Skip to content

Update dependency jupyterlab to v4 [SECURITY] #48

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update dependency jupyterlab to v4 [SECURITY] #48

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Aug 7, 2024 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
jupyterlab (changelog) ^3.0.0 -> ^4.0.0 age confidence

GitHub Vulnerability Alerts

CVE-2024-22421

Impact

Users of JupyterLab who click on a malicious link may get their Authorization and XSRFToken tokens exposed to a third party when running an older jupyter-server version.

Patches

JupyterLab 4.1.0b2, 4.0.11, and 3.6.7 were patched.

Workarounds

No workaround has been identified, however users should ensure to upgrade jupyter-server to version 2.7.2 or newer which includes a redirect vulnerability fix.

References

Vulnerability reported by user @​davwwwx via the bug bounty program sponsored by the European Commission and hosted on the Intigriti platform.

CVE-2024-43805

Impact

The vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature.

A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user.

Patches

JupyterLab v3.6.8, v4.2.5 and Jupyter Notebook v7.2.2 were patched.

Workarounds

There is no workaround for the underlying DOM Clobbering susceptibility. However, select plugins can be disabled on deployments which cannot update in a timely fashion to minimise the risk. These are:

  • @jupyterlab/mathjax-extension:plugin - users will loose ability to preview mathematical equations
  • @jupyterlab/markdownviewer-extension:plugin - users will loose ability to open Markdown previews
  • @jupyterlab/mathjax2-extension:plugin (if installed with optional jupyterlab-mathjax2 package) - an older version of the mathjax plugin for JupyterLab 4.x

To disable these extensions run:

jupyter labextension disable @​jupyterlab/markdownviewer-extension:plugin
jupyter labextension disable @​jupyterlab/mathjax-extension:plugin
jupyter labextension disable @​jupyterlab/mathjax2-extension:plugin

To confirm that the plugins were disabled run:

jupyter labextension list

References

None

Notes

This change has a potential to break rendering of some markdown. There is a setting in Sanitizer which allows to revert to the previous sanitizer settings (allowNamedProperties).

CVE-2025-59842

Links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the noopener attribute.

This is deemed to have no impact on the default installations. Theoretically users of third-party LaTeX-rendering extensions could find themselves vulnerable to reverse tabnabbing attacks if:

  • links generated by those extensions included target=_blank (no such extensions are known at time of writing) and
  • they were to click on a link generated in LaTeX (typically visibly different from other links).

For consistency with handling on other links, new versions of JupyterLab will enforce noopener and target=_blank on all links generated by typesetters. The former will harden the resilience of JupyterLab to extensions with lack of secure defaults in link rendering, and the latter will improve user experience by preventing accidental state loss when clicking on links rendered by LaTeX typesetters.

Impact

Since the official LaTeX typesetter extensions for JupyterLab: jupyterlab-mathjax (default), jupyterlab-mathjax2 and jupyterlab-katex do not include the target=_blank, there is no impact for JupyterLab users.

Patches

JupyterLab 4.4.8

Workarounds

No workarounds are necessary.

References

None

Release Notes

jupyterlab/jupyterlab (jupyterlab)

v4.4.8

Compare Source

4.4.8

(Full Changelog)

Bugs fixed
Maintenance and upkeep improvements
Documentation improvements
Contributors to this release

(GitHub contributors page for this release)

@​brichet | @​github-actions | @​HaudinFlorence | @​jtpio | @​jupyterlab-probot | @​krassowski | @​martinRenou | @​meeseeksmachine | @​Meriem-BenIsmail | @​williamstein

v4.4.7

Compare Source

4.4.7

(Full Changelog)

Enhancements made
Bugs fixed
Documentation improvements
Contributors to this release

(GitHub contributors page for this release)

@​bollwyvl | @​jtpio | @​jupyterlab-probot | @​krassowski | @​lumberbot-app | @​meeseeksmachine | @​Meriem-BenIsmail

v4.4.6

Compare Source

4.4.6

(Full Changelog)

Bugs fixed
Maintenance and upkeep improvements
Documentation improvements
Contributors to this release

(GitHub contributors page for this release)

@​brichet | @​Darshan808 | @​fcollonval | @​github-actions | @​jtpio | @​jupyterlab-probot | @​krassowski | @​meeseeksmachine | @​Zsailer

v4.4.5

Compare Source

4.4.5

(Full Changelog)

Bugs fixed
Maintenance and upkeep improvements
Documentation improvements
Contributors to this release

(GitHub contributors page for this release)

@​Darshan808 | @​github-actions | @​itsmevichu | @​jtpio | @​jupyterlab-probot | @​kr-2003 | @​krassowski | @​martinRenou | @​meeseeksmachine | @​nkn2022

v4.4.4

Compare Source

4.4.4

(Full Changelog)

Bugs fixed
Maintenance and upkeep improvements
Documentation improvements
Contributors to this release

(GitHub contributors page for this release)

@​github-actions | @​jtpio | @​jupyterlab-probot | @​krassowski | @​lumberbot-app | @​meeseeksmachine

v4.4.3

Compare Source

4.4.3

(Full Changelog)

Bugs fixed
Maintenance and upkeep improvements
Contributors to this release

(GitHub contributors page for this release)

@​github-actions | @​jtpio | @​jupyterlab-probot | @​krassowski | @​meeseeksmachine

v4.4.2

Compare Source

4.4.2

(Full Changelog)

Bugs fixed
Maintenance and upkeep improvements
Documentation improvements
Contributors to this release

(GitHub contributors page for this release)

@​jtpio | @​jupyterlab-probot | @​krassowski | @​meeseeksmachine | @​nkn2022

v4.4.1

Compare Source

(Full Changelog)

Bugs fixed
Maintenance and upkeep improvements
Contributors to this release

(GitHub contributors page for this release)

@​achhina | @​afshin | @​bnavigator | @​brichet | @​Darshan808 | @​davidbrochart | @​DenisaCG | @​dependabot | @​jtpio | @​jupyterlab-probot | @​krassowski | @​pre-commit-ci

v4.4.0

Compare Source

(Full Changelog)

New features added
Enhancements made
Bugs fixed

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/pypi-jupyterlab-vulnerability branch from 91039e7 to 1a19566 Compare August 30, 2024 08:42
@renovate renovate bot changed the title Update dependency jupyterlab to v3.6.7 [SECURITY] Update dependency jupyterlab to v3.6.8 [SECURITY] Aug 30, 2024
@renovate renovate bot force-pushed the renovate/pypi-jupyterlab-vulnerability branch from 1a19566 to fb326fc Compare August 11, 2025 03:40
@renovate renovate bot force-pushed the renovate/pypi-jupyterlab-vulnerability branch from fb326fc to 67eb59c Compare September 27, 2025 07:43
@renovate renovate bot changed the title Update dependency jupyterlab to v3.6.8 [SECURITY] Update dependency jupyterlab to v4 [SECURITY] Sep 27, 2025
@renovate Renovate
Copy link
Contributor Author

renovate bot commented Sep 27, 2025

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: poetry.lock
Creating virtualenv goldnlp-ko74Ig3J-py3.10 in /home/ubuntu/.cache/pypoetry/virtualenvs
Updating dependencies
Resolving dependencies...


The current project's Python requirement (>=3.7.10,<3.11) is not compatible with some of the required packages Python requirement:
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9

Because no versions of jupyterlab match >4.0.0,<4.0.1 || >4.0.1,<4.0.2 || >4.0.2,<4.0.3 || >4.0.3,<4.0.4 || >4.0.4,<4.0.5 || >4.0.5,<4.0.6 || >4.0.6,<4.0.7 || >4.0.7,<4.0.8 || >4.0.8,<4.0.9 || >4.0.9,<4.0.10 || >4.0.10,<4.0.11 || >4.0.11,<4.0.12 || >4.0.12,<4.0.13 || >4.0.13,<4.1.0 || >4.1.0,<4.1.1 || >4.1.1,<4.1.2 || >4.1.2,<4.1.3 || >4.1.3,<4.1.4 || >4.1.4,<4.1.5 || >4.1.5,<4.1.6 || >4.1.6,<4.1.7 || >4.1.7,<4.1.8 || >4.1.8,<4.2.0 || >4.2.0,<4.2.1 || >4.2.1,<4.2.2 || >4.2.2,<4.2.3 || >4.2.3,<4.2.4 || >4.2.4,<4.2.5 || >4.2.5,<4.2.6 || >4.2.6,<4.2.7 || >4.2.7,<4.3.0 || >4.3.0,<4.3.1 || >4.3.1,<4.3.2 || >4.3.2,<4.3.3 || >4.3.3,<4.3.4 || >4.3.4,<4.3.5 || >4.3.5,<4.3.6 || >4.3.6,<4.3.7 || >4.3.7,<4.3.8 || >4.3.8,<4.4.0 || >4.4.0,<4.4.1 || >4.4.1,<4.4.2 || >4.4.2,<4.4.3 || >4.4.3,<4.4.4 || >4.4.4,<4.4.5 || >4.4.5,<4.4.6 || >4.4.6,<4.4.7 || >4.4.7,<4.4.8 || >4.4.8,<4.4.9 || >4.4.9,<5.0.0
 and jupyterlab (4.0.0) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.0.1) requires Python >=3.8
 and jupyterlab (4.0.2) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.0.3) requires Python >=3.8
 and jupyterlab (4.0.4) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.0.5) requires Python >=3.8
 and jupyterlab (4.0.6) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.0.7) requires Python >=3.8
 and jupyterlab (4.0.8) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.0.9) requires Python >=3.8
 and jupyterlab (4.0.10) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.0.11) requires Python >=3.8
 and jupyterlab (4.0.12) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.0.13) requires Python >=3.8
 and jupyterlab (4.1.0) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.1.1) requires Python >=3.8
 and jupyterlab (4.1.2) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.1.3) requires Python >=3.8
 and jupyterlab (4.1.4) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.1.5) requires Python >=3.8
 and jupyterlab (4.1.6) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.1.7) requires Python >=3.8
 and jupyterlab (4.1.8) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.2.0) requires Python >=3.8
 and jupyterlab (4.2.1) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.2.2) requires Python >=3.8
 and jupyterlab (4.2.3) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.2.4) requires Python >=3.8
 and jupyterlab (4.2.5) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.2.6) requires Python >=3.8
 and jupyterlab (4.2.7) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.3.0) requires Python >=3.8
 and jupyterlab (4.3.1) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.3.2) requires Python >=3.8
 and jupyterlab (4.3.3) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.3.4) requires Python >=3.8
 and jupyterlab (4.3.5) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.3.6) requires Python >=3.8
 and jupyterlab (4.3.7) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.3.8) requires Python >=3.8
 and jupyterlab (4.4.0) requires Python >=3.9, jupyterlab is forbidden.
And because jupyterlab (4.4.1) requires Python >=3.9
 and jupyterlab (4.4.2) requires Python >=3.9, jupyterlab is forbidden.
And because jupyterlab (4.4.3) requires Python >=3.9
 and jupyterlab (4.4.4) requires Python >=3.9, jupyterlab is forbidden.
And because jupyterlab (4.4.5) requires Python >=3.9
 and jupyterlab (4.4.6) requires Python >=3.9, jupyterlab is forbidden.
And because jupyterlab (4.4.7) requires Python >=3.9
 and jupyterlab (4.4.8) requires Python >=3.9, jupyterlab is forbidden.
So, because jupyterlab (4.4.9) requires Python >=3.9
 and goldnlp depends on jupyterlab (^4.0.0), version solving failed.

  • Check your dependencies Python requirement: The Python requirement can be specified via the `python` or `markers` properties
    
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"

    https://python-poetry.org/docs/dependency-specification/#python-restricted-dependencies,
    https://python-poetry.org/docs/dependency-specification/#using-environment-markers

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants