chore(deps): patch and minor dependency updates across SDK packages (#1765)

## Summary

Routine dependency refresh for `packages/js-sdk`, `packages/cli` and
`packages/python-sdk`. Two commits, split by risk: patch bumps, then
minor bumps. No majors are included — every version picked was published
at least 7 days ago (as of 2026-08-24), so freshly-cut releases are
deliberately left out.

Verified with `pnpm run format`, `pnpm run lint`, `pnpm run typecheck`,
`pnpm --filter @e2b/cli test`, js-sdk `vitest --project unit --project
connectionConfig --project template`, the offline python-sdk tests
(`pytest tests --ignore=tests/async --ignore=tests/sync`, 464 passed)
and both `pnpm build`s.

**Patch** (`9ab1412`) — JS: `@types/inquirer`, `@types/statuses`,
`@types/react`, `@types/react-dom`, `react`, `react-dom`, `json2md`,
`statuses`, `tar` 7.5.22, `tsdown` 0.22.14. Python: `packaging` 26.3,
`wcmatch` 11.0.1, `python-dotenv` 1.2.3 (`uv.lock` only — declared
constraints unchanged).

**Minor** (`76b5518`) — `@bufbuild/protobuf` 2.14.0,
`@testing-library/react` 16.3.2, `async-listen` 3.1.0, `msw` 2.15.0,
`openapi-typescript` 7.13.0, `oxlint` 1.78.0, `playwright` 1.62.1, `yup`
1.7.1, `wrangler` 4.123.0, `@redocly/cli` 2.46.1. `@redocly/cli` is
pinned in two places, so `codegen.Dockerfile` moves with the js-sdk
devDependency to keep local codegen matching CI.

A changeset covers `e2b` and `@e2b/cli` since their published runtime
dependency ranges changed.

### Deliberately skipped

Held back as too new (< 7 days old at time of writing), not because of
any known breakage:
`vitest` / `@vitest/*` 4.1.11, `oxlint` 1.79.0, `@redocly/cli` 2.46.2,
`wrangler` 4.125.0, `@cloudflare/vitest-pool-workers` 0.22.0, `inquirer`
14.1.0, `@inquirer/prompts` 8.6.0, `@changesets/cli` 3.0.1,
`@vitejs/plugin-react` 6.1.0 — the next run should pick these up.

`prettier` 3.9.6 is also excluded even though it is old enough: it
reformats `extends`/union clauses and would rewrite ~6 unrelated SDK
source files. That belongs in its own format-only PR, not mixed into a
dependency bump.

### Follow-ups (need code changes / decisions)

- `chalk` 6, `commander` 15, `boxen` 8, `@npmcli/package-json` 8,
`inquirer` 14 + `@inquirer/prompts` 8 — CLI-facing majors; ESM/API
surface changes to work through.
- `undici` 8 (js-sdk runtime dep) — the repo already carries `undici8`
as an optional dependency, so promoting it is a deliberate transport
decision, not a bump.
- `@types/node` 26 vs. the `engines` floor of Node 20; `knip` 6,
`openapi-fetch` 0.17, `@changesets/cli` 3, `@changesets/read` 1.
- Python: `ruff` 0.16 (currently `<0.12`), `ty` 0.0.74 (currently pinned
`0.0.15`), `protobuf-py` 0.3 — the last one must move in lockstep with
the `protoc-gen-py` codegen pin.
- `@types/handlebars` is deprecated (handlebars ships its own types);
the CLI devDependency can likely just be dropped.

### Not verified here

Two js-sdk integration tests failed against this account and are
unrelated to the bumps: `tests/sandbox/network.test.ts` needs an
`httpbin` template that does not exist in the test org (`404: template
'httpbin' not found`, fails identically on a clean tree), and
`tests/sandbox/git/config.test.ts` failed once with `[unknown]
terminated` and passed on rerun.


Link to Devin session:
https://app.devin.ai/sessions/3f9ed63a7b1e44af886dea8f2178b844

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Author: devin-ai-integration[bot]

.changeset/dependency-updates.md

@@ -0,0 +1,6 @@
+---
+'@e2b/cli': patch
+'e2b': patch
+---
+
+Update runtime dependencies: `tar` 7.5.22 and `@bufbuild/protobuf` 2.14.0 in the JS SDK, `statuses` 2.0.2, `async-listen` 3.1.0 and `yup` 1.7.1 in the CLI. No behavior change.

codegen.Dockerfile

@@ -42,6 +42,6 @@ RUN npm install -g \
     pnpm@${PNPM_VERSION} \
     @connectrpc/protoc-gen-connect-es@1.6.1 \
     @bufbuild/protoc-gen-es@2.6.2 \
-    @redocly/cli@2.39.0
+    @redocly/cli@2.46.1
 
 CMD ["make", "generate"]

package.json

@@ -21,7 +21,7 @@
   },
   "devDependencies": {
     "@changesets/cli": "2.31.1",
-    "oxlint": "^1.72.0",
+    "oxlint": "^1.78.0",
     "prettier": "^3.6.2"
   },
   "engines": {

packages/cli/package.json

@@ -49,16 +49,16 @@
   },
   "devDependencies": {
     "@types/handlebars": "^4.1.0",
-    "@types/inquirer": "^9.0.7",
+    "@types/inquirer": "^9.0.10",
     "@types/json2md": "^1.5.4",
     "@types/node": "^20.19.19",
     "@types/npmcli__package-json": "^4.0.4",
-    "@types/statuses": "^2.0.5",
+    "@types/statuses": "^2.0.6",
     "@typescript/native": "npm:typescript@^7.0.2",
     "@vitest/coverage-v8": "^4.1.10",
-    "json2md": "^2.0.1",
+    "json2md": "^2.0.3",
     "knip": "^5.43.6",
-    "tsdown": "^0.22.3",
+    "tsdown": "^0.22.14",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vitest": "^4.1.10"
   },
@@ -75,7 +75,7 @@
     "@iarna/toml": "^2.2.5",
     "@inquirer/prompts": "^7.9.0",
     "@npmcli/package-json": "^7.0.5",
-    "async-listen": "^3.0.1",
+    "async-listen": "^3.1.0",
     "boxen": "^7.1.1",
     "chalk": "^5.3.0",
     "cli-highlight": "^2.1.11",
@@ -85,8 +85,8 @@
     "inquirer": "^12.10.0",
     "simple-update-notifier": "^2.0.0",
     "simple-wcswidth": "^1.1.2",
-    "statuses": "^2.0.1",
-    "yup": "^1.3.2"
+    "statuses": "^2.0.2",
+    "yup": "^1.7.1"
   },
   "engines": {
     "node": ">=20.18.1 <21 || >=22.9.0"

packages/js-sdk/package.json

@@ -46,12 +46,12 @@
   },
   "devDependencies": {
     "@cloudflare/vitest-pool-workers": "^0.18.7",
-    "@redocly/cli": "2.39.0",
-    "@testing-library/react": "^16.2.0",
+    "@redocly/cli": "2.46.1",
+    "@testing-library/react": "^16.3.2",
     "@types/node": "^20.19.19",
     "@types/platform": "^1.3.6",
-    "@types/react": "^19.2.0",
-    "@types/react-dom": "^19.2.0",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.4",
     "@typescript/native": "npm:typescript@^7.0.2",
     "@vitejs/plugin-react": "^4.3.4",
     "@vitest/browser": "^4.1.10",
@@ -60,17 +60,17 @@
     "error-stack-parser-es": "^2.0.1",
     "json-schema-to-typescript": "^15.0.4",
     "knip": "^5.43.6",
-    "msw": "^2.12.10",
+    "msw": "^2.15.0",
     "npm-run-all": "^4.1.5",
-    "openapi-typescript": "^7.9.1",
-    "playwright": "^1.55.1",
-    "react": "^19.2.0",
-    "react-dom": "^19.2.0",
-    "tsdown": "^0.22.3",
+    "openapi-typescript": "^7.13.0",
+    "playwright": "^1.62.1",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
+    "tsdown": "^0.22.14",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vitest": "^4.1.10",
     "vitest-browser-react": "^2.2.0",
-    "wrangler": "^4.113.0"
+    "wrangler": "^4.123.0"
   },
   "files": [
     "dist",
@@ -92,7 +92,7 @@
     "typescript"
   ],
   "dependencies": {
-    "@bufbuild/protobuf": "^2.12.1",
+    "@bufbuild/protobuf": "^2.14.0",
     "@connectrpc/connect": "^2.1.2",
     "@connectrpc/connect-web": "^2.1.2",
     "chalk": "^5.3.0",
@@ -101,7 +101,7 @@
     "glob": "^13.0.6",
     "openapi-fetch": "^0.14.1",
     "platform": "^1.3.6",
-    "tar": "^7.5.19",
+    "tar": "^7.5.22",
     "undici": "^7.29.0"
   },
   "optionalDependencies": {