Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 22, 2025

Bumps the dev-dependencies group with 4 updates in the / directory: @biomejs/biome, turbo, vitest and @types/node.

Updates @biomejs/biome from 1.9.4 to 2.3.10

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.3.10

2.3.10

Patch Changes

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.3.10

Patch Changes

2.3.9

Patch Changes

  • #8232 84c9e08 Thanks @​ruidosujeira! - Added the nursery rule noScriptUrl.

    This rule disallows the use of javascript: URLs, which are considered a form of eval and can pose security risks such as XSS vulnerabilities.

    <a href="javascript:alert('XSS')">Click me</a>
  • #8341 343dc4d Thanks @​arendjr! - Added the nursery rule useAwaitThenable, which enforces that await is only used on Promise values.

    Invalid

    await "value";
    const createValue = () => "value";
    await createValue();

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​biomejs/biome since your current version.


Updates turbo from 2.6.3 to 2.7.1

Release notes

Sourced from turbo's releases.

Turborepo v2.7.1

What's Changed

Docs

Examples

Changelog

New Contributors

Full Changelog: vercel/turborepo@v2.7.0...v2.7.1

Turborepo v2.7.1-canary.0

What's Changed

Docs

Changelog

Full Changelog: vercel/turborepo@v2.7.0...v2.7.1-canary.0

Turborepo v2.7.0

What's Changed

Docs

... (truncated)

Commits
  • 46da9fd publish 2.7.1 to registry
  • ec482bf chore: Format version printing similar to rest of prelude (#11289)
  • 3e0eefb fix: Correct version mismatch causing noUpdateNotifier to fail (#11133)
  • 3a0afcc feat(query): Provide query for external dependencies (#9929)
  • 0136f70 ci: Add timeouts to all jobs (#11288)
  • beda9ed fix: Typo in example with-solid README.md description (#11287)
  • fa7d7ce chore(boundaries): Allow packages to import themselves (#10202)
  • 1848d7d fix: Overly aggressive path checking in microfrontends loading (#11286)
  • e965970 release(turborepo): 2.7.1-canary.0 (#11285)
  • 8e3f9ff fix: Correctly validate workspace root as package (#11284)
  • Additional commits viewable in compare view

Updates vitest from 4.0.8 to 4.0.16

Release notes

Sourced from vitest's releases.

v4.0.16

   🐞 Bug Fixes

    View changes on GitHub

v4.0.15

   🚀 Experimental Features

   🐞 Bug Fixes

    View changes on GitHub

v4.0.14

   🚀 Experimental Features

... (truncated)

Commits
  • b46d744 chore: release v4.0.16
  • 84a3062 fix(browser): string formatting bug when including placeholders in console.lo...
  • f7f6aa8 fix: log deprecated test.poolOptions if it's set (#9226)
  • 568513c fix: allow inlining fully dynamic import (#9137)
  • 5d26b87 fix(experimental): export setupEnvironment for custom pools (#9187)
  • f17eb42 refactor: avoid using isFileServingAllowed from Vite (#9160)
  • 78cfbf9 fix: avoid crashing on process.versions stub (#9174)
  • da0ade2 fix: fix browser mode default testTimeout back to 15 seconds (#9167)
  • eb1abf0 chore: release v4.0.15
  • a68f74e feat(cache): add opt-out on a plugin level, fix internal root cache (#9154)
  • Additional commits viewable in compare view

Updates @types/node from 20.19.27 to 25.0.3

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

zjy365 and others added 30 commits October 23, 2025 10:33
- Add comprehensive TypeScript SDK with modular architecture
- Implement kubeconfig-based authentication for Sealos platform
- Add HTTP connection pooling with health monitoring
- Implement high-performance file operations via HTTP endpoints
- Add WebSocket support for real-time file watching
- Replace CLI scaffolding with enterprise-grade SDK library
- Add comprehensive documentation and usage examples
- Configure dual ESM/CJS build system

🤖 Generated with Claude Code

Co-Authored-By: Claude <[email protected]>
- Transform single-package project to turbo monorepo structure
- Add packages/sdk (TypeScript SDK) and packages/server (Bun HTTP server)
- Replace old CLI tooling with modern Devbox SDK architecture
- Update build system: tsup → turbo + individual package builds
- Migrate from ESLint/Prettier to Biome for consistent formatting
- Switch from Node test runner to Vitest for better performance
- Archive old OpenSpec changes and restructure documentation
- Update project dependencies to support monorepo tooling
- Implement HTTP API + Bun runtime architecture for container communication
- Add comprehensive TypeScript configuration for dual ESM/CJS output
- Set up workspace-level tooling for consistent development experience

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>
This commit establishes enterprise-grade architecture following Cloudflare Sandbox SDK patterns:

BREAKING CHANGES:
- Created @sealos/devbox-shared package as single source of truth for types, errors, and logging
- Restructured TypeScript project with proper project references
- Updated all packages to depend on shared package

Features:
- Error System: 40+ error codes with HTTP status mapping, error contexts, and DevboxError class with TraceID support
- Type System: 50+ shared types covering file operations, process execution, session management, and Devbox lifecycle
- Logger System: Structured logging with TraceID, child loggers, and multiple output formats (JSON/human-readable)

Configuration Improvements:
- Added packages/sdk/tsconfig.json with composite project support
- Simplified root tsconfig.json to use project references instead of scattered paths
- Fixed tsup target version from node18/20 to node22 (matching package.json engines)
- Optimized turbo.json with precise cache inputs/outputs for better cache hit rates
- Created .npmrc with strict engine checks and exact version dependencies
- Enhanced vitest.config.ts with coverage thresholds (80%) and @shared alias
- Updated .gitignore to cover all build artifacts (*.tsbuildinfo, devbox-server-*)

Package Structure:
packages/
├── shared/                    # New: Single source of truth
│   ├── src/errors/           # ErrorCode, ErrorResponse, DevboxError
│   ├── src/types/            # File, Process, Session, Devbox types
│   └── src/logger/           # Logger with TraceID support
├── sdk/                       # Updated: Depends on @sealos/devbox-shared
└── server/                    # Updated: Depends on @sealos/devbox-shared

This architecture update brings the codebase to Cloudflare Sandbox SDK standards with:
- Type consistency across SDK and Server packages
- Standardized error handling with detailed contexts
- Distributed tracing support via TraceID
- Optimized build system with project references
- Production-ready configuration

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>
- Remove bun.lockb from .gitignore
- Add bun.lockb to version control for dependency consistency
- Ensures all environments use identical dependency versions
- Add core server modules (container, middleware, response-builder, router)
- Implement comprehensive test suite for core components
- Update shared types for devbox and session management
- Enhance server.ts with new core architecture
- Update package configurations and TypeScript settings

This commit establishes the foundation for the Bun-based HTTP server
with modular architecture and full test coverage.
✨ New Features:
- Add persistent shell session management (Session, SessionManager)
- Implement session API endpoints (create, execute, list, terminate, update)
- Add health check endpoint
- Add request validation middleware with Zod schemas
- Add process tracking utility for background process management

🔧 Improvements:
- Enhance file handlers with better error handling and logging
- Improve process handlers with structured responses
- Add path validation utilities
- Update server routing with trace logging

📝 Documentation & Testing:
- Add comprehensive API test suite (api-tests.http)
- Add validation schemas for all endpoints
- Update task tracking documents
- Document completed work

🏗️ Architecture:
- Implement modular handler structure
- Add dependency injection container pattern
- Enhance middleware pipeline
- Improve error response formatting
- Fix invalid rule configurations in biome.json
  - Remove noAltText (deprecated)
  - Remove noEval, noNewFunction, noUnsafeNegation from security
  - Fix noGlobalIsNaN -> noGlobalIsNan (case)
  - Remove unsupported typescript top-level config block
- Add Bun global variable to javascript.globals configuration
- Auto-fix code formatting issues
  - Fix import statement sorting
  - Add missing trailing commas
  - Remove inferable type annotations

Lint status:
- @sealos/devbox-shared: ✅ Passed (0 errors)
- @sealos/devbox-sdk: ⚠️ 7 errors, 40 warnings (mainly any type warnings)
- @sealos/devbox-server: ⚠️ 14 errors, 27 warnings (mainly any type warnings)
- Add Bun server testing task (0008)
- Add SDK implementation gap analysis (0009)
- Add SDK phase 1-4 implementation tasks (0010-0013)
- Add devbox API specification (devbox-api.json)
✅ All 5 tasks completed:
- Task 1: Enhanced DevboxSDK.close() for proper resource cleanup
- Task 2: Complete DevboxAPI client with 17+ endpoints
- Task 3: Enhanced DevboxInstance with waitForReady() and path validation
- Task 4: Added caching to ConnectionManager (60s TTL)
- Task 5: ConnectionPool with health checks already complete

🔧 Changes:
- Enhanced waitForReady() with configurable timeout and interval
- Added path validation to prevent directory traversal
- Implemented devbox info caching (reduces API calls by 60%)
- Fixed connection manager to prioritize publicAddress over privateAddress
- Fixed build errors (corrected import paths, exports)

📦 Build:
- ✅ ESM build success (43.54 KB)
- ✅ CJS build success (44.02 KB)
- ✅ No linter errors

📚 Examples:
- Added comprehensive basic-usage.ts example
- Created example documentation

🎯 Next: Phase 2 - Advanced Features (Session, Transfer, WebSocket)
Added detailed project status including:
- Current completion status for BUN Server (Phase 1-3: 100%)
- Current completion status for SDK (Phase 1: 100%)
- Updated task file statuses with completion dates
- Added metrics summary (builds, tests, coverage)
- Prioritized next steps and roadmap
- Listed key achievements and production readiness

Overall project: ~60% complete with core features production-ready

🤖 Generated with Claude Code

Co-Authored-By: Claude <[email protected]>
- Add comprehensive testing framework with TestHelper class
- Implement unit tests for DevboxSDK and DevboxInstance
- Add integration tests for concurrency and workflows
- Add E2E tests for app deployment and file operations
- Implement performance benchmarks using Vitest bench
- Add retry mechanism utility with exponential backoff
- Update monitoring metrics collection
- Add testing documentation (README, TESTING_STATUS, PERFORMANCE)
- Add test setup and teardown automation
- Configure Vitest for testing environment
- Add .env.example for configuration
- Remove deprecated markdown-lint workflow

Changes:
- New: Test framework (setup.ts, *.test.ts, *.bench.ts)
- New: Documentation (TESTING_STATUS.md, PERFORMANCE.md)
- New: Utils (retry.ts)
- Modified: API client and auth modules
- Removed: Deprecated app.test.ts and main.ts

Ref: tasks/0013-task-sdk-phase4-testing-optimization.md
- Add DevboxCreateResponse and DevboxGetResponse type definitions
- Refactor create/get methods to use new response transformation functions
- Update test cases to match new resource format (cpu/memory units)
- Unify runtime type naming (node.js, next.js)
- Code formatting and lint fixes
init support server golang version.
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

refactor: fix architectural separation and update API endpoint

- Remove file operations from DevboxAPI to maintain proper architectural separation
- Update default Devbox API endpoint to https://devbox.usw.sealos.io/v1
- Delete misplaced file operation methods that bypassed connection pooling

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

chore: reorganize documentation files to tasks directory

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

refactor: add mock server support and cleanup test setup

- Add mock server configuration for testing without real Devbox environment
- Update test setup to support both real and mock environments
- Remove outdated examples directory
- Add mock server URL configuration to connection manager
- Update server default port to 9757 for mock server
- Clean up TypeScript configuration formatting

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

delete log
refactor: replace uuid with nanoid for ID generation
style: update JSON field names to snake_case
docs: add API documentation
test: add tests for new sync execution endpoints
Bumps [actions/labeler](https://github.com/actions/labeler) from 5 to 6.
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](actions/labeler@v5...v6)

---
updated-dependencies:
- dependency-name: actions/labeler
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
)

Bumps [actions/stale](https://github.com/actions/stale) from 9.0.0 to 10.1.0.
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](actions/stale@28ca103...5f858e3)

---
updated-dependencies:
- dependency-name: actions/stale
  dependency-version: 10.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
)

Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 4 to 5.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@v4...v5)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
)

Bumps [peter-evans/create-issue-from-file](https://github.com/peter-evans/create-issue-from-file) from 5.0.0 to 6.0.0.
- [Release notes](https://github.com/peter-evans/create-issue-from-file/releases)
- [Commits](peter-evans/create-issue-from-file@24452a7...fca9117)

---
updated-dependencies:
- dependency-name: peter-evans/create-issue-from-file
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
zjy365 and others added 17 commits December 16, 2025 16:05
- Switch from npm to [email protected] to match project configuration
- Update Node.js version from 20.x to 22.x in release workflow
- Add pnpm cache for faster CI builds
- Use --frozen-lockfile for consistent dependencies
- Re-enable auto-trigger for PR and main branch
- Replace 'next lint' with 'biome check' in devbox-docs
- Add lint:fix script for docs package
- Auto-fix formatting issues across all packages with biome
- Fixes the lint error: 'Invalid project directory provided'
- Ensures consistent linting across the monorepo
- Replace Math.pow(k, i) with k ** i in formatBytes method
- Fixes lint error: useExponentiationOperator
- All lint checks now pass with only warnings
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
…alities (#50)

- Added `list_files` handler to list files in a directory with pagination and filtering options.
- Introduced `change_permissions` handler to modify file permissions, supporting recursive changes.
- Implemented `search_files`, `find_in_files`, and `replace_in_files` handlers for file operations based on name and content.
- Created `FileInfo` struct to encapsulate file metadata for responses.
- Updated router to include new file-related endpoints.
- Enhanced path validation to ensure safe access to file system.
- Added comprehensive tests for new functionalities, including permission changes and search operations.

Signed-off-by: zzjin <[email protected]>
* feat: Implement file listing, permission changes, and search functionalities

- Added `list_files` handler to list files in a directory with pagination and filtering options.
- Introduced `change_permissions` handler to modify file permissions, supporting recursive changes.
- Implemented `search_files`, `find_in_files`, and `replace_in_files` handlers for file operations based on name and content.
- Created `FileInfo` struct to encapsulate file metadata for responses.
- Updated router to include new file-related endpoints.
- Enhanced path validation to ensure safe access to file system.
- Added comprehensive tests for new functionalities, including permission changes and search operations.

Signed-off-by: zzjin <[email protected]>

* feat: Add version information and help option to server command

Signed-off-by: zzjin <[email protected]>

---------

Signed-off-by: zzjin <[email protected]>
* revert: remove getPreviewLink method and PortPreviewUrl type

* update ci

* support search and find

* remove test

* update npm token

* update  package

* fix
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Dec 22, 2025
@dependabot dependabot bot requested a review from zjy365 as a code owner December 22, 2025 10:00
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Dec 22, 2025

Labels

The following labels could not be found: automerge. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Dec 22, 2025
zjy365 and others added 4 commits December 23, 2025 14:44
* update ci

* remove test

* update npm token

* fix

* fix(changesets): resolve validation error by linking devbox-sdk and devbox-shared

- Remove devbox-shared from ignore list to allow devbox-sdk publishing
- Add linked configuration to sync versions between devbox-sdk and devbox-shared
- Update NOTES.txt to document the configuration rationale
- devbox-shared remains private and will not be published due to private: true flag

* ci: add typecheck step to CI workflow

- Add typecheck step before build to catch TypeScript errors early
- Keep lint, typecheck, and build steps in CI pipeline
)

* update ci

* remove test

* update npm token

* fix

* ci: add typecheck step to CI workflow

- Add typecheck step before build to catch TypeScript errors early
- Keep lint, typecheck, and build steps in CI pipeline

* feat: parse API URL from kubeconfig instead of environment variable

- Add js-yaml dependency for kubeconfig parsing
- Create kubeconfig parser utility to extract server URL
- Transform kubeconfig server URL: add 'devbox.' prefix and remove port
- Update HTTP manager and API client to use parsed URL
- Remove DEVBOX_API_URL environment variable requirement
- Priority: config.baseUrl > kubeconfig URL > default URL
- Fix URL construction to avoid double slashes

* chore: remove debug logs and update import style

- Comment out debug console.log in API client
- Use node: protocol prefix for built-in module imports

* refactor(test): reorganize test structure and extract common utilities

- Move devbox-sdk-core and devbox-sdk-lifecycle tests to base/ directory
- Extract waitForDevboxReady helper to setup.ts for reuse
- Remove duplicate helper functions from test files
- Add devbox-file-basic.test.ts for basic file operations
- Update TEST_AGENT runtime value in types.ts
- Clean up unused imports

* refactor: add centralized logger utility and replace console logs

- Add logger.ts utility with LOG_LEVEL environment variable support
- Replace console.log with logger.info/error in API and HTTP clients
- Remove console.debug calls from retry utility
- Support INFO, WARN, ERROR log levels (DEBUG not supported)

* update log

* update

* docs: simplify configuration guide and remove outdated env vars

- Update configuration guide to emphasize \`KUBECONFIG\` as the primary requirement.
- Remove outdated references to \`DEVBOX_API_URL\` from examples.
- Simplify SDK initialization examples in API reference.

* update
Bumps the dev-dependencies group with 4 updates in the / directory: [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome), [turbo](https://github.com/vercel/turborepo), [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) and [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node).


Updates `@biomejs/biome` from 1.9.4 to 2.3.10
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/[email protected]/packages/@biomejs/biome)

Updates `turbo` from 2.6.3 to 2.7.1
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.6.3...v2.7.1)

Updates `vitest` from 4.0.8 to 4.0.16
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.16/packages/vitest)

Updates `@types/node` from 20.19.27 to 25.0.3
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.3.10
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: turbo
  dependency-version: 2.7.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: vitest
  dependency-version: 4.0.16
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@types/node"
  dependency-version: 25.0.3
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/dev-dependencies-71baf22118 branch from b6a9549 to b903eae Compare December 26, 2025 06:44
@zzjin zzjin closed this Jan 4, 2026
@zzjin zzjin deleted the dependabot/npm_and_yarn/dev-dependencies-71baf22118 branch January 4, 2026 12:23
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Jan 4, 2026

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants