From 39908bf5b9292565bde5b5d96953c54cb54d40f6 Mon Sep 17 00:00:00 2001 From: Helmut Hoffer von Ankershoffen Date: Thu, 7 May 2026 09:53:46 +0200 Subject: [PATCH] fix(deps): raise jupyter floors for 7 CVEs in jupyter extra [PYSDK-124] MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Raise lower bounds on three packages reachable through the `jupyter` extra so that downstream consumers (`pip install aignostics[jupyter]`, `uvx --with aignostics[jupyter]`) can no longer resolve versions vulnerable to recently disclosed advisories. * `jupyterlab`: `>=4.4.9` → `>=4.5.7` — adds CVE-2026-40171 (High, CVSS 8.4, GHSA-rch3-82jr-f9w9, stored XSS / token theft via CommandLinker), CVE-2026-42266 (High, CVSS 8.8, GHSA-37w4-hwhx-4rc4, extension allowlist bypass), CVE-2026-42557 (High, CVSS 8.6, GHSA-mqcg-5x36-vfcg, arbitrary command execution via crafted HTML buttons). * `notebook`: new floor `>=7.5.6` — adds CVE-2026-40171 (High) and CVE-2026-42557 (High); shipped via Renovate/Dependabot in #614/#616 but the floor was not lifted in `pyproject.toml`. * `jupyter-server`: new floor `>=2.18.0` — adds CVE-2025-61669 (Medium, GHSA-qh7q-6qm3-653w, open redirect via `?next=`), CVE-2026-35397 (High, GHSA-5789-5fc7-67v3, sibling-directory path traversal escape from `root_dir`), CVE-2026-40110 (High, GHSA-24qx-w28j-9m6p, CORS Origin-header bypass via unanchored `re.match`), CVE-2026-40934 (Medium, GHSA-5mrq-x3x5-8v8f, authentication cookie persistence across password rotation). Key reviewer property: every new lower bound is <= the currently locked version in uv.lock (jupyterlab 4.5.7, notebook 7.5.6, jupyter-server 2.18.1). No dependency is upgraded; the diff only records tighter consumer-facing constraints. uv lock produced no version changes — only requires-dist specifier and extras-set metadata updates. make audit and make lint green locally. make test_unit exhibits a pre-existing flake (32 failures in client_cache_test / client_me_retry_test due to tenacity retry logic vs the 10s pytest-timeout) that reproduces identically on main without any of these changes — unrelated to this PR. Resolves PYSDK-124 (Anomaly). Generated by Claude Opus 4.7 (cloud routine pysdk-audit-daily) for helmut@aignostics.com. Co-Authored-By: Claude Opus 4.7 --- pyproject.toml | 8 +++++--- uv.lock | 6 +++++- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index e456a9c7..9a45dcdb 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -153,9 +153,11 @@ jupyter = [ "jupyter>=1.1.1,<2", # Transitive overrides # WARNING: one cannot negate or downgrade a dependency required here. use override-dependencies for that. - "jupyter-core>=5.8.1", # CVE-2025-30167 - "jupyterlab>=4.4.9", # CVE-2025-59842 - "nbconvert>=7.17.1", # CVE-2025-53000 (>=7.17.0, Dependabot #424); CVE-2026-39377, CVE-2026-39378 (>=7.17.1, Dependabot #553) + "jupyter-core>=5.8.1", # CVE-2025-30167 (High) + "jupyterlab>=4.5.7", # CVE-2025-59842 (Low, >=4.4.9); CVE-2026-40171 (High, >=4.5.7, Renovate #616); CVE-2026-42266 (High, >=4.5.7); CVE-2026-42557 (High, >=4.5.7) + "nbconvert>=7.17.1", # CVE-2025-53000 (High, >=7.17.0, Dependabot #424); CVE-2026-39377, CVE-2026-39378 (High, >=7.17.1, Dependabot #553) + "notebook>=7.5.6", # CVE-2026-40171 (High, >=7.5.6, Dependabot #614); CVE-2026-42557 (High, >=7.5.6) + "jupyter-server>=2.18.0", # CVE-2025-61669 (Medium, >=2.18.0, Dependabot #628); CVE-2026-35397 (High, >=2.18.0); CVE-2026-40110 (High, >=2.18.0); CVE-2026-40934 (Medium, >=2.18.0) ] marimo = [ "cloudpathlib>=0.23.0,<1", diff --git a/uv.lock b/uv.lock index f901c5b0..fef10ff2 100644 --- a/uv.lock +++ b/uv.lock @@ -101,8 +101,10 @@ dependencies = [ jupyter = [ { name = "jupyter" }, { name = "jupyter-core" }, + { name = "jupyter-server" }, { name = "jupyterlab" }, { name = "nbconvert" }, + { name = "notebook" }, ] marimo = [ { name = "cloudpathlib" }, @@ -199,7 +201,8 @@ requires-dist = [ { name = "jsonschema", extras = ["format-nongpl"], specifier = ">=4.25.1,<5" }, { name = "jupyter", marker = "extra == 'jupyter'", specifier = ">=1.1.1,<2" }, { name = "jupyter-core", marker = "extra == 'jupyter'", specifier = ">=5.8.1" }, - { name = "jupyterlab", marker = "extra == 'jupyter'", specifier = ">=4.4.9" }, + { name = "jupyter-server", marker = "extra == 'jupyter'", specifier = ">=2.18.0" }, + { name = "jupyterlab", marker = "extra == 'jupyter'", specifier = ">=4.5.7" }, { name = "loguru", specifier = ">=0.7.3,<1" }, { name = "lxml", specifier = ">=6.1.0" }, { name = "lxml-html-clean", specifier = ">=0.4.4" }, @@ -208,6 +211,7 @@ requires-dist = [ { name = "matplotlib", marker = "extra == 'marimo'", specifier = ">=3.10.7,<4" }, { name = "nbconvert", marker = "extra == 'jupyter'", specifier = ">=7.17.1" }, { name = "nicegui", extras = ["native"], specifier = ">=3.11.0,<4" }, + { name = "notebook", marker = "extra == 'jupyter'", specifier = ">=7.5.6" }, { name = "openslide-bin", specifier = ">=4.0.0.10,<5" }, { name = "openslide-python", specifier = ">=1.4.3,<2" }, { name = "packaging", specifier = ">=26,<27" },