Update dependency jupyterlab to v4 [SECURITY]

[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
jupyterlab (changelog)	^3.0.0 → ^4.0.0

---

JupyterLab vulnerable to potential authentication and CSRF tokens leak

CVE-2024-22421 / GHSA-44cc-43rp-5947

More information

Details

Impact

Users of JupyterLab who click on a malicious link may get their Authorization and XSRFToken tokens exposed to a third party when running an older jupyter-server version.

Patches

JupyterLab 4.1.0b2, 4.0.11, and 3.6.7 were patched.

Workarounds

No workaround has been identified, however users should ensure to upgrade jupyter-server to version 2.7.2 or newer which includes a redirect vulnerability fix.

References

Vulnerability reported by user @​davwwwx via the bug bounty program sponsored by the European Commission and hosted on the Intigriti platform.

Severity

• CVSS Score: 7.6 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

References

• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947
• https://github.com/jupyterlab/jupyterlab/commit/1ef7a4fa0202ebdf663e1cc0b45c8813a34a0b96
• https://github.com/jupyterlab/jupyterlab/commit/fccd83dc4441da0384ee3fd1322c3b2d9ad4caaa
• https://nvd.nist.gov/vuln/detail/CVE-2024-22421
• https://github.com/jupyterlab/jupyterlab/commit/19bd9b96cb2e77170a67e43121637d0b5619e8c6
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQJKNRDRFMKGVRIYNNN6CKMNJDNYWO2H/
• https://github.com/advisories/GHSA-44cc-43rp-5947

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering

CVE-2024-43805 / GHSA-9q39-rmj3-p4r2

More information

Details

Impact

The vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature.

A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user.

Patches

JupyterLab v3.6.8, v4.2.5 and Jupyter Notebook v7.2.2 were patched.

Workarounds

There is no workaround for the underlying DOM Clobbering susceptibility. However, select plugins can be disabled on deployments which cannot update in a timely fashion to minimise the risk. These are:

• @jupyterlab/mathjax-extension:plugin - users will loose ability to preview mathematical equations
• @jupyterlab/markdownviewer-extension:plugin - users will loose ability to open Markdown previews
• @jupyterlab/mathjax2-extension:plugin (if installed with optional jupyterlab-mathjax2 package) - an older version of the mathjax plugin for JupyterLab 4.x

To disable these extensions run:

jupyter labextension disable @jupyterlab/markdownviewer-extension:plugin
jupyter labextension disable @jupyterlab/mathjax-extension:plugin
jupyter labextension disable @jupyterlab/mathjax2-extension:plugin

To confirm that the plugins were disabled run:

jupyter labextension list

References

None

Notes

This change has a potential to break rendering of some markdown. There is a setting in Sanitizer which allows to revert to the previous sanitizer settings (allowNamedProperties).

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-9q39-rmj3-p4r2
• https://nvd.nist.gov/vuln/detail/CVE-2024-43805
• https://github.com/jupyterlab/jupyterlab/commit/06ad9de836f155add7d3d651ef936cc4c5ea8093
• https://github.com/jupyterlab/jupyterlab/commit/88e24baac551196f9cb3de16bd060a7ab1597674
• https://github.com/advisories/GHSA-9q39-rmj3-p4r2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

JupyterLab LaTeX typesetter links did not enforce noopener attribute

CVE-2025-59842 / GHSA-vvfj-2jqx-52jm

More information

Details

Links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the noopener attribute.

This is deemed to have no impact on the default installations. Theoretically users of third-party LaTeX-rendering extensions could find themselves vulnerable to reverse tabnabbing attacks if:

• links generated by those extensions included target=_blank (no such extensions are known at time of writing) and
• they were to click on a link generated in LaTeX (typically visibly different from other links).

For consistency with handling on other links, new versions of JupyterLab will enforce noopener and target=_blank on all links generated by typesetters. The former will harden the resilience of JupyterLab to extensions with lack of secure defaults in link rendering, and the latter will improve user experience by preventing accidental state loss when clicking on links rendered by LaTeX typesetters.

Impact

Since the official LaTeX typesetter extensions for JupyterLab: jupyterlab-mathjax (default), jupyterlab-mathjax2 and jupyterlab-katex do not include the target=_blank, there is no impact for JupyterLab users.

Patches

JupyterLab 4.4.8

Workarounds

No workarounds are necessary.

References

None

Severity

• CVSS Score: 2.1 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-vvfj-2jqx-52jm
• https://github.com/jupyterlab/jupyterlab/commit/88ef373039a8cc09f27d3814382a512d9033675c
• https://nvd.nist.gov/vuln/detail/CVE-2025-59842
• https://github.com/advisories/GHSA-vvfj-2jqx-52jm

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS

CVE-2026-40171 / GHSA-rch3-82jr-f9w9

More information

Details

Impact

A stored Cross-Site Scripting (XSS) vulnerability in Jupyter Notebook allows attackers to steal authentication tokens from users who open malicious notebook files and interact with elements that the attacker can make look indistinguishable from legitimate controls (single click interaction).

The vulnerability enables complete account takeover through the Jupyter REST API, allowing the attacker to:

1. Read all files
2. Modify/create files
3. Access running kernels and execute arbitrary code
4. Create terminals for shell access

Patches

Jupyter Notebook 7.5.6 and JupyterLab 4.5.7 include patches for this vulnerability.

Workarounds

The help extension can be disabled via CLI:

jupyter labextension disable @jupyter-notebook/help-extension
jupyter labextension disable @jupyterlab/help-extension

Hardening

The patched versions include a toggle to disable the command linker functionality altogether, for example via overrides.json:

{
  "@jupyterlab/apputils-extension:sanitizer": {
    "allowCommandLinker": false
  }
}

Resources

• https://jupyterlab.readthedocs.io/en/latest/user/commands.html#commands-in-markdown-output-and-files

Acknowledgments

Reported by Daniel Teixeira - NVIDIA AI Red Team

Severity

• CVSS Score: 8.4 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/jupyter/notebook/security/advisories/GHSA-rch3-82jr-f9w9
• https://jupyterlab.readthedocs.io/en/latest/user/commands.html#commands-in-markdown-output-and-files
• https://nvd.nist.gov/vuln/detail/CVE-2026-40171
• https://github.com/advisories/GHSA-rch3-82jr-f9w9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

JupyterLab's command linker attributes in HTML enable one-click command execution from untrusted content

CVE-2026-42557 / GHSA-mqcg-5x36-vfcg

More information

Details

JupyterLab's HTML sanitizer allowlists data-commandlinker-command and data-commandlinker-args on button elements, while CommandLinker listens for all click events on document.body and executes the named command without checking whether the element came from trusted JupyterLab UI. A notebook with a pre-saved HTML cell output containing a deceptive button can trigger arbitrary JupyterLab commands - including arbitrary code execution - on a single user click, without any code being submitted for execution by the user.

Impact

An attacker who shares a notebook or a Markdown file - via email, GitHub, or a Binder link - can invoke an arbitrary command upon a single click by the victim. The button can be rendered inside the output area and be visually indistinguishable from a legitimate widget. No kernel needs to start; the HTML output is stored in the notebook file and displayed immediately on open.

Single-click impact

An attacker convincing the victim to click on a single button or link can:

• execute arbitrary code in the available kernels,
• delete files leading to information loss; in principle the loss could be unrecoverable, depending on server configuration and attack complexity,
• open multiple kernels/terminals at once, or create multiple files at once, putting significant stress on the server and thus deny availability for other users when using standalone multi-tenant jupyter-server deployment, and to a lesser degree impact availability on JupyterHub deployments.

The arbitrary code execution will be immediately visible to the user; and can be halted by the timely user intervention. The deletion of files can be silent and go unnoticed for some time.

Multi-click attacks

An attacker who convinces the victim to click on multiple buttons in specific order and to grant access to clipboard (or in scenarios where the user already granted keyboard access) can obtain full access to the terminal and execute arbitrary commands in the environment with access scope that might exceed that of available kernels. Only users of Chromium-based browsers are susceptible to this expanded variant of the attack.

The execution of commands in the terminal would be immediately visible to the user.

Impact of third-party extensions

The impact described above assumes a plain JupyterLab/Notebook installation. In environments with frontend extensions that contribute additional commands the attack surface is increased by the functionality covered by these commands.

Patches

JupyterLab 4.5.7

Workarounds

No workarounds are available for end-users.

Downstream applications inheriting from JupyterFrontEnd or JupyterLab can effectively disable the CommandLinker by passing commandLinker: new CommandLinker({ commands: new CommandRegistry() }) option in the initialization options.

Hardening

The patched versions include a toggle to disable the command linker functionality altogether, for example via overrides.json:

{
  "@jupyterlab/apputils-extension:sanitizer": {
    "allowCommandLinker": false
  }
}

Resources

• https://jupyterlab.readthedocs.io/en/latest/user/commands.html#commands-in-markdown-files

Severity

• CVSS Score: 8.6 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-mqcg-5x36-vfcg
• https://jupyterlab.readthedocs.io/en/latest/user/commands.html#commands-in-markdown-files
• https://nvd.nist.gov/vuln/detail/CVE-2026-42557
• https://github.com/advisories/GHSA-mqcg-5x36-vfcg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

JupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocol

GHSA-vmhf-c436-hxj4

More information

Details

A malicious PyPI package can place a javascript: URL in its [project.urls] metadata. JupyterLab's Extension Manager renders this as the extension's home-page link without validating the protocol, so a user who clicks the extension name executes attacker-controlled JavaScript in the JupyterLab origin.

Details

One of the PyPI package's URL (jupyterlab/extensions/pypi.py) is copied straight into the homepage_url rendered by the frontend in packages/extensionmanager/src/widget.tsx#L77-L88.

best_guess_home_url = (
    homepage_url            # home_page / [project.urls] Homepage
    or data.get("project_url")
    or data.get("package_url")
    or documentation_url    # docs_url / [project.urls] Documentation
    or source_url           # [project.urls] Source Code
    or bug_tracker_url      # bugtrack_url / [project.urls] Bug Tracker
)

##### homepage_url=best_guess_home_url

{entry.homepage_url ? (
  <a href={entry.homepage_url} target="_blank" rel="noopener noreferrer" ...>
    {entry.name}
  </a>
) : ( <div>{entry.name}</div> )}

Impact

An attacker needs to publish a package to PyPI (no access to the target). When the package appears in a victim's extension manager list and the victim clicks the extension name, the payload runs in the JupyterLab origin.

Preconditions: Extension Manager enabled with the default PyPI source, the malicious package appears in the victim's list/search results.

Patches

Patched in 4.5.9, commits 4e61e07 and d5d961f

Severity

• CVSS Score: 5.1 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-vmhf-c436-hxj4
• https://github.com/jupyterlab/jupyterlab/commit/4e61e07d0a91145b53fbf96ac74b0387f6bc51f6
• https://github.com/jupyterlab/jupyterlab/commit/d5d961f6e10a6442dddbf94d9a976b3897055a12
• https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.9
• https://github.com/advisories/GHSA-vmhf-c436-hxj4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

JupyterLab: Cross-site scripting (XSS) via crafted settings file (overrides.json)

CVE-2026-73417 / GHSA-pppj-hq3g-57pj

More information

Details

JupyterLab 4.5+ allows notebook settings to be shared and applied through an overrides.json file using the Import button in the Settings Editor.

Certain notebook display settings were not properly validated before being applied. As a result, a crafted settings file could contain hidden instructions that run as code inside JupyterLab when imported, instead of only changing a display preference.

Because importing a settings file appears harmless, a user could import a file shared by another party without realizing it could do more. On multi-tenant file systems without proper permission control, another user could plant a malicious overrides.json.

CVE assignment pending, GitHub CNA is experiencing severe backlog

Impact

When a malicious settings file is applied, the embedded code runs with the same access as the affected user. This could allow an attacker to read or modify that user's notebooks and files, and to run code on the user's behalf through the notebook server, including on any connected kernel.

User Interaction vs Privileges Required

Write access to a loaded settings location

If an attacker can write to a directory JupyterLab loads settings from (e.g. on shared or multi-tenant file system), they could place a crafted overrides.json that is applied to another user automatically at startup. This requires high privilages but no action by the victim.

User-imported settings file

A user can import a crafted overrides.json through the Import button in the Settings Editor, having received it from another party. This requires no privileges but a deliberate action by the victim, who reasonably expects a settings file to change preferences rather than run code.

Patches

JupyterLab 4.6.2 and 4.5.10 were patched.

Workarounds

None

Hardening

1. Treat a settings file as something that can affect how JupyterLab behaves, not only how it appears. Administrators are encouraged to establish a trusted process for distributing configuration rather than relying on ad-hoc importing of shared files.
2. On multi-tenant or shared file systems, restrict write permissions on the application settings directory and other Jupyter configuration paths so that one user cannot place an overrides.json (or other configuration) readable by another user. A settings file in these locations is applied automatically, without an import step, so directory permissions are the primary control against cross-user tampering.

Severity

• CVSS Score: 8.6 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:L

References

• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-pppj-hq3g-57pj
• https://github.com/jupyterlab/jupyterlab/pull/19184
• https://github.com/jupyterlab/jupyterlab/pull/19185
• https://github.com/jupyterlab/jupyterlab/pull/19186
• https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c
• https://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432
• https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10
• https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2
• https://github.com/advisories/GHSA-pppj-hq3g-57pj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

JupyterLab: Allowlist/blocklist check in PyPIExtensionManager.install() not enforced for direct callers (missing await)

GHSA-whvh-wf3x-g77j

More information

Details

The extension allowlist/blocklist check inside PyPIExtensionManager.install() was not enforced due to a missing await. For purposes of JupyterLab this was a secondary defense-in-depth check: install() was intended to enforce the allowlist/blocklist itself for any future uses and users calling this method directly (in addition to the separate check handling requests arriving through the HTTP API). The only runtime symptom was a RuntimeWarning: coroutine 'is_install_allowed' was never awaited.

This has security implications only for deployments that combine all of the following:

• a custom extension or downstream integration that imports PyPIExtensionManager and calls install() directly with a package name influenced by untrusted user input (the stock JupyterLab HTTP handler is not affected - it performs its own awaited allowlist check before calling install());
• an allowlist/blocklist configured with the intent of restricting which packages users can install;
• the (default) PyPI Extension Manager enabled; and
• kernels and terminals disabled or delegated to remote hosts, so that the custom extension's install() call is the only available package-install vector (otherwise a user with kernel access can install packages directly regardless of this check)

Impact

Low. No exposure for stock JupyterLab: the HTTP API and Extension Manager UI enforce the listing through a separate, correctly awaited check. The gap affected only custom extensions or downstream integrations that called the public install() method directly and relied on it to self-enforce.

Patches

JupyterLab v4.6.2 and v4.5.10 contain the patch.

Users of applications that depend on JupyterLab, such as Notebook v7+, should update jupyterlab package too.

Workarounds

No action is required for deployments that only expose extension management through the JupyterLab HTTP API / Extension Manager UI, as that path was already enforcing the listing via the handler's own check. Deployments wanting to disable programmatic extension installation entirely can switch to the read-only extension manager:

--LabApp.extension_manager=readonly

or the following traitlet:

c.LabApp.extension_manager = 'readonly'

You can confirm that the read-only manager is in use from GUI:

Severity

• CVSS Score: 0.0 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N

References

• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-whvh-wf3x-g77j
• https://github.com/jupyterlab/jupyterlab/pull/19184
• https://github.com/jupyterlab/jupyterlab/pull/19185
• https://github.com/jupyterlab/jupyterlab/pull/19186
• https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c
• https://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432
• https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10
• https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2
• https://github.com/advisories/GHSA-whvh-wf3x-g77j

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

CVE-2026-73415 / GHSA-gx64-gj6p-pc4c

More information

Details

JupyterLab's image viewer allows for cross-site scripting (XSS) when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution (RCE) on the JupyterLab server.

Impact

This vulnerability allows for arbitrary code execution.

Patches

JupyterLab v4.6.2 and v4.5.10 contain the patch.

Workarounds

Disable the image viewer plugin:

jupyter labextension disable @jupyterlab/imageviewer-extension:plugin

Confirm with:

jupyter labextension list

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-gx64-gj6p-pc4c
• https://github.com/jupyterlab/jupyterlab/pull/19184
• https://github.com/jupyterlab/jupyterlab/pull/19185
• https://github.com/jupyterlab/jupyterlab/pull/19186
• https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c
• https://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432
• https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10
• https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2
• https://github.com/advisories/GHSA-gx64-gj6p-pc4c

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

CVE-2026-102830 / GHSA-3jqq-pw4j-pqcj

More information

Details

Description

A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=(n != 1);. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was anchored at the start but not at the end, so it accepted any string that began with a valid plural rule and ignored everything after it.

A header such as the following passed the check, and the part after the plural rule ran in the JupyterLab page as soon as the first plural string was translated:

nplurals=2; plural=(n > 1); <anything here ran as JavaScript>

Users are affected if all of the following are true:

• they run JupyterLab 3.0.0 through 4.6.3, or an application that bundles it such as Notebook 7;
• a language pack they did not write is installed in the environment; and
• that language is selected, so its catalogue is loaded

An installation using the default English locale loads no catalogue and is not affected.

CVE assignment pending, GitHub CNA is experiencing severe backlog

Impact

The code in the header ran in the JupyterLab page, in the same origin and session as the authenticated user. It could call the Jupyter Server REST API as that user: read and write any file under the server root, start a kernel and run code in it, and open a terminal where terminals are enabled. Nothing had to be clicked; translating one plural string was enough, and that happens during normal use of the interface.

What this changes is who has to be trusted. A language pack is a Python package, and installing one is already a privileged act, so an attacker who can get any package installed has server-side code execution regardless of this issue. The header is different because it is catalogue metadata: it travels with translation content, through the translation pipeline that carries strings from Crowdin into the language packs, and it is reviewed as text rather than as code. Anyone able to change a catalogue, or to publish a pack under a name someone installs, got JavaScript execution in every browser that selected that language.

Note: the impact is much more limited on JupyterLite which typically does not have access to most of the surfaces that this flaw exposes.

Patches

JupyterLab v4.6.4 and v4.5.11 contain the patch. The check now has to match the whole header, so a plural rule followed by anything else is rejected and no function is built from it.

JupyterLab 3.x reached end of life and receives no patch. Its users should move to a supported 4.x release.

Users of applications that depend on JupyterLab, such as Notebook v7+, should update jupyterlab package too.

Workarounds

Use the English locale, which loads no catalogue:

jupyter lab --LabApp.default_locale=en

or the following traitlet:

c.LabApp.default_locale = 'en'

Everyone then sees the interface in English, whatever language they had selected.

To check what is installed instead of switching, report any pack whose header carries more than a plural rule:

python -c "
import re
from jupyterlab_server.translation_utils import get_language_packs, get_language_pack
ok = re.compile(r'\s*nplurals\s*=\s*\d+\s*;\s*plural\s*=[\s\-?|&=!<>+*/%:;n0-9_()]+')
packs, _ = get_language_packs()
for locale in packs:
    data, _ = get_language_pack(locale)
    for domain, catalog in (data or {}).items():
        header = catalog.get('', {}).get('plural_forms')
        if header and not ok.fullmatch(header):
            print('SUSPECT', locale, domain, repr(header))
"

The command prints nothing when every catalogue is sound. A line of output names the pack to remove.

Severity

• CVSS Score: 6.8 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

References

• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-3jqq-pw4j-pqcj
• https://nvd.nist.gov/vuln/detail/CVE-2026-102830
• https://github.com/jupyterlab/jupyterlab/commit/985a3223cd77fd4f991cd90066342a90711d70f6
• https://github.com/jupyterlab/jupyterlab/commit/de324ae91346c713c4f5e5485f97b6e914e0f774
• https://github.com/jupyterlab/jupyterlab/commit/f9de43dc565a1118120d466117f877a189a4ce90
• https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.11
• https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.4
• https://github.com/advisories/GHSA-3jqq-pw4j-pqcj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

jupyterlab/jupyterlab (jupyterlab)

v4.5.11

Compare Source

4.5.11

(Full Changelog)

Security fixes

• GHSA-3325-v43h-43rv - moderate
• GHSA-6966-vjj6-99xv - high
• GHSA-jwrc-gm9j-263p - moderate
• GHSA-3jqq-pw4j-pqcj - moderate

Bugs fixed

• Backport of security patches on 4.5.x branch #​19794 (@​krassowski, @​MUFFANUJ)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review.
See our definition of contributors.

(GitHub contributors page for this release)

@​krassowski (activity) | @​MUFFANUJ (activity)

v4.5.10

Compare Source

4.5.10

(Full Changelog)

Security patches

• GHSA-gx64-gj6p-pc4c
• GHSA-89vp-jrxv-24w8
• GHSA-h5v5-8746-g7mm
• GHSA-pppj-hq3g-57pj
• GHSA-whvh-wf3x-g77j

Bugs fixed

• Backport of security patches to 4.5.x branch #​19186 (@​krassowski, @​MUFFANUJ)

Maintenance and upkeep improvements

• Reconfigure 4.5.x branch (4.6.x is new stable) #​19060 (@​krassowski)
• Split external link checks and only run if diff includes a URL #​19029 (@​MUFFANUJ)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review.
See our definition of contributors.

(GitHub contributors page for this release)

@​krassowski (activity) | @​MUFFANUJ (activity)

v4.5.9

Compare Source

4.5.9

(Full Changelog)

Bugs fixed

• Fix jupyter labextension build crash on webpack ≥ 5.107 #​19021 (@​Darshan808, @​krassowski)
• Backport PR #​18992: Fix hidden cells after moving collapsed headings #​19016 (@​MUFFANUJ, @​krassowski)
• Forbid relative URLs in extensionmanager #​19013 (@​Yann-P)
• Fix XSS in extension manager's homepage_url #​19003 (@​Yann-P)
• Fix toolbar popup row clipping in Safari #​18998 (@​arun-357)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review.
See our definition of contributors.

(GitHub contributors page for this release)

@​arun-357 (activity) | @​Darshan808 (activity) | @​krassowski (activity) | @​MUFFANUJ (activity) | @​Yann-P (activity)

v4.5.8

Compare Source

4.5.8

(Full Changelog)

Bugs fixed

• Prevent dialog from hanging when getValue() throws #​18938 (@​AliMahmoudDev)
• Add packaging min version pin #​18910 (@​krassowski)
• Use CSS anchor for prompt overlay #​18840 (@​CrafterKolyan)

Maintenance and upkeep improvements

• Fix completer test failures on CI #​18946 (@​krassowski)
• Bump license webpack plugin #​18929 (@​Darshan808, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review.
See our definition of contributors.

(GitHub contributors page for this release)

@​AliMahmoudDev (activity) | @​CrafterKolyan (activity) | @​Darshan808 (activity) | @​krassowski (activity)

v4.5.7

Compare Source

4.5.7

(Full Changelog)

Security patches

• CVE-2026-42557 GHSA-mqcg-5x36-vfcg
• CVE-2026-42266 GHSA-37w4-hwhx-4rc4
• CVE-2026-40171 GHSA-rch3-82jr-f9w9

Bugs fixed

• Video and Audio Content Providers: Fix JupyterLite support #​18652 (@​martinRenou)
• Fix notebook hang when dropping cells #​18808 (@​MUFFANUJ)
• Fix Contextual Help keyboard shortcut reliability and menu Help functionality #​18747 (@​itsmejay80)
• Fix focusing input element when opening a dialog from Command Palette #​18735 (@​Carreau)
• Fix native context menu blocked even when context menu is suppressed #​18753 (@​utsav-develops)
• Fix flaky toolbar item placement in popup #​18618 (@​filipeoliveira05)
• Update terminal default font family to honor macOS system-wide ui-monospace #​18647 (@​flaviomartins)

Maintenance and upkeep improvements

• Fix linting issue #​18819 (@​krassowski)
• Fix syntax for Python 3.9 on 4.5.x branch #​18817 (@​krassowski)
• Remove unused CodeMirror v5 CSS rule #​18785 (@​Carreau)
• Remove unused CSS rule forgotten after CodeMirror migration #​18763 (@​Carreau)
• Remove unused progress bar CSS rule in execution indicator #​18759 (@​Carreau)
• Remove dead .jp-VariableRenderer-TrustButton CSS rule #​18762 (@​Carreau)
• Remove used .jp-Cell-Placeholder CSS rules #​18761 (@​Carreau)

Documentation improvements

• Fix name of option for extension manager implementation in docs #​18788 (@​krassowski)
• Remove 4.5.0 announcement from docs #​18740 (@​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review.
See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​filipeoliveira05 (activity) | @​flaviomartins (activity) | @​itsmejay80 (activity) | @​jtpio (activity) | @​krassowski (activity) | @​martinRenou (activity) | @​MUFFANUJ (activity) | @​utsav-develops (activity)

v4.5.6

Compare Source

4.5.6

(Full Changelog)

Bugs fixed

• Replace scrollback implementation with scroll anchoring outside of full windowing mode #​18522 (@​krassowski)
• Harmonize translation wrappers in Python files to use gettext methods #​18597 (@​tmetzl)
• Remove unimplemented filebrowser:search command #​18593 (@​krassowski)
• Fix status bar focus outlines #​18585 (@​IsabelParedes)
• Fix filebrowser:create-new-file context menu selector #​18588 (@​jtpio)
• Fix single-character code blocks rendering as empty #​18572 (@​soniya-malviy)
• Hide code input in CodeConsole when configured #​18554 (@​agriyakhetarpal)

Maintenance and upkeep improvements

• Update benchmark snapshots even if base snapshots require changes #​18549 (@​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review.
See our definition of contributors.

(GitHub contributors page for this release)

@​agriyakhetarpal (activity) | @​IsabelParedes (activity) | @​jtpio (activity) | @​krassowski (activity) | @​soniya-malviy (activity) | @​tmetzl (activity)

v4.5.5

Compare Source

4.5.5

(Full Changelog)

Bugs fixed

• Fix theme settings broken in non-English locales #​18530 (@​apoorvdarshan)
• Fix comms subshell resource management on disposal and when changing settings #​18531 (@​krassowski)
• Upgrade @codemirror/view, fixing slow selection when line wrapping is enabled #​18479 (@​krassowski)
• Only turn off overflow anchor when windowing is active [#​18503](https://redirect.github.com/jupyterlab/jupyterlab/pull/185

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: poetry.lock

The current project's Python requirement (>=3.7.10,<3.11) is not compatible with some of the required packages Python requirement:
  - jupyterlab requires Python >=3.10, so it will not be satisfied for Python >=3.7.10,<3.10
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.8, so it will not be satisfied for Python >=3.7.10,<3.8
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.9, so it will not be satisfied for Python >=3.7.10,<3.9
  - jupyterlab requires Python >=3.10, so it will not be satisfied for Python >=3.7.10,<3.10
  - jupyterlab requires Python >=3.10, so it will not be satisfied for Python >=3.7.10,<3.10
  - jupyterlab requires Python >=3.10, so it will not be satisfied for Python >=3.7.10,<3.10
  - jupyterlab requires Python >=3.10, so it will not be satisfied for Python >=3.7.10,<3.10

Because no versions of jupyterlab match >4.0.0,<4.0.1 || >4.0.1,<4.0.2 || >4.0.2,<4.0.3 || >4.0.3,<4.0.4 || >4.0.4,<4.0.5 || >4.0.5,<4.0.6 || >4.0.6,<4.0.7 || >4.0.7,<4.0.8 || >4.0.8,<4.0.9 || >4.0.9,<4.0.10 || >4.0.10,<4.0.11 || >4.0.11,<4.0.12 || >4.0.12,<4.0.13 || >4.0.13,<4.1.0 || >4.1.0,<4.1.1 || >4.1.1,<4.1.2 || >4.1.2,<4.1.3 || >4.1.3,<4.1.4 || >4.1.4,<4.1.5 || >4.1.5,<4.1.6 || >4.1.6,<4.1.7 || >4.1.7,<4.1.8 || >4.1.8,<4.2.0 || >4.2.0,<4.2.1 || >4.2.1,<4.2.2 || >4.2.2,<4.2.3 || >4.2.3,<4.2.4 || >4.2.4,<4.2.5 || >4.2.5,<4.2.6 || >4.2.6,<4.2.7 || >4.2.7,<4.3.0 || >4.3.0,<4.3.1 || >4.3.1,<4.3.2 || >4.3.2,<4.3.3 || >4.3.3,<4.3.4 || >4.3.4,<4.3.5 || >4.3.5,<4.3.6 || >4.3.6,<4.3.7 || >4.3.7,<4.3.8 || >4.3.8,<4.4.0 || >4.4.0,<4.4.1 || >4.4.1,<4.4.2 || >4.4.2,<4.4.3 || >4.4.3,<4.4.4 || >4.4.4,<4.4.5 || >4.4.5,<4.4.6 || >4.4.6,<4.4.7 || >4.4.7,<4.4.8 || >4.4.8,<4.4.9 || >4.4.9,<4.4.10 || >4.4.10,<4.5.0 || >4.5.0,<4.5.1 || >4.5.1,<4.5.2 || >4.5.2,<4.5.3 || >4.5.3,<4.5.4 || >4.5.4,<4.5.5 || >4.5.5,<4.5.6 || >4.5.6,<4.5.7 || >4.5.7,<4.5.8 || >4.5.8,<4.5.9 || >4.5.9,<4.5.10 || >4.5.10,<4.5.11 || >4.5.11,<4.6.0 || >4.6.0,<4.6.1 || >4.6.1,<4.6.2 || >4.6.2,<4.6.3 || >4.6.3,<4.6.4 || >4.6.4,<5.0.0
 and jupyterlab (4.0.0) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.0.1) requires Python >=3.8
 and jupyterlab (4.0.2) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.0.3) requires Python >=3.8
 and jupyterlab (4.0.4) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.0.5) requires Python >=3.8
 and jupyterlab (4.0.6) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.0.7) requires Python >=3.8
 and jupyterlab (4.0.8) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.0.9) requires Python >=3.8
 and jupyterlab (4.0.10) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.0.11) requires Python >=3.8
 and jupyterlab (4.0.12) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.0.13) requires Python >=3.8
 and jupyterlab (4.1.0) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.1.1) requires Python >=3.8
 and jupyterlab (4.1.2) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.1.3) requires Python >=3.8
 and jupyterlab (4.1.4) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.1.5) requires Python >=3.8
 and jupyterlab (4.1.6) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.1.7) requires Python >=3.8
 and jupyterlab (4.1.8) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.2.0) requires Python >=3.8
 and jupyterlab (4.2.1) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.2.2) requires Python >=3.8
 and jupyterlab (4.2.3) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.2.4) requires Python >=3.8
 and jupyterlab (4.2.5) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.2.6) requires Python >=3.8
 and jupyterlab (4.2.7) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.3.0) requires Python >=3.8
 and jupyterlab (4.3.1) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.3.2) requires Python >=3.8
 and jupyterlab (4.3.3) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.3.4) requires Python >=3.8
 and jupyterlab (4.3.5) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.3.6) requires Python >=3.8
 and jupyterlab (4.3.7) requires Python >=3.8, jupyterlab is forbidden.
And because jupyterlab (4.3.8) requires Python >=3.8
 and jupyterlab (4.4.0) requires Python >=3.9, jupyterlab is forbidden.
And because jupyterlab (4.4.1) requires Python >=3.9
 and jupyterlab (4.4.2) requires Python >=3.9, jupyterlab is forbidden.
And because jupyterlab (4.4.3) requires Python >=3.9
 and jupyterlab (4.4.4) requires Python >=3.9, jupyterlab is forbidden.
And because jupyterlab (4.4.5) requires Python >=3.9
 and jupyterlab (4.4.6) requires Python >=3.9, jupyterlab is forbidden.
And because jupyterlab (4.4.7) requires Python >=3.9
 and jupyterlab (4.4.8) requires Python >=3.9, jupyterlab is forbidden.
And because jupyterlab (4.4.9) requires Python >=3.9
 and jupyterlab (4.4.10) requires Python >=3.9, jupyterlab is forbidden.
And because jupyterlab (4.5.0) requires Python >=3.9
 and jupyterlab (4.5.1) requires Python >=3.9, jupyterlab is forbidden.
And because jupyterlab (4.5.2) requires Python >=3.9
 and jupyterlab (4.5.3) requires Python >=3.9, jupyterlab is forbidden.
And because jupyterlab (4.5.4) requires Python >=3.9
 and jupyterlab (4.5.5) requires Python >=3.9, jupyterlab is forbidden.
And because jupyterlab (4.5.6) requires Python >=3.9
 and jupyterlab (4.5.7) requires Python >=3.9, jupyterlab is forbidden.
And because jupyterlab (4.5.8) requires Python >=3.9
 and jupyterlab (4.5.9) requires Python >=3.9, jupyterlab is forbidden.
And because jupyterlab (4.5.10) requires Python >=3.9
 and jupyterlab (4.5.11) requires Python >=3.9, jupyterlab is forbidden.
And because jupyterlab (4.6.0) requires Python >=3.10
 and jupyterlab (4.6.1) requires Python >=3.10, jupyterlab is forbidden.
And because jupyterlab (4.6.2) requires Python >=3.10
 and jupyterlab (4.6.3) requires Python >=3.10, jupyterlab is forbidden.
So, because jupyterlab (4.6.4) requires Python >=3.10
 and godel depends on jupyterlab (^4.0.0), version solving failed.

  • Check your dependencies Python requirement: The Python requirement can be specified via the `python` or `markers` properties
    
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.10,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.8,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.9,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.10,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.10,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.10,<3.11"
    For jupyterlab, a possible solution would be to set the `python` property to ">=3.10,<3.11"

    https://python-poetry.org/docs/dependency-specification/#python-restricted-dependencies,
    https://python-poetry.org/docs/dependency-specification/#using-environment-markers