fix(deps): bump smol-toml override to 1.7.1

[sitole]

Resolves Dependabot alert #382 (CVE-2026-85730, high).

smol-toml is a transitive dev dependency of knip@5.43.6. This PR moves the existing pnpm override from <1.6.1 -> ^1.6.1 to <1.7.1 -> ^1.7.1. The lockfile now resolves smol-toml@1.8.0.

Only pnpm-workspace.yaml and pnpm-lock.yaml change.

[changeset-bot]

⚠️ No Changeset found

Latest commit: a254470

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cursor]

PR Summary

Low Risk
Dependency-only override and lockfile refresh with no application code changes.

Overview
Transitive smol-toml (via knip) was pinned below a version affected by CVE-2026-85730. The pnpm override is raised from ^1.6.1 to ^1.7.1, and the lockfile now resolves smol-toml@1.8.0. Only pnpm-workspace.yaml and pnpm-lock.yaml change.

^{Reviewed by Cursor Bugbot for commit a254470. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

TASTE.md compliance review: this PR only bumps the smol-toml pnpm override (pnpm-workspace.yaml + lockfile) and touches no SDK source, so no TASTE.md principles (API surface, naming, errors, parity, docs) apply. 0 violations.

[github-actions]

Package Artifacts

Built from 757119e. Download artifacts from this workflow run.

JS SDK (e2b@2.49.1-fix-smol-toml-override.0):

npm install ./e2b-2.49.1-fix-smol-toml-override.0.tgz

CLI (@e2b/cli@2.19.1-fix-smol-toml-override.0):

npm install ./e2b-cli-2.19.1-fix-smol-toml-override.0.tgz

Code Interpreter JS SDK (@e2b/code-interpreter@2.8.1-fix-smol-toml-override.0):

npm install ./e2b-code-interpreter-2.8.1-fix-smol-toml-override.0.tgz

Desktop JS SDK (@e2b/desktop@2.4.1-fix-smol-toml-override.0):

npm install ./e2b-desktop-2.4.1-fix-smol-toml-override.0.tgz

Python SDK (e2b==2.49.0+fix.smol.toml.override):

pip install ./e2b-2.49.0+fix.smol.toml.override-py3-none-any.whl

Code Interpreter Python SDK (e2b-code-interpreter==2.10.0+fix.smol.toml.override):

pip install ./e2b_code_interpreter-2.10.0+fix.smol.toml.override-py3-none-any.whl

Desktop Python SDK (e2b-desktop==2.5.0+fix.smol.toml.override):

pip install ./e2b_desktop-2.5.0+fix.smol.toml.override-py3-none-any.whl

[claude]

Looks good, straightforward dependency override bump. Reviewed: pnpm-workspace.yaml's override bump for smol-toml from <1.6.1: ^1.6.1 to <1.7.1: ^1.7.1, and the corresponding pnpm-lock.yaml regeneration (overrides section, integrity hash, and packages/snapshots entries for smol-toml@ 1.8.0, consumed by knip). No source code, package public surfaces, or specs are affected.

Extended reasoning...

Overview

The diff touches exactly two files: pnpm-workspace.yaml and pnpm-lock.yaml. It raises a pnpm dependency override for the transitive dev dependency smol-toml (pulled in via knip) from <1.6.1: ^1.6.1 to <1.7.1: ^1.7.1, which causes the lockfile to resolve smol-toml@ 1.8.0 instead of 1.6.1. The lockfile change is confined to the overrides: block, the package resolution/integrity entry, and the snapshots: entry for the package that depends on it (knip). This is consistent end-to-end and matches the PR's stated intent of bumping a dependency-override range.

Security risks

None identified. This is a version bump of a dev-only transitive dependency (used by knip, a lint/dead-code tool), not runtime/production code. The change does not touch auth, crypto, permissions, or any application logic. If anything, this is a security-motivated fix per the PR description (addressing a dependency advisory), and moving to a newer, presumably patched version reduces risk rather than introducing it.

Level of scrutiny

Low. This is a mechanical, self-contained lockfile/override change with no ambiguity — exactly the class of change (version bumps, config tweaks) that does not need deep human review. I verified the diff directly rather than relying solely on the PR description, and the actual file contents match the stated summary precisely.

Other factors

No SDK package (packages/cli, packages/js-sdk, packages/python-sdk) public surface is touched, so per CLAUDE.md a changeset is not required. No spec/ files are touched, so the Copybara-sync restriction is not implicated. No tests are needed for a pure dependency bump. The bug hunter reported no findings, and I found nothing beyond that on my own read of the diff.