build(deps): bump cloudflare/sandbox from 0.12.4-python to 0.12.7-python - #1624
build(deps): bump cloudflare/sandbox from 0.12.4-python to 0.12.7-python#1624dependabot[bot] wants to merge 1 commit into
Conversation
Bumps cloudflare/sandbox from 0.12.4-python to 0.12.7-python. --- updated-dependencies: - dependency-name: cloudflare/sandbox dependency-version: 0.12.7-python dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
push | ee7eed0 | Aug 22 2026, 09:44 PM |
![push-agent[bot]](https://avatars.githubusercontent.com/in/2801157?s=60&v=4){kind=small}
There was a problem hiding this comment.
Dependabot bumps the Cloudflare Sandbox base image from 0.12.4-python to 0.12.7-python. The Dockerfile's own header (lines 4-6) mandates keeping this tag pinned to the @cloudflare/sandbox npm package version in app/package.json, but that package is still 0.12.4 — creating exactly the version mismatch the file warns can 'produce SDK warnings and break features.' Several in-repo references also drift stale.
Review by Push · fugu
| # `engine-strict`, and pnpm exits 0. Do not "fix" it by forcing Node 24 in here. | ||
|
|
||
| FROM docker.io/cloudflare/sandbox:0.12.4-python | ||
| FROM docker.io/cloudflare/sandbox:0.12.7-python |
There was a problem hiding this comment.
WARNING: Version-pin invariant broken. The header at lines 4-6 requires this base image tag to stay pinned to the @cloudflare/sandbox package version in app/package.json, warning that a mismatch "produces SDK warnings and can break features." app/package.json still declares "@cloudflare/sandbox": "0.12.4", so bumping the image to 0.12.7-python alone introduces the mismatch. Bump the npm package to 0.12.7 in the same PR (and mirror in sandbox/app.py per the note at lines 18-20), or hold this Dependabot bump until the SDK is bumped together.
| # `engine-strict`, and pnpm exits 0. Do not "fix" it by forcing Node 24 in here. | ||
|
|
||
| FROM docker.io/cloudflare/sandbox:0.12.4-python | ||
| FROM docker.io/cloudflare/sandbox:0.12.7-python |
There was a problem hiding this comment.
SUGGESTION: Stale self-references left behind: the verification snippets in this same file still cite cloudflare/sandbox:0.12.4-python (lines 25 and 30), and ARCHITECTURE.md line 109 still reads "extends cloudflare/sandbox:0.12.4-python". Update these to 0.12.7 so the docs match the pinned tag.
Bumps cloudflare/sandbox from 0.12.4-python to 0.12.7-python.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)