fix: resolve open Dependabot alerts (js-yaml, brace-expansion, esbuild, pillow)

[mishushakov]

Fixes all 33 open Dependabot alerts.

npm (pnpm-lock.yaml)

Added pnpm overrides (same pattern as #226) and regenerated the lockfile:

• js-yaml@3 → 3.15.0 (quadratic-CPU merge-key DoS, alerts Update dependency e2b #212/Bump electron from 35.7.5 to 39.8.5 in /examples/basic-javascript in the npm_and_yarn group across 1 directory #183)
• js-yaml@4 → 4.3.0 (alerts Update patch-updates #213/Bump electron from 35.7.5 to 39.8.4 in /examples/basic-javascript in the npm_and_yarn group across 1 directory #182)
• brace-expansion@1 → 1.1.16, brace-expansion@2 → 2.1.2 (exponential-expansion DoS, alerts Document customizing the sandbox template #210/Disconnect from fire-and-forget background commands #211)
• esbuild → 0.28.1 (Windows dev-server arbitrary file read, alert Update python Docker tag #170)

pip (poetry.lock)

• Bumped pillow 12.2.0 → 12.3.0 in packages/python-sdk and examples/basic-python (multiple heap OOB write / decompression-bomb / DoS advisories, alerts Bump pytest from 7.4.4 to 9.0.3 in /packages/python-sdk in the pip group across 1 directory #184–Update patch-updates #209). The existing ^12.0.0 constraint already allows it, so only lockfiles changed.

Verification

• pnpm install resolves cleanly; packages/js-sdk builds successfully with esbuild 0.28.1
• poetry update pillow --lock re-resolved only pillow in both lockfiles

🤖 Generated with Claude Code

[cursor]

PR Summary

Low Risk
Dependency-only security bumps with no application logic changes; minor risk from toolchain version shifts (esbuild) in dev/build paths.

Overview
Open Dependabot alerts on transitive npm and Python dependencies are addressed by pinning patched versions and refreshing lockfiles.

Root package.json adds pnpm overrides for js-yaml (merge-key DoS), brace-expansion (exponential expansion DoS), and esbuild (Windows dev-server file read); pnpm-lock.yaml is regenerated so the tree uses those versions (including consolidating esbuild to 0.28.1). pillow is bumped from 12.2.0 to 12.3.0 in packages/python-sdk/poetry.lock and examples/basic-python/poetry.lock for heap OOB, decompression-bomb, and DoS fixes. A changeset records a patch release for @e2b/desktop-python.

^{Reviewed by Cursor Bugbot for commit 00b4cf0. Bugbot is set up for automated code reviews on this repo. Configure here.}