fix(deps): bump smol-toml override to ^1.7.1 (GHSA-7w5x-hrqm-74c2)

[devin-ai-integration]

Summary

Fixes Dependabot alert #382 — smol-toml <= 1.7.0 DoS via malformed TOML (GHSA-7w5x-hrqm-74c2 / CVE-2026-85730).

smol-toml is only a transitive dev dependency (via knip), so this just widens the existing pnpm override in pnpm-workspace.yaml:

-  smol-toml@<1.6.1: ^1.6.1
+  smol-toml@<1.7.1: ^1.7.1

The lockfile now resolves smol-toml@1.8.0. pnpm install --frozen-lockfile and pnpm run check-deps (knip) in packages/js-sdk still run fine. No changeset since no published package sources changed.

Link to Devin session: https://app.devin.ai/sessions/8dc32030056b4aa0b20608f23f3b04d7
Open in Devin Desktop: https://app.devin.ai/desktop/session/8dc32030056b4aa0b20608f23f3b04d7?variant=devin
Requested by: @mishushakov

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[changeset-bot]

⚠️ No Changeset found

Latest commit: 6dfefe4

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[devin-ai-integration]

TASTE.md review: PR only widens the smol-toml pnpm override in pnpm-workspace.yaml and updates pnpm-lock.yaml (transitive dev dep via knip). No SDK surface (API shape, types, errors, config, parity — T-1…T-64) is touched, so nothing applies. 0 violations.

[github-actions]

Package Artifacts

Built from 8f552ff. Download artifacts from this workflow run.

JS SDK (e2b@2.49.1-devin-1789058570-smol-toml-dependabot-382.0):

npm install ./e2b-2.49.1-devin-1789058570-smol-toml-dependabot-382.0.tgz

CLI (@e2b/cli@2.19.1-devin-1789058570-smol-toml-dependabot-382.0):

npm install ./e2b-cli-2.19.1-devin-1789058570-smol-toml-dependabot-382.0.tgz

Code Interpreter JS SDK (@e2b/code-interpreter@2.8.1-devin-1789058570-smol-toml-dependabot-382.0):

npm install ./e2b-code-interpreter-2.8.1-devin-1789058570-smol-toml-dependabot-382.0.tgz

Desktop JS SDK (@e2b/desktop@2.4.1-devin-1789058570-smol-toml-dependabot-382.0):

npm install ./e2b-desktop-2.4.1-devin-1789058570-smol-toml-dependabot-382.0.tgz

Python SDK (e2b==2.49.0+devin.1789058570.smol.toml.dependabot.382):

pip install ./e2b-2.49.0+devin.1789058570.smol.toml.dependabot.382-py3-none-any.whl

Code Interpreter Python SDK (e2b-code-interpreter==2.10.0+devin.1789058570.smol.toml.dependabot.382):

pip install ./e2b_code_interpreter-2.10.0+devin.1789058570.smol.toml.dependabot.382-py3-none-any.whl

Desktop Python SDK (e2b-desktop==2.5.0+devin.1789058570.smol.toml.dependabot.382):

pip install ./e2b_desktop-2.5.0+devin.1789058570.smol.toml.dependabot.382-py3-none-any.whl

[mishushakov]

dupe