fix(deps): resolve all open Dependabot alerts (#1598)

## Summary

Fixes all 8 open [Dependabot
alerts](https://github.com/e2b-dev/E2B/security/dependabot), all in
`pnpm-lock.yaml`:

| Package | Severity | Alerts | Before | After | How |
|---|---|---|---|---|---|
| `@vitest/browser` | critical | #328 | 4.1.8 | 4.1.10 | updated the
vitest family in js-sdk and cli devDeps (4.1.10 peer-requires
`vitest@4.1.10` exactly) |
| `tar` | critical/high/medium ×4 | #324–#327 | 7.5.16 | 7.5.21 | bumped
the js-sdk runtime dep floor to `^7.5.19` + repo-wide override |
| `sharp` | high | #329 | 0.34.5 | 0.35.3 | new override (pinned exactly
by miniflare, dev-only) |
| `shell-quote` | high | #323 | 1.8.4 | 1.10.0 | widened existing
override (dev-only, via npm-run-all) |
| `brace-expansion` | high | #322 | 2.1.0 | 2.1.2 | widened existing
override |

The only runtime-dependency change is `tar` in the js-sdk (used for
template build contexts), so a patch changeset for `e2b` is included.
The CLI bundles the SDK and its dependencies into `dist/index.js`, so
the published CLI also ships the vulnerable `tar` — a patch changeset
for `@e2b/cli` is included to rebundle it. Everything else is dev
tooling or lockfile-only.

## Verification

- `pnpm run lint` and `pnpm run typecheck` pass (the 7 python-sdk ty
diagnostics pre-exist on main)
- js-sdk: unit + connectionConfig (393 passed) and template projects
(132 passed, exercises the new `tar` end-to-end against the real API) on
vitest 4.1.10; `pnpm run build` clean
- js-sdk `test:cf` passes — miniflare/workerd boots with sharp 0.35.3
- cli: full suite green (103 passed) on vitest 4.1.10

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: mishushakov

.changeset/heavy-eyes-tap.md

@@ -0,0 +1,5 @@
+---
+'@e2b/cli': patch
+---
+
+Rebuild the CLI so the bundled `tar` picks up 7.5.19+, fixing the node-tar denial-of-service vulnerabilities (the CLI bundles the SDK and its dependencies into `dist/index.js`)

.changeset/spotty-onions-fix.md

@@ -0,0 +1,5 @@
+---
+'e2b': patch
+---
+
+Bump the minimum `tar` dependency to 7.5.19 to pull in upstream fixes for node-tar denial-of-service vulnerabilities (GHSA advisories covering PAX parsing, negative entry sizes, and unbounded decompression)

package.json

@@ -30,7 +30,7 @@
       "vite@>=6.0.0 <6.4.3": "^6.4.3",
       "lodash@<4.18.0": "^4.18.0",
       "brace-expansion@<1.1.13": "^1.1.13",
-      "brace-expansion@>=2.0.0 <2.0.3": "^2.0.3",
+      "brace-expansion@>=2.0.0 <2.1.2": "^2.1.2",
       "brace-expansion@>=5.0.0 <5.0.6": "^5.0.6",
       "underscore@<1.13.8": "^1.13.8",
       "js-yaml@<3.15.0": "^3.15.0",
@@ -44,7 +44,9 @@
       "minimatch@>=9.0.0 <9.0.7": "^9.0.7",
       "minimatch@>=10.0.0 <10.2.3": "^10.2.3",
       "ws@>=8.0.0 <8.20.1": "^8.20.1",
-      "shell-quote@<1.8.4": "^1.8.4"
+      "shell-quote@<1.9.0": "^1.9.0",
+      "sharp@<0.35.0": "^0.35.0",
+      "tar@<7.5.19": "^7.5.19"
     }
   }
 }

packages/cli/package.json

@@ -55,12 +55,12 @@
     "@types/npmcli__package-json": "^4.0.4",
     "@types/statuses": "^2.0.5",
     "@typescript/native": "npm:typescript@^7.0.2",
-    "@vitest/coverage-v8": "^4.1.0",
+    "@vitest/coverage-v8": "^4.1.10",
     "json2md": "^2.0.1",
     "knip": "^5.43.6",
     "tsdown": "^0.22.3",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.10"
   },
   "files": [
     "dist",

packages/js-sdk/package.json

@@ -53,8 +53,8 @@
     "@types/react-dom": "^19.2.0",
     "@typescript/native": "npm:typescript@^7.0.2",
     "@vitejs/plugin-react": "^4.3.4",
-    "@vitest/browser": "^4.1.0",
-    "@vitest/browser-playwright": "^4.1.0",
+    "@vitest/browser": "^4.1.10",
+    "@vitest/browser-playwright": "^4.1.10",
     "dotenv": "^16.4.5",
     "json-schema-to-typescript": "^15.0.4",
     "knip": "^5.43.6",
@@ -66,7 +66,7 @@
     "react-dom": "^19.2.0",
     "tsdown": "^0.22.3",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
-    "vitest": "^4.1.8",
+    "vitest": "^4.1.10",
     "vitest-browser-react": "^2.2.0",
     "wrangler": "^4.113.0"
   },
@@ -99,7 +99,7 @@
     "glob": "^11.1.0",
     "openapi-fetch": "^0.14.1",
     "platform": "^1.3.6",
-    "tar": "^7.5.16",
+    "tar": "^7.5.19",
     "undici": "^7.28.0"
   },
   "optionalDependencies": {