chore: bump smol-toml override to ^1.7.1 for security advisory

[devin-ai-integration]

Summary

Fixes the failing Dependabot security update run on main.

Dependabot could not apply the new smol-toml advisory (affects <= 1.7.0) because smol-toml is only a transitive dep (via knip@5.43.6, which declares ^1.3.1) and the repo's pnpm override still pinned it to the previous advisory's fix version:

| security_update_not_possible | "dependency-name": "smol-toml",
|                              | "latest-resolvable-version": "1.6.1",
|                              | "lowest-non-vulnerable-version": "1.7.1",

Change, following the existing override pattern in pnpm-workspace.yaml:

-  smol-toml@<1.6.1: ^1.6.1
+  smol-toml@<1.7.1: ^1.7.1

Lockfile regenerated (pnpm install --lockfile-only); smol-toml resolves to 1.8.0. pnpm install --frozen-lockfile succeeds and knip (the only consumer) produces identical output before/after.

No changeset: no published package source changed.

Link to Devin session: https://app.devin.ai/sessions/7eb29dfcecb0487ab1cceb9b6033d2ab
Open in Devin Desktop: https://app.devin.ai/desktop/session/7eb29dfcecb0487ab1cceb9b6033d2ab?variant=devin

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[changeset-bot]

⚠️ No Changeset found

Latest commit: bd64afd

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

Package Artifacts

Built from 0c8927f. Download artifacts from this workflow run.

JS SDK (e2b@2.49.1-devin-1789052742-smol-toml-override.0):

npm install ./e2b-2.49.1-devin-1789052742-smol-toml-override.0.tgz

CLI (@e2b/cli@2.19.1-devin-1789052742-smol-toml-override.0):

npm install ./e2b-cli-2.19.1-devin-1789052742-smol-toml-override.0.tgz

Code Interpreter JS SDK (@e2b/code-interpreter@2.8.1-devin-1789052742-smol-toml-override.0):

npm install ./e2b-code-interpreter-2.8.1-devin-1789052742-smol-toml-override.0.tgz

Desktop JS SDK (@e2b/desktop@2.4.1-devin-1789052742-smol-toml-override.0):

npm install ./e2b-desktop-2.4.1-devin-1789052742-smol-toml-override.0.tgz

Python SDK (e2b==2.49.0+devin.1789052742.smol.toml.override):

pip install ./e2b-2.49.0+devin.1789052742.smol.toml.override-py3-none-any.whl

Code Interpreter Python SDK (e2b-code-interpreter==2.10.0+devin.1789052742.smol.toml.override):

pip install ./e2b_code_interpreter-2.10.0+devin.1789052742.smol.toml.override-py3-none-any.whl

Desktop Python SDK (e2b-desktop==2.5.0+devin.1789052742.smol.toml.override):

pip install ./e2b_desktop-2.5.0+devin.1789052742.smol.toml.override-py3-none-any.whl

[devin-ai-integration]

TASTE.md review: no SDK source changed (only the smol-toml pnpm override in pnpm-workspace.yaml and the regenerated lockfile), so no design principles (T-1–T-6x) apply. 0 violations — compliant.

[claude]

Looks good, straightforward dependency-override bump. Checked that the version change in pnpm-workspace.yaml (smol-toml override ^1.6.1 to ^1.7.1) matches the lockfile regeneration exactly, and confirmed the diff touches only these two files with no other unrelated changes.

Extended reasoning...

Overview

The diff is confined to pnpm-workspace.yaml and pnpm-lock.yaml. It raises the pnpm dependency override for the transitive package smol-toml from <1.6.1: ^1.6.1 to <1.7.1: ^1.7.1, following an existing override pattern already present in the file. The lockfile was regenerated accordingly: the resolved smol-toml version moved from 1.6.1 to 1.8.0 with a matching new integrity hash, in both the overrides block and the snapshots section for the package that depends on it (knip).

Security risks

None identified. This change itself is a security fix — it bumps a transitive dependency override to remediate an advisory affecting smol-toml <= 1.7.0. There is no application code, auth, crypto, or permission logic touched.

Level of scrutiny

Low. This is exactly the kind of mechanical, self-contained version bump that CLAUDE.md's approval guidelines call out as approvable without requiring a human look: a config/lockfile change with a single-line diff in the source config and a mirrored lockfile update, no ambiguity, and a clear, verifiable intent (advisory remediation).

Other factors

No changeset is required per CLAUDE.md guidance, since this doesn't change the public surface of packages/cli, js-sdk, or python-sdk — it's a workspace-level override only affecting knip, a dev tool. No spec/ files were touched, so the Copybara-sync rule is not implicated. No SDK code exists in this diff so the JS/Python parity rule doesn't apply. The PR description's claims (advisory fix version numbers, that knip is the sole consumer, that pnpm install --frozen-lockfile succeeds) are consistent with what's visible in the diff itself.