10.0: + resolution: {integrity: sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ==} engines: {node: '>=22.19.0'} unenv@2.0.0-rc.24: @@ -7316,7 +7316,7 @@ snapshots: undici@7.28.0: {} - undici@8.8.0: + undici@8.10.0: optional: true unenv@2.0.0-rc.24: From 60cd07fec0346eeb75845fab40ed51e60ebb4c93 Mon Sep 17 00:00:00 2001 From: Mish Ushakov <10400064+mishushakov@users.noreply.github.com> Date: Thu, 6 Aug 2026 20:18:44 +0200 Subject: [PATCH 2/2] chore(js-sdk): bump `undici` to ^7.29.0 for the security advisories Covers GHSA-4cwx-7wf7-3272 (High) and four Medium advisories, all patched in 7.29.0. Also overrides the copy miniflare pins exactly at 7.28.0 so the lockfile no longer carries a vulnerable undici 7. Co-Authored-By: Claude Opus 5 (1M context) --- .changeset/bump-undici8-8-10-0.md | 2 +- package.json | 1 + packages/js-sdk/package.json | 2 +- pnpm-lock.yaml | 13 +++++++------ 4 files changed, 10 insertions(+), 8 deletions(-) diff --git a/.changeset/bump-undici8-8-10-0.md b/.changeset/bump-undici8-8-10-0.md index 12f0c2f142..a53c897d2e 100644 --- a/.changeset/bump-undici8-8-10-0.md +++ b/.changeset/bump-undici8-8-10-0.md @@ -2,4 +2,4 @@ 'e2b': patch --- -Bump the optional `undici8` dependency (`npm:undici@…`) from 8.8.0 to 8.10.0. The pin stays exact and the Node floor is unchanged — undici 8.10.0 still declares `engines.node >= 22.19.0`, matching the SDK's `UNDICI_8_MIN_NODE` gate, so which package `loadUndici()` picks on a given Node version does not change. +Bump both undici dependencies past the 2026-07-24 security advisories: the required `undici` from `^7.28.0` to `^7.29.0`, and the optional `undici8` (`npm:undici@…`) from 8.8.0 to 8.10.0. Both releases fix one High ([GHSA-4cwx-7wf7-3272](https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272)) and four Medium advisories, and undici 8.10.0 additionally fixes HTTP/2 request settling, refused-stream retries and GOAWAY handling, which the SDK exercises because every dispatcher it builds sets `allowH2: true`. Neither bump moves a Node floor — 7.29.0 still requires Node `>=20.18.1` and 8.10.0 still requires `>=22.19.0`, matching the `UNDICI_8_MIN_NODE` gate — so package selection and behaviour are unchanged. diff --git a/package.json b/package.json index bf305da6ec..3ad5e09614 100644 --- a/package.json +++ b/package.json @@ -56,6 +56,7 @@ "minimatch@>=5.0.0 <5.1.8": "^5.1.8", "minimatch@>=9.0.0 <9.0.7": "^9.0.7", "minimatch@>=10.0.0 <10.2.3": "^10.2.3", + "undici@>=7.0.0 <7.29.0": "^7.29.0", "ws@>=8.0.0 <8.20.1": "^8.20.1", "shell-quote@<1.9.0": "^1.9.0", "sharp@<0.35.0": "^0.35.0", diff --git a/packages/js-sdk/package.json b/packages/js-sdk/package.json index 9c06203b50..c05137fc16 100644 --- a/packages/js-sdk/package.json +++ b/packages/js-sdk/package.json @@ -102,7 +102,7 @@ "openapi-fetch": "^0.14.1", "platform": "^1.3.6", "tar": "^7.5.19", - "undici": "^7.28.0" + "undici": "^7.29.0" }, "optionalDependencies": { "undici8": "npm:undici@8.10.0" diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 4dd12bedea..0af2554765 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -23,6 +23,7 @@ overrides: minimatch@>=5.0.0 <5.1.8: ^5.1.8 minimatch@>=9.0.0 <9.0.7: ^9.0.7 minimatch@>=10.0.0 <10.2.3: ^10.2.3 + undici@>=7.0.0 <7.29.0: ^7.29.0 ws@>=8.0.0 <8.20.1: ^8.20.1 shell-quote@<1.9.0: ^1.9.0 sharp@<0.35.0: ^0.35.0 @@ -167,8 +168,8 @@ importers: specifier: ^7.5.19 version: 7.5.21 undici: - specifier: ^7.28.0 - version: 7.28.0 + specifier: ^7.29.0 + version: 7.29.0 devDependencies: '@cloudflare/vitest-pool-workers': specifier: ^0.18.7 @@ -3753,8 +3754,8 @@ packages: undici-types@6.21.0: resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==} - undici@7.28.0: - resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==} + undici@7.29.0: + resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==} engines: {node: '>=20.18.1'} undici@8.10.0: @@ -6424,7 +6425,7 @@ snapshots: dependencies: '@cspotcode/source-map-support': 0.8.1 sharp: 0.35.3(@types/node@20.19.43) - undici: 7.28.0 + undici: 7.29.0 workerd: 1.20260721.1 ws: 8.21.0(bufferutil@4.0.8)(utf-8-validate@6.0.3) youch: 4.1.0-beta.10 @@ -7314,7 +7315,7 @@ snapshots: undici-types@6.21.0: {} - undici@7.28.0: {} + undici@7.29.0: {} undici@8.10.0: optional: true