Skip to content

Update dependency jupyterlite-core to v0.4.1 [SECURITY] - autoclosed#189

Closed
renovate[bot] wants to merge 1 commit intomainfrom
renovate/pypi-jupyterlite-core-vulnerability
Closed

Update dependency jupyterlite-core to v0.4.1 [SECURITY] - autoclosed#189
renovate[bot] wants to merge 1 commit intomainfrom
renovate/pypi-jupyterlite-core-vulnerability

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Sep 6, 2024 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
jupyterlite-core ==0.1.3 -> ==0.4.1 age confidence

GitHub Vulnerability Alerts

GHSA-gj55-2xf9-67rq

Impact

The vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature.

A malicious user can access any data accessible from JupyterLite and perform arbitrary actions in JupyterLite environment.

Patches

JupyterLite 0.4.1 was patched.

Workarounds

There is no workaround for the underlying DOM Clobbering susceptibility. However, select plugins can be disabled on deployments which cannot update in a timely fashion to minimise the risk. These are:

  • @jupyterlab/mathjax-extension:plugin - users will loose ability to preview mathematical equations
  • @jupyterlab/markdownviewer-extension:plugin - users will loose ability to open Markdown previews
  • @jupyterlab/mathjax2-extension:plugin (if installed with optional jupyterlab-mathjax2 package) - an older version of the mathjax plugin for JupyterLab 4.x

To disable these extensions populate the disabledExtensions key in jupyter-config-data stanza of jupyter-lite.json as documented on https://jupyterlite.readthedocs.io/en/stable/howto/configure/config_files.html#jupyter-lite-json

{
  "jupyter-lite-schema-version": 0,
  "jupyter-config-data": {
    "appName": "My JupyterLite App",
    "disabledExtensions": [
      "@​jupyterlab/markdownviewer-extension:plugin",
      "@​jupyterlab/mathjax-extension:plugin",
      "@​jupyterlab/mathjax2-extension:plugin"
    ]
  }
}

To confirm that the plugins were disabled manual inspection of the built page is required.

References

Upstream advisory: GHSA-9q39-rmj3-p4r2

Notes

This change has a potential to break rendering of some markdown. There is a setting in Sanitizer which allows to revert to the previous sanitizer settings (allowNamedProperties).

Release Notes

jupyterlite/jupyterlite (jupyterlite-core)

v0.4.1

Compare Source

0.4.1

(Full Changelog)

Maintenance and upkeep improvements
Documentation improvements
Contributors to this release

(GitHub contributors page for this release)

@​github-actions | @​jtpio | @​michaelweinold | @​zonca

v0.4.0

Compare Source

0.4.0

(Full Changelog)

Enhancements made
Bugs fixed
Maintenance and upkeep improvements
Documentation improvements
API and Breaking Changes
Contributors to this release

(GitHub contributors page for this release)

@​afshin | @​bollwyvl | @​Carreau | @​dependabot | @​github-actions | @​jtpio | @​juntyr | @​krassowski | @​martinRenou

v0.3.0

Compare Source

0.3.0

(Full Changelog)

Enhancements made
Bugs fixed
Maintenance and upkeep improvements
Documentation improvements
Contributors to this release

(GitHub contributors page for this release)

@​andeplane | @​bollwyvl | @​dependabot | @​fcollonval | @​github-actions | @​ianthomas23 | @​jtpio | @​martinRenou

v0.2.3

Compare Source

0.2.3

(Full Changelog)

Maintenance and upkeep improvements
Documentation improvements
Contributors to this release

(GitHub contributors page for this release)

@​dependabot | @​fcollonval | @​github-actions | @​jeremy-feng | @​jtpio | @​Rjchauhan18 | @​tgourdel

v0.2.2

Compare Source

0.2.2

(Full Changelog)

Bugs fixed
Maintenance and upkeep improvements
Documentation improvements
Contributors to this release

(GitHub contributors page for this release)

@​agoose77 | @​bollwyvl | @​dependabot | @​github-actions | @​jtpio | @​tomjakubowski

v0.2.1

Compare Source

0.2.1

(Full Changelog)

Bugs fixed
Maintenance and upkeep improvements
Documentation improvements
Contributors to this release

(GitHub contributors page for this release)

@​andeplane | @​bollwyvl | @​github-actions | @​jtpio | @​Tialo

v0.2.0

Compare Source

0.2.0

(Full Changelog)

✨ Highlights ✨

JupyterLite 0.2.0 is released 🎉

The main highlights in JupyterLite 0.2.0 is the update to JupyterLab 4. This brings compatibility with extensions that have been updated to JupyterLab 4 the past couple of months.

The RetroLab interface has now been removed in favor of Notebook 7 (which is the successor of RetroLab).

Check out the migration guide to learn more on how to update your deployments: https://jupyterlite.readthedocs.io/en/latest/migration.html

Below is the full changelog since the last stable release.

Enhancements made
Bugs fixed
Maintenance and upkeep improvements
Documentation improvements
API and Breaking Changes
Contributors to this release

(GitHub contributors page for this release)

@​andeplane | @​bollwyvl | @​dependabot | @​github-actions | @​jtpio | @​martinRenou | @​trungleduc

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the dependencies label Sep 6, 2024
@renovate renovate bot requested a review from rclement September 6, 2024 20:10
@renovate
Copy link
Contributor Author

renovate bot commented Sep 6, 2024 •
edited
Loading

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Pipfile.lock
Command failed: pipenv lock
Creating a virtualenv for this project
Pipfile: 
/tmp/renovate/repos/github/meetup-python-grenoble/meetup-python-grenoble.github.
io/Pipfile
Using /usr/local/bin/python3.10.19 to create virtualenv...
created virtual environment CPython3.10.19.final.0-64 in 1146ms
  creator 
CPython3Posix(dest=/runner/cache/others/virtualenvs/meetup-python-grenoble.githu
b.io-nPZa1W9V, clear=False, no_vcs_ignore=False, global=False)
  seeder FromAppData(download=False, pip=bundle, setuptools=bundle, via=copy, 
app_data_dir=/tmp/containerbase/cache/.local/share/virtualenv)
    added seed packages: pip==25.3, setuptools==80.9.0
  activators 
BashActivator,CShellActivator,FishActivator,NushellActivator,PowerShellActivator
,PythonActivator

✔ Successfully created virtual environment!
Virtualenv location: /runner/cache/others/virtualenvs/meetup-python-grenoble.github.io-nPZa1W9V
Locking  dependencies...
Locking  dependencies...
CRITICAL:pipenv.patched.pip._internal.resolution.resolvelib.factory:Cannot 
install -r /tmp/pipenv-n47zkpnh-requirements/pipenv-dig2hqvj-constraints.txt 
(line 8) and jupyterlite-core==0.4.1 because these package versions have 
conflicting dependencies.
[ResolutionFailure]:   File 
"/opt/containerbase/tools/pipenv/2025.0.4/3.10.19/lib/python3.10/site-packages/p
ipenv/resolver.py", line 451, in main
[ResolutionFailure]:       _main(
[ResolutionFailure]:   File 
"/opt/containerbase/tools/pipenv/2025.0.4/3.10.19/lib/python3.10/site-packages/p
ipenv/resolver.py", line 436, in _main
[ResolutionFailure]:       resolve_packages(
[ResolutionFailure]:   File 
"/opt/containerbase/tools/pipenv/2025.0.4/3.10.19/lib/python3.10/site-packages/p
ipenv/resolver.py", line 400, in resolve_packages
[ResolutionFailure]:       results, resolver = resolve_deps(
[ResolutionFailure]:   File 
"/opt/containerbase/tools/pipenv/2025.0.4/3.10.19/lib/python3.10/site-packages/p
ipenv/utils/resolver.py", line 1083, in resolve_deps
[ResolutionFailure]:       results, hashes, internal_resolver = 
actually_resolve_deps(
[ResolutionFailure]:   File 
"/opt/containerbase/tools/pipenv/2025.0.4/3.10.19/lib/python3.10/site-packages/p
ipenv/utils/resolver.py", line 811, in actually_resolve_deps
[ResolutionFailure]:       resolver.resolve()
[ResolutionFailure]:   File 
"/opt/containerbase/tools/pipenv/2025.0.4/3.10.19/lib/python3.10/site-packages/p
ipenv/utils/resolver.py", line 471, in resolve
[ResolutionFailure]:       raise ResolutionFailure(message=e)
Your dependencies could not be resolved. You likely have a mismatch in your 
sub-dependencies.
You can use $ pipenv run pip install <requirement_name> to bypass this 
mechanism, then run $ pipenv graph to inspect the versions actually installed in
the virtualenv.
Hint: try $ pipenv lock --pre if it is a pre-release dependency.
ERROR: ResolutionImpossible: for help visit 
https://pip.pypa.io/en/latest/topics/dependency-resolution/#dealing-with-depende
ncy-conflicts

Your dependencies could not be resolved. You likely have a mismatch in your 
sub-dependencies.
You can use $ pipenv run pip install <requirement_name> to bypass this 
mechanism, then run $ pipenv graph to inspect the versions actually installed in
the virtualenv.
Hint: try $ pipenv lock --pre if it is a pre-release dependency.
ERROR: Failed to lock Pipfile.lock!

@renovate renovate bot force-pushed the renovate/pypi-jupyterlite-core-vulnerability branch 2 times, most recently from c84c367 to 4c42c1d Compare September 19, 2024 14:05
@renovate renovate bot force-pushed the renovate/pypi-jupyterlite-core-vulnerability branch 2 times, most recently from 1ee5293 to d54bbee Compare October 25, 2024 11:22
@renovate renovate bot force-pushed the renovate/pypi-jupyterlite-core-vulnerability branch from d54bbee to 0bcc4e3 Compare November 1, 2024 19:51
@renovate renovate bot force-pushed the renovate/pypi-jupyterlite-core-vulnerability branch 3 times, most recently from ce50a7f to 47ea251 Compare November 19, 2024 21:34
@renovate renovate bot force-pushed the renovate/pypi-jupyterlite-core-vulnerability branch 2 times, most recently from f7d1211 to d9936e6 Compare November 26, 2024 15:52
@renovate renovate bot force-pushed the renovate/pypi-jupyterlite-core-vulnerability branch 3 times, most recently from d080d9c to d46d248 Compare December 11, 2024 12:43
@renovate renovate bot force-pushed the renovate/pypi-jupyterlite-core-vulnerability branch from d46d248 to 70900a9 Compare December 15, 2024 19:01
@renovate renovate bot force-pushed the renovate/pypi-jupyterlite-core-vulnerability branch from 70900a9 to d2d4738 Compare January 29, 2025 21:29
@renovate renovate bot force-pushed the renovate/pypi-jupyterlite-core-vulnerability branch from d2d4738 to 753f956 Compare March 19, 2025 23:28
@renovate renovate bot force-pushed the renovate/pypi-jupyterlite-core-vulnerability branch from 753f956 to ed98f1b Compare April 29, 2025 00:14
@renovate renovate bot force-pushed the renovate/pypi-jupyterlite-core-vulnerability branch from ed98f1b to ab6adc9 Compare May 21, 2025 23:47
@renovate renovate bot force-pushed the renovate/pypi-jupyterlite-core-vulnerability branch from ab6adc9 to 2a29cb0 Compare June 22, 2025 18:38
@renovate renovate bot force-pushed the renovate/pypi-jupyterlite-core-vulnerability branch from 2a29cb0 to db0617a Compare June 30, 2025 13:32
@renovate renovate bot force-pushed the renovate/pypi-jupyterlite-core-vulnerability branch from db0617a to 20e5ac3 Compare September 21, 2025 17:55
@renovate renovate bot force-pushed the renovate/pypi-jupyterlite-core-vulnerability branch from 20e5ac3 to dc713d1 Compare October 21, 2025 23:58
@renovate renovate bot force-pushed the renovate/pypi-jupyterlite-core-vulnerability branch from dc713d1 to e3a7b6b Compare October 23, 2025 14:36
@renovate renovate bot changed the title Update dependency jupyterlite-core to v0.4.1 [SECURITY] Update dependency jupyterlite-core to v0.4.1 [SECURITY] - autoclosed Nov 19, 2025
@renovate renovate bot closed this Nov 19, 2025
@renovate renovate bot deleted the renovate/pypi-jupyterlite-core-vulnerability branch November 19, 2025 14:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rclement rclement Awaiting requested review from rclement

Assignees

@rclement rclement

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rclement