jupyterlab (4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-4) unstable; urgency=high [ Alexandre Detiste ] * Salsa CI: test the nocheck profile [ Xavier Guimard ] * Declare compliance with policy 4.7.4 * Drop "Rules-Requires-Root: no" * Drop "Priority: optional" * Fix build with typescript 6 [ Bastien Roucariès ] * Security fixes (Closes: #1144343) * Fix CVE-2026-67338: Jupyterlab contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the JupyterLab origin when users click the extension name. * Fix CVE-2026-73415: In packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server * Fix CVE-2026-73416: jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, JupyterLab's PyPI extension manager enforces blocked_extensions_uris by comparing requested install names to blocklist entries with custom normalization that is weaker than PyPI package-name canonicalization. An authenticated user can request a PyPI-equivalent spelling such as JupyterLab.Git for a blocklisted package such as jupyterlab-git, and JupyterLab accepts the install request even though pip resolves the variant to the same package. Security impact requires an allowlist or blocklist intended to restrict package installation, the PyPI Extension Manager, and kernels and terminals that are disabled or delegated to remote hosts. The bypass lets an authenticated user install a prohibited extension, defeat integrity restrictions, and affect availability without gaining new read access. * Fix CVE-2026-73417: JupyterLab allows notebook settings to be shared and applied through an overrides.json file using the Import button in the Settings Editor. In packages/notebook-extension/schema/tracker.json and packages/notebook-extension/src/index.ts, the sideBySideLeftMarginOverride and sideBySideRightMarginOverride settings are not properly validated before being inserted into style content, allowing a crafted settings file to contain instructions that execute as code instead of only changing display preferences. A user can import the malicious file, or an attacker with access to a shared settings location can plant an overrides.json that is applied automatically. The embedded code runs with the affected user's access and can read or modify notebooks and files and run code through the notebook server, including on a connected kernel. * Fix CVE-2026-73626: A missing 'await' caused the is_install_allowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install(). The stock JupyterLab HTTP API and Extension Manager UI are not affected, as they perform a separate, correctly awaited check. * Fix CVE-2026-73627: A plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or disabling plugins that were locked, including child plugins of multi-plugin extensions and plugins locked via the 'lock all' mechanism. -- Bastien Roucariès Sun, 16 Aug 2026 13:18:21 +0200 jupyterlab (4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3) unstable; urgency=medium * Upload to unstable * Do not run slow test on slow arch * Fix CVE-2026-40171: Command linker attributes chained with help command enable one-click authentication token theft * Fix CVE-2026-42266: JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request * Fix CVE-2026-42557: Command linker attributes in HTML enable one-click command execution from untrusted content -- Bastien Roucariès Tue, 28 Jul 2026 10:11:40 +0200 jupyterlab (4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-2) experimental; urgency=medium * Increase timeout for test -- Bastien Roucariès Wed, 22 Jul 2026 23:41:17 +0200 jupyterlab (4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-1) experimental; urgency=medium * New upstream release * Fix CVE-2026-40171: Command linker attributes chained with help command enable one-click authentication token theft * Fix CVE-2026-42266: JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request * Fix CVE-2026-42557: Command linker attributes in HTML enable one-click command execution from untrusted content -- Bastien Roucariès Tue, 21 Jul 2026 18:57:10 +0200 jupyterlab (4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4-1) experimental; urgency=medium * New upstream release * Fix CVE-2025-59842: Links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the noopener attribute. (Closes: #1118967) -- Bastien Roucariès Mon, 20 Jul 2026 13:43:19 +0200 jupyterlab (4.4.1+ds1+~3.0.5+~0.16.6+~cs1.4.4-1) experimental; urgency=medium * New upstream release -- Bastien Roucariès Sun, 12 Jul 2026 02:29:30 +0200 jupyterlab (4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-8) unstable; urgency=medium * Avoid some test on slow architecture -- Bastien Roucariès Fri, 24 Jul 2026 13:28:36 +0200 jupyterlab (4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-7) unstable; urgency=high * Increase timeout for individual test fixing autopkgtest on slow architecture. -- Bastien Roucariès Wed, 22 Jul 2026 22:15:12 +0200 jupyterlab (4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-6) unstable; urgency=high * Increase timeout for individual test fixing FTBFS -- Bastien Roucariès Mon, 20 Jul 2026 10:51:23 +0200 jupyterlab (4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-5) unstable; urgency=high * Increase timeout for slow architecture -- Bastien Roucariès Sun, 19 Jul 2026 17:14:06 +0200 jupyterlab (4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-4) unstable; urgency=medium * Use xterm > 5.5.0 -- Bastien Roucariès Thu, 09 Jul 2026 10:52:30 +0200 jupyterlab (4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-3) unstable; urgency=medium * Add autopkgtest for @jupyterlab packages -- Bastien Roucariès Fri, 26 Jun 2026 14:21:35 +0200 jupyterlab (4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-2) unstable; urgency=medium * Add more test * Fix marked and python httpx breakage -- Bastien Roucariès Wed, 24 Jun 2026 11:17:33 +0200 jupyterlab (4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-1) unstable; urgency=medium * New upstream version * Upload to unstable -- Bastien Roucariès Tue, 16 Jun 2026 23:04:22 +0200 jupyterlab (4.1.3+ds1+~2.0.1+~0.15.3+~cs1.4.4-1) experimental; urgency=medium * New upstream version * Add component jupyter-ui-toolkit -- Bastien Roucariès Mon, 01 Jun 2026 11:39:31 +0200 jupyterlab (4.0.13+ds1+~2.0.1+~cs1.4.4-1) unstable; urgency=medium * New upstream version -- Bastien Roucariès Mon, 01 Jun 2026 11:07:02 +0200 jupyterlab (4.0.11+ds5+~cs11.25.27-1) unstable; urgency=medium * Remove systeminformation -- Bastien Roucariès Wed, 27 May 2026 00:28:57 +0200 jupyterlab (4.0.11+ds4+~cs11.25.27-4) unstable; urgency=high * Fix a transition bug and conflict bug for systeminformation -- Bastien Roucariès Tue, 26 May 2026 11:43:18 +0200 jupyterlab (4.0.11+ds4+~cs11.25.27-3) unstable; urgency=high * Sourcefull build -- Bastien Roucariès Tue, 26 May 2026 08:44:33 +0200 jupyterlab (4.0.11+ds4+~cs11.25.27-2) unstable; urgency=medium * Binary upload for fixing breakage with systeminfomation * Manually install systeminformation under galata -- Bastien Roucariès Mon, 25 May 2026 21:39:26 +0200 jupyterlab (4.0.11+ds4+~cs11.25.27-1) unstable; urgency=medium * Embed temporary systeminformation to break build loop -- Bastien Roucariès Mon, 25 May 2026 18:59:24 +0200 jupyterlab (4.0.11+ds3+~cs11.25.27-1) unstable; urgency=medium * Team upload * Deembed systeminformation -- Bastien Roucariès Mon, 25 May 2026 13:07:11 +0200 jupyterlab (4.0.11+ds2+~cs11.25.27-3) unstable; urgency=medium * Team upload * Fix multiple FTBFS * Bug fix: "FTBFS: error TS2345", thanks to Santiago Vila (Closes: #1131655). * Bug fix: "Please fix Maintainer field email address to avoid future confusion", thanks to Jérémy Lal (Closes: #1109823). * Bug fix: "control Vcs-Browser please update link", thanks to onders (Closes: #1130626). -- Bastien Roucariès Fri, 22 May 2026 15:23:23 +0200 jupyterlab (4.0.11+ds2+~cs11.25.27-2) unstable; urgency=medium * Team upload * Add test for some package at build -- Bastien Roucariès Sun, 08 Mar 2026 13:05:45 +0100 jupyterlab (4.0.11+ds2+~cs11.25.27-1) unstable; urgency=medium * Team upload * Remove duplicate-package-checker-webpack-plugin embded package -- Bastien Roucariès Sat, 07 Mar 2026 14:34:54 +0100 jupyterlab (4.0.11+ds1+~cs11.25.27-9) unstable; urgency=medium * Team upload * Port to glob@10 -- Bastien Roucariès Wed, 03 Dec 2025 18:37:32 +0100 jupyterlab (4.0.11+ds1+~cs11.25.27-8) unstable; urgency=medium * Add node-supports-color into dependencies and add a patch for node-supports-color >= 11 (Closes: #1119742) -- Yadd Fri, 07 Nov 2025 15:18:12 +0100 jupyterlab (4.0.11+ds1+~cs11.25.27-7) unstable; urgency=medium * Team upload [ Jérémy Lal ] * Fix build of bundled browser module (Closes: #1102558). Adds a webpack plugin to support modules prefixed by "node:". [ Picca Frédéric-Emmanuel ] * switch to the upstream (hatchling) build system. - now jupyterlab is well integrated with jupyterhub - do not install examples at the wrong place. - the Python dist-info are right. * Bug fix: "missing four files from upstream distribution", thanks to Julian Gilbey (Closes: #1101429). * Bug fix: "advertises Python package version as 0.0.0", thanks to Julian Gilbey (Closes: #1086709). * Bug fix: "installs examples into dist-packages", thanks to Piotr Ożarowski (Closes: #1102934). * d/control: B-D on webpack (>= 5.97.1+dfsg1+~cs11.18.27-3~) -- Picca Frédéric-Emmanuel Thu, 05 Jun 2025 14:45:20 +0200 jupyterlab (4.0.11+ds1+~cs11.25.27-6) unstable; urgency=medium * Declare compliance with policy 4.7.2 * Fix webpack/commonjs config (Closes: #1101851) * Clean temporary files -m (Closes: #1101816) -- Yadd Wed, 02 Apr 2025 18:46:10 +0200 jupyterlab (4.0.11+ds1+~cs11.25.27-5) unstable; urgency=medium * Add dependency on python3-notebook. -- Roland Mas Sat, 22 Mar 2025 14:40:05 +0100 jupyterlab (4.0.11+ds1+~cs11.25.27-4) unstable; urgency=medium * debian/watch: replace /releases by /tags in GitHub urls * Add dependency to node-license-webpack-plugin -- Yadd Thu, 26 Dec 2024 06:14:42 +0100 jupyterlab (4.0.11+ds1+~cs11.25.27-3) unstable; urgency=medium * Fix CVE-2024-43805 (Closes: #1082871) -- Yadd Mon, 25 Nov 2024 15:00:57 +0100 jupyterlab (4.0.11+ds1+~cs11.25.27-2) unstable; urgency=medium * Require well build @codemirror/language and @codemirror/view (Closes: #1078077) -- Yadd Mon, 26 Aug 2024 06:11:09 +0400 jupyterlab (4.0.11+ds1+~cs11.25.27-1) unstable; urgency=medium * First version of Jupyterlab that merges python3-jupyterlab and node-jupyterlab * Rename source and package into jupyterlab * Change maintainer to Debian PAN Maintainer [ Roland Mas ] * Update debian/watch to cope with the github "tags" page being full of tags that are not relevant to us. [ Yadd ] * Declare compliance with policy 4.7.0 * New upstream version 4.0.11+ds1+~cs11.25.27 * Refresh patches * Merge python3-jupyterlab and node-jupyterlab * Add patch to use system yarnpkg or an arbitrary command given by arg (Closes: #1060772) * Increase Node.js memory for i386 build * Add build dependency to: - python3-jupyter-server - python3-async-lru - python3-jupyterlab-server - python3-notebook-shim * Increase Node.js memory use to fix i386 build * Launch also "jupyter-labextension build galata/extension" * Replace html-loader pre-processing by a custom script (see #1078077) -- Yadd Mon, 12 Aug 2024 16:35:17 +0400 python3-jupyterlab (4.0.11+ds1-2) unstable; urgency=medium * Improve error detection in d/rules. * Bug fix: "Use node-long package", thanks to Bastien Roucariès (Closes: #1067017). * Bug fix: "use pacckaged node-call-bind (provided package)", thanks to Bastien Roucariès (Closes: #1067019). * Bug fix: "please use node-get-intrinsic", thanks to Bastien Roucariès (Closes: #1067020). -- Roland Mas Tue, 19 Mar 2024 16:49:20 +0100 python3-jupyterlab (4.0.11+ds1-1) unstable; urgency=medium * New upstream release. * Bug fix: "CVE-2024-22420 CVE-2024-22421", thanks to Salvatore Bonaccorso (Closes: #1061221). -- Roland Mas Mon, 22 Jan 2024 13:52:19 +0100 node-jupyterlab (4.0.10+ds1+~cs11.25.27-1) unstable; urgency=medium * New upstream version 4.0.10+ds1+~cs11.25.27 * Unfuzz patches -- Yadd Tue, 09 Jan 2024 09:28:06 +0400 python3-jupyterlab (4.0.10+ds1-1) unstable; urgency=medium * New upstream release. -- Roland Mas Fri, 12 Jan 2024 16:01:12 +0100 node-jupyterlab (4.0.9+ds1+~cs11.25.24-2) unstable; urgency=medium * Fix autopkgtest * Fix copyright paths * Update lintian overrides -- Yadd Wed, 20 Dec 2023 13:18:48 +0400 node-jupyterlab (4.0.9+ds1+~cs11.25.24-1) unstable; urgency=medium * Embed duplicate-package-checker-webpack-plugin and systeminformation -- Yadd Tue, 19 Dec 2023 11:51:43 +0400 node-jupyterlab (4.0.9+ds1+~cs3.4.4-1) unstable; urgency=medium * Remove patch fix-node-xterm-paths.patch that is missing from debian/patches/series * New upstream version 4.0.9+ds1+~cs3.4.4 * Add patch for minimatch >= 9 * Update lintian overrides * Require node-typestyle >= 2.4.0+ds+~3.0.10~ * Upload to unstable -- Yadd Tue, 19 Dec 2023 08:10:53 +0400 python3-jupyterlab (4.0.9+ds1-2) unstable; urgency=medium * Run jupyter-labextension build at package build time. -- Roland Mas Wed, 03 Jan 2024 17:06:14 +0100 python3-jupyterlab (4.0.9+ds1-1) unstable; urgency=medium * New upstream release. -- Roland Mas Tue, 26 Dec 2023 14:50:00 +0100 python3-jupyterlab (4.0.8+ds1-3) UNRELEASED; urgency=medium * Add missing Build-Depends. * Pre-build Jupyterlab assets at package build time. * Bug fix: "Jupyter lab does not start up", thanks to Christian Holm Christensen (Closes: #1060390). -- Roland Mas Tue, 26 Dec 2023 14:45:22 +0100 python3-jupyterlab (4.0.8+ds1-2) unstable; urgency=medium * Update debian/copyright slightly. -- Roland Mas Tue, 14 Nov 2023 11:44:52 +0100 python3-jupyterlab (4.0.8+ds1-1) unstable; urgency=medium * New upstream release. * Exclude yarn.js. -- Roland Mas Sat, 11 Nov 2023 14:10:59 +0100 node-jupyterlab (4.0.5+ds1+~cs2.4.6-3) experimental; urgency=medium * Build: + @jupyterlab/galata + @jupyterlab/galata-extension + @jupyterlab/buildutils * Add build dependencies to: + node-playwright + node-stdlib * Embed systeminformation for build only * Add patch to don't try to update @jupyterlab/* libraries * Set dependencies -- Yadd Wed, 20 Sep 2023 11:44:37 +0400 node-jupyterlab (4.0.5+ds1+~cs2.4.6-2) experimental; urgency=medium * Build: + @jupyterlab/terminal + @jupyterlab/terminal-extension + @jupyterlab/metapackage + @jupyterlab/mathjax-extension + @jupyterlab/application-top * Add build dependencies to: + node-xterm >= 5 + node-d3-delaunay + node-d3-geo-projection + node-find-root + node-html-loader + node-mathjax-full + node-micromatch + node-path-browserify + node-process + node-sort-package-json , node-source-map-loader + node-style-loader + node-xterm >= 5 -- Yadd Mon, 18 Sep 2023 12:29:39 +0400 node-jupyterlab (4.0.5+ds1+~cs2.4.6-1) experimental; urgency=medium * Build: + @jupyterlab/debugger, @jupyterlab/debugger-extension + @jupyterlab/template + @jupyterlab/tooltip-extension + @jupyterlab/builder + @jupyterlab/json-extension + @jupyterlab/vega5-extension + @jupyterlab/testing * Embed mini-svg-data-uri * Add build dependencies: + node-geojson, node-lodash-packages, node-react-json-tree, node-simulate-event, node-vega, node-vega-lite, node-vega-embed, node-vscode-debugprotocol, node-xtend -- Yadd Wed, 13 Sep 2023 13:52:06 +0400 node-jupyterlab (4.0.5+ds1+~1.0.2-1) experimental; urgency=medium * debian/watch: no alpha releases * New upstream version 4.0.5+ds1+~1.0.2 * Update patches -- Yadd Sat, 02 Sep 2023 07:47:19 +0400 node-jupyterlab (4.0.2+ds1+~1.0.2-2) experimental; urgency=medium * build @jupyterlab/nconvert-css -- Yadd Mon, 17 Jul 2023 18:00:27 +0400 node-jupyterlab (4.0.2+ds1+~1.0.2-1) experimental; urgency=medium * New upstream version 4.0.2+ds1+~1.0.2 * Unfuzz patches * Add build dependency to node-lezer-markdown -- Yadd Fri, 14 Jul 2023 10:41:37 +0400 node-jupyterlab (4.0.0~rc1+ds1+~1.0.2-1) experimental; urgency=medium * Initial release (Closes: #1035651) -- Yadd Wed, 05 Jul 2023 15:43:54 +0400 python3-jupyterlab (3.6.3-4) unstable; urgency=medium * Add missing runtime dependency on node-jupyterlab. -- Roland Mas Fri, 21 Jul 2023 18:27:15 +0200 python3-jupyterlab (3.6.3-3) unstable; urgency=medium * Clean up build-dependencies since the Javascript parts are no longer built from this source package. -- Roland Mas Fri, 21 Jul 2023 18:14:12 +0200 python3-jupyterlab (3.6.3-2) unstable; urgency=medium * Node modules are now packaged separately in node-jupyterlab. * Initial release. -- Roland Mas Thu, 18 May 2023 17:04:44 +0200 python3-jupyterlab (3.6.3-1) UNRELEASED; urgency=medium * Import new upstream release. -- Roland Mas Mon, 01 May 2023 16:48:01 +0200 python3-jupyterlab (3.6.1-1) UNRELEASED; urgency=medium * Import new upstream release. -- Roland Mas Wed, 08 Mar 2023 17:29:24 +0100 python3-jupyterlab (3.5.0~rc0-1) UNRELEASED; urgency=medium * Import new upstream pre-release. -- Roland Mas Wed, 19 Oct 2022 15:55:29 +0200 python3-jupyterlab (3.4.8-1) UNRELEASED; urgency=medium * Import new upstream release. -- Roland Mas Wed, 05 Oct 2022 10:09:23 +0200 python3-jupyterlab (3.2.4-1) UNRELEASED; urgency=medium [ Julien Puydt ] * Initial release. (Closes: #934258) [ Roland Mas ] * Continuing Julien's work. -- Roland Mas Wed, 09 Feb 2022 20:06:59 +0100