sandbox@3.2.2

Patch Changes

• Bump ws from ^8.18.3 to ^8.21.0 to address CVE-2026-48779, a high-severity memory exhaustion DoS triggered by a high volume of tiny fragments and data chunks. (#228)

sandbox@3.2.1

Patch Changes

• Fix scope inference failing with a raw Zod validation error. Teams missing updatedAt are now kept and malformed team entries are skipped. The CLI also no longer leaks raw validation details when scope can't be determined, showing a friendly hint instead. OAuth response parse failures are masked the same way. (#225)

• Prettify timeout and API errors. Unknown errors print a single line; set DEBUG=sandbox:errors to see the full stack. (#226)

• Updated dependencies [d57891c7552f872a0ce659b4b55aaa8d85415a2f]:

  • @vercel/sandbox@2.2.1

@vercel/sandbox@2.2.1

Patch Changes

• Fix scope inference failing with a raw Zod validation error. Teams missing updatedAt are now kept and malformed team entries are skipped. The CLI also no longer leaks raw validation details when scope can't be determined, showing a friendly hint instead. OAuth response parse failures are masked the same way. (#225)

sandbox@3.2.0

Minor Changes

• Move the interactive shell server out of the sandbox and into the sandbox-controller. sandbox connect/ssh (CLI) and the new Sandbox.openInteractive() (SDK) now request a WebSocket URL and token from the API and connect to the controller-hosted PTY, instead of installing and bootstrapping the vc-interactive-server binary inside the sandbox at connect time. This removes the bundled server binary along with the @vercel/pty-tunnel and @vercel/pty-tunnel-server packages. (#222)

Patch Changes

• Updated dependencies [4b8970d53239f50384063ddd8690ff0091f5eaa0, b37dcabfa323a1a8a13c5479dce8c28dcdbce7f4]:
  • @vercel/sandbox@2.2.0

@vercel/sandbox@2.2.0

Minor Changes

• Move the interactive shell server out of the sandbox and into the sandbox-controller. sandbox connect/ssh (CLI) and the new Sandbox.openInteractive() (SDK) now request a WebSocket URL and token from the API and connect to the controller-hosted PTY, instead of installing and bootstrapping the vc-interactive-server binary inside the sandbox at connect time. This removes the bundled server binary along with the @vercel/pty-tunnel and @vercel/pty-tunnel-server packages. (#222)

Patch Changes

• Upgrade Zod to v4 and update validators for Zod 4 compatibility. (#219)

sandbox@3.2.0-beta.0

Minor Changes

• Add support for drives via a new Drive class and CLI commands. (#196)

Patch Changes

• Updated dependencies [d51a1b7cd19de15018dab2140cbc08ba646c9e2f]:
  • @vercel/sandbox@2.2.0-beta.0

@vercel/sandbox@2.2.0-beta.0

Minor Changes

• Add support for drives via a new Drive class and CLI commands. (#196)

sandbox@3.1.2

Patch Changes

• Update Undici version to fix incompatibility with Node.js 26 (#220)

• Updated dependencies [3ba842a5d029177b11a619f3ae6c5b4b0dd8b215]:

  • @vercel/sandbox@2.1.1

@vercel/sandbox@2.1.1

Patch Changes

• Update Undici version to fix incompatibility with Node.js 26 (#220)

sandbox@3.1.1

Patch Changes

• Fix sandbox connect hanging or failing on a stopped/resumed sandbox. The interactive shell now surfaces attach() failures instead of swallowing them once the connection handshake lands, always stops the spinner on teardown (so a failure can no longer hang the process), and includes the in-sandbox server's stderr when the interactive server exits early. The in-sandbox vc-interactive-server also health-checks a reused server before trusting a leftover config file, so a stale /tmp/vercel/interactive/config.json restored from a snapshot no longer causes it to connect to a dead socket. (#215)