jupyterlab (4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-4) unstable; urgency=high

  [ Alexandre Detiste ]
  * Salsa CI: test the nocheck profile

  [ Xavier Guimard ]
  * Declare compliance with policy 4.7.4
  * Drop "Rules-Requires-Root: no"
  * Drop "Priority: optional"
  * Fix build with typescript 6

  [ Bastien Roucariès ]
  * Security fixes (Closes: #1144343)
  * Fix CVE-2026-67338:
    Jupyterlab contains a stored cross-site scripting vulnerability
    in the Extension Manager that fails to validate URI protocols in
    package metadata URLs. Attackers can publish malicious PyPI packages
    with javascript: URLs in project metadata that execute arbitrary
    JavaScript in the JupyterLab origin when users click the extension name.
  * Fix CVE-2026-73415:
    In packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer
    uses URL.createObjectURL for a specially crafted SVG image and
    revokes the blob URL too early, allowing the image to retain
    an executable same-origin context when it is opened through
    the image viewer and then opened in a new browser tab.
    The resulting cross-site scripting can be used to execute
    arbitrary code on the JupyterLab server
  * Fix CVE-2026-73416:
    jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py,
    JupyterLab's PyPI extension manager enforces blocked_extensions_uris
    by comparing requested install names to blocklist entries with custom
    normalization that is weaker than PyPI package-name canonicalization.
    An authenticated user can request a PyPI-equivalent spelling such as
    JupyterLab.Git for a blocklisted package such as jupyterlab-git,
    and JupyterLab accepts the install request even
    though pip resolves the variant to the same package.
    Security impact requires an allowlist or blocklist intended
    to restrict package installation, the PyPI Extension Manager, and kernels
    and terminals that are disabled or delegated to remote hosts.
    The bypass lets an authenticated
    user install a prohibited extension, defeat integrity restrictions,
    and affect availability without gaining new read access.
  * Fix CVE-2026-73417:
    JupyterLab allows notebook settings to be shared and applied through an
    overrides.json file using the Import button in the Settings Editor.
    In packages/notebook-extension/schema/tracker.json and
    packages/notebook-extension/src/index.ts, the sideBySideLeftMarginOverride
    and sideBySideRightMarginOverride settings are not properly
    validated before being inserted into style content, allowing
    a crafted settings file to contain instructions that execute as code
    instead of only changing display preferences. A user can import the
    malicious file, or an attacker with access to a shared settings
    location can plant an overrides.json that is applied automatically.
    The embedded code runs with the affected user's access and can read
    or modify notebooks and files and run code through the notebook server,
    including on a connected kernel.
  * Fix CVE-2026-73626:
    A missing 'await' caused the is_install_allowed coroutine to never
    execute, so the extension allowlist/blocklist check was not enforced
    for direct callers of install(). The stock JupyterLab HTTP API and
    Extension Manager UI are not affected, as they perform a separate,
    correctly awaited check.
  * Fix CVE-2026-73627:
    A plugin manager lock-rule enforcement bypass.
    Two server-side enforcement gaps allow an authenticated user to
    circumvent administrator lock rules by making direct requests to the
    /lab/api/plugins endpoint, enabling or disabling plugins that were locked,
    including child plugins of multi-plugin extensions and plugins locked
    via the 'lock all' mechanism.

 -- Bastien Roucariès <rouca@debian.org>  Sun, 16 Aug 2026 13:18:21 +0200

jupyterlab (4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3) unstable; urgency=medium

  * Upload to unstable
  * Do not run slow test on slow arch
  * Fix CVE-2026-40171:
    Command linker attributes chained with help command enable
    one-click authentication token theft
  * Fix CVE-2026-42266:
    JupyterLab has an Extension Manager API/GUI Policy Discrepancy,
    allowing 3rd party (malicious) extensions install via POST request 
  * Fix CVE-2026-42557:
    Command linker attributes in HTML enable one-click command
    execution from untrusted content

 -- Bastien Roucariès <rouca@debian.org>  Tue, 28 Jul 2026 10:11:40 +0200

jupyterlab (4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-2) experimental; urgency=medium

  * Increase timeout for test

 -- Bastien Roucariès <rouca@debian.org>  Wed, 22 Jul 2026 23:41:17 +0200

jupyterlab (4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-1) experimental; urgency=medium

  * New upstream release
  * Fix CVE-2026-40171:
    Command linker attributes chained with help command enable
    one-click authentication token theft
  * Fix CVE-2026-42266:
    JupyterLab has an Extension Manager API/GUI Policy Discrepancy,
    allowing 3rd party (malicious) extensions install via POST request 
  * Fix CVE-2026-42557:
    Command linker attributes in HTML enable one-click command
    execution from untrusted content

 -- Bastien Roucariès <rouca@debian.org>  Tue, 21 Jul 2026 18:57:10 +0200

jupyterlab (4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4-1) experimental; urgency=medium

  * New upstream release
  * Fix CVE-2025-59842:
    Links generated with LaTeX typesetters in Markdown files and
    Markdown cells in JupyterLab and Jupyter Notebook did not include
    the noopener attribute.
    (Closes: #1118967)

 -- Bastien Roucariès <rouca@debian.org>  Mon, 20 Jul 2026 13:43:19 +0200

jupyterlab (4.4.1+ds1+~3.0.5+~0.16.6+~cs1.4.4-1) experimental; urgency=medium

  * New upstream release

 -- Bastien Roucariès <rouca@debian.org>  Sun, 12 Jul 2026 02:29:30 +0200

jupyterlab (4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-8) unstable; urgency=medium

  * Avoid some test on slow architecture

 -- Bastien Roucariès <rouca@debian.org>  Fri, 24 Jul 2026 13:28:36 +0200

jupyterlab (4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-7) unstable; urgency=high

  * Increase timeout for individual test fixing autopkgtest on slow
    architecture.

 -- Bastien Roucariès <rouca@debian.org>  Wed, 22 Jul 2026 22:15:12 +0200

jupyterlab (4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-6) unstable; urgency=high

  * Increase timeout for individual test fixing FTBFS

 -- Bastien Roucariès <rouca@debian.org>  Mon, 20 Jul 2026 10:51:23 +0200

jupyterlab (4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-5) unstable; urgency=high

  * Increase timeout for slow architecture

 -- Bastien Roucariès <rouca@debian.org>  Sun, 19 Jul 2026 17:14:06 +0200

jupyterlab (4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-4) unstable; urgency=medium

  * Use xterm > 5.5.0

 -- Bastien Roucariès <rouca@debian.org>  Thu, 09 Jul 2026 10:52:30 +0200

jupyterlab (4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-3) unstable; urgency=medium

  * Add autopkgtest for @jupyterlab packages

 -- Bastien Roucariès <rouca@debian.org>  Fri, 26 Jun 2026 14:21:35 +0200

jupyterlab (4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-2) unstable; urgency=medium

  * Add more test
  * Fix marked and python httpx breakage

 -- Bastien Roucariès <rouca@debian.org>  Wed, 24 Jun 2026 11:17:33 +0200

jupyterlab (4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-1) unstable; urgency=medium

  * New upstream version
  * Upload to unstable

 -- Bastien Roucariès <rouca@debian.org>  Tue, 16 Jun 2026 23:04:22 +0200

jupyterlab (4.1.3+ds1+~2.0.1+~0.15.3+~cs1.4.4-1) experimental; urgency=medium

  * New upstream version
  * Add component jupyter-ui-toolkit

 -- Bastien Roucariès <rouca@debian.org>  Mon, 01 Jun 2026 11:39:31 +0200

jupyterlab (4.0.13+ds1+~2.0.1+~cs1.4.4-1) unstable; urgency=medium

  * New upstream version

 -- Bastien Roucariès <rouca@debian.org>  Mon, 01 Jun 2026 11:07:02 +0200

jupyterlab (4.0.11+ds5+~cs11.25.27-1) unstable; urgency=medium

  * Remove systeminformation

 -- Bastien Roucariès <rouca@debian.org>  Wed, 27 May 2026 00:28:57 +0200

jupyterlab (4.0.11+ds4+~cs11.25.27-4) unstable; urgency=high

  * Fix a transition bug and conflict bug for systeminformation

 -- Bastien Roucariès <rouca@debian.org>  Tue, 26 May 2026 11:43:18 +0200

jupyterlab (4.0.11+ds4+~cs11.25.27-3) unstable; urgency=high

  * Sourcefull build

 -- Bastien Roucariès <rouca@debian.org>  Tue, 26 May 2026 08:44:33 +0200

jupyterlab (4.0.11+ds4+~cs11.25.27-2) unstable; urgency=medium

  * Binary upload for fixing breakage with systeminfomation
  * Manually install systeminformation under galata

 -- Bastien Roucariès <rouca@debian.org>  Mon, 25 May 2026 21:39:26 +0200

jupyterlab (4.0.11+ds4+~cs11.25.27-1) unstable; urgency=medium

  * Embed temporary systeminformation to break build loop

 -- Bastien Roucariès <rouca@debian.org>  Mon, 25 May 2026 18:59:24 +0200

jupyterlab (4.0.11+ds3+~cs11.25.27-1) unstable; urgency=medium

  * Team upload
  * Deembed systeminformation

 -- Bastien Roucariès <rouca@debian.org>  Mon, 25 May 2026 13:07:11 +0200

jupyterlab (4.0.11+ds2+~cs11.25.27-3) unstable; urgency=medium

  * Team upload
  * Fix multiple FTBFS
  * Bug fix: "FTBFS: error TS2345", thanks to Santiago Vila
    (Closes: #1131655).
  * Bug fix: "Please fix Maintainer field email address to avoid future
    confusion", thanks to Jérémy Lal (Closes: #1109823).
  * Bug fix: "control Vcs-Browser please update link", thanks to onders
    (Closes: #1130626).

 -- Bastien Roucariès <rouca@debian.org>  Fri, 22 May 2026 15:23:23 +0200

jupyterlab (4.0.11+ds2+~cs11.25.27-2) unstable; urgency=medium

  * Team upload
  * Add test for some package at build

 -- Bastien Roucariès <rouca@debian.org>  Sun, 08 Mar 2026 13:05:45 +0100

jupyterlab (4.0.11+ds2+~cs11.25.27-1) unstable; urgency=medium

  * Team upload
  * Remove duplicate-package-checker-webpack-plugin embded
    package

 -- Bastien Roucariès <rouca@debian.org>  Sat, 07 Mar 2026 14:34:54 +0100

jupyterlab (4.0.11+ds1+~cs11.25.27-9) unstable; urgency=medium

  * Team upload
  * Port to glob@10

 -- Bastien Roucariès <rouca@debian.org>  Wed, 03 Dec 2025 18:37:32 +0100

jupyterlab (4.0.11+ds1+~cs11.25.27-8) unstable; urgency=medium

  * Add node-supports-color into dependencies and add a patch for
    node-supports-color >= 11 (Closes: #1119742)

 -- Yadd <yadd@debian.org>  Fri, 07 Nov 2025 15:18:12 +0100

jupyterlab (4.0.11+ds1+~cs11.25.27-7) unstable; urgency=medium

  * Team upload
  [ Jérémy Lal ]
  * Fix build of bundled browser module (Closes: #1102558).
    Adds a webpack plugin to support modules prefixed by "node:".

  [ Picca Frédéric-Emmanuel ]
  * switch to the upstream (hatchling) build system.
    - now jupyterlab is well integrated with jupyterhub
    - do not install examples at the wrong place.
    - the Python dist-info are right.
  * Bug fix: "missing four files from upstream distribution", thanks to
    Julian Gilbey (Closes: #1101429).
  * Bug fix: "advertises Python package version as 0.0.0", thanks to
    Julian Gilbey (Closes: #1086709).
  * Bug fix: "installs examples into dist-packages", thanks to Piotr
    Ożarowski (Closes: #1102934).
  * d/control: B-D on webpack (>= 5.97.1+dfsg1+~cs11.18.27-3~)

 -- Picca Frédéric-Emmanuel <picca@debian.org>  Thu, 05 Jun 2025 14:45:20 +0200

jupyterlab (4.0.11+ds1+~cs11.25.27-6) unstable; urgency=medium

  * Declare compliance with policy 4.7.2
  * Fix webpack/commonjs config (Closes: #1101851)
  * Clean temporary files -m (Closes: #1101816)

 -- Yadd <yadd@debian.org>  Wed, 02 Apr 2025 18:46:10 +0200

jupyterlab (4.0.11+ds1+~cs11.25.27-5) unstable; urgency=medium

  * Add dependency on python3-notebook.

 -- Roland Mas <lolando@debian.org>  Sat, 22 Mar 2025 14:40:05 +0100

jupyterlab (4.0.11+ds1+~cs11.25.27-4) unstable; urgency=medium

  * debian/watch: replace /releases by /tags in GitHub urls
  * Add dependency to node-license-webpack-plugin

 -- Yadd <yadd@debian.org>  Thu, 26 Dec 2024 06:14:42 +0100

jupyterlab (4.0.11+ds1+~cs11.25.27-3) unstable; urgency=medium

  * Fix CVE-2024-43805 (Closes: #1082871)

 -- Yadd <yadd@debian.org>  Mon, 25 Nov 2024 15:00:57 +0100

jupyterlab (4.0.11+ds1+~cs11.25.27-2) unstable; urgency=medium

  * Require well build @codemirror/language and @codemirror/view
    (Closes: #1078077)

 -- Yadd <yadd@debian.org>  Mon, 26 Aug 2024 06:11:09 +0400

jupyterlab (4.0.11+ds1+~cs11.25.27-1) unstable; urgency=medium

  * First version of Jupyterlab that merges python3-jupyterlab and
    node-jupyterlab
  * Rename source and package into jupyterlab
  * Change maintainer to Debian PAN Maintainer
    <debian-pan-maintainers@alioth-lists.debian.net>

  [ Roland Mas ]
  * Update debian/watch to cope with the github "tags" page being full of
    tags that are not relevant to us.

  [ Yadd ]
  * Declare compliance with policy 4.7.0
  * New upstream version 4.0.11+ds1+~cs11.25.27
  * Refresh patches
  * Merge python3-jupyterlab and node-jupyterlab
  * Add patch to use system yarnpkg or an arbitrary command given by arg
    (Closes: #1060772)
  * Increase Node.js memory for i386 build
  * Add build dependency to:
    - python3-jupyter-server
    - python3-async-lru
    - python3-jupyterlab-server
    - python3-notebook-shim
  * Increase Node.js memory use to fix i386 build
  * Launch also "jupyter-labextension build galata/extension"
  * Replace html-loader pre-processing by a custom script (see #1078077)

 -- Yadd <yadd@debian.org>  Mon, 12 Aug 2024 16:35:17 +0400

python3-jupyterlab (4.0.11+ds1-2) unstable; urgency=medium

  * Improve error detection in d/rules.
  * Bug fix: "Use node-long package", thanks to Bastien Roucariès (Closes:
    #1067017).
  * Bug fix: "use pacckaged node-call-bind (provided package)", thanks to
    Bastien Roucariès (Closes: #1067019).
  * Bug fix: "please use node-get-intrinsic", thanks to Bastien Roucariès
    (Closes: #1067020).

 -- Roland Mas <lolando@debian.org>  Tue, 19 Mar 2024 16:49:20 +0100

python3-jupyterlab (4.0.11+ds1-1) unstable; urgency=medium

  * New upstream release.
  * Bug fix: "CVE-2024-22420 CVE-2024-22421", thanks to Salvatore
    Bonaccorso (Closes: #1061221).

 -- Roland Mas <lolando@debian.org>  Mon, 22 Jan 2024 13:52:19 +0100

node-jupyterlab (4.0.10+ds1+~cs11.25.27-1) unstable; urgency=medium

  * New upstream version 4.0.10+ds1+~cs11.25.27
  * Unfuzz patches

 -- Yadd <yadd@debian.org>  Tue, 09 Jan 2024 09:28:06 +0400

python3-jupyterlab (4.0.10+ds1-1) unstable; urgency=medium

  * New upstream release.

 -- Roland Mas <lolando@debian.org>  Fri, 12 Jan 2024 16:01:12 +0100

node-jupyterlab (4.0.9+ds1+~cs11.25.24-2) unstable; urgency=medium

  * Fix autopkgtest
  * Fix copyright paths
  * Update lintian overrides

 -- Yadd <yadd@debian.org>  Wed, 20 Dec 2023 13:18:48 +0400

node-jupyterlab (4.0.9+ds1+~cs11.25.24-1) unstable; urgency=medium

  * Embed duplicate-package-checker-webpack-plugin and systeminformation

 -- Yadd <yadd@debian.org>  Tue, 19 Dec 2023 11:51:43 +0400

node-jupyterlab (4.0.9+ds1+~cs3.4.4-1) unstable; urgency=medium

  * Remove patch fix-node-xterm-paths.patch that is missing
    from debian/patches/series
  * New upstream version 4.0.9+ds1+~cs3.4.4
  * Add patch for minimatch >= 9
  * Update lintian overrides
  * Require node-typestyle >= 2.4.0+ds+~3.0.10~
  * Upload to unstable

 -- Yadd <yadd@debian.org>  Tue, 19 Dec 2023 08:10:53 +0400

python3-jupyterlab (4.0.9+ds1-2) unstable; urgency=medium

  * Run jupyter-labextension build at package build time.

 -- Roland Mas <lolando@debian.org>  Wed, 03 Jan 2024 17:06:14 +0100

python3-jupyterlab (4.0.9+ds1-1) unstable; urgency=medium

  * New upstream release.

 -- Roland Mas <lolando@debian.org>  Tue, 26 Dec 2023 14:50:00 +0100

python3-jupyterlab (4.0.8+ds1-3) UNRELEASED; urgency=medium

  * Add missing Build-Depends.
  * Pre-build Jupyterlab assets at package build time.
  * Bug fix: "Jupyter lab does not start up", thanks to Christian Holm
    Christensen (Closes: #1060390).

 -- Roland Mas <lolando@debian.org>  Tue, 26 Dec 2023 14:45:22 +0100

python3-jupyterlab (4.0.8+ds1-2) unstable; urgency=medium

  * Update debian/copyright slightly.

 -- Roland Mas <lolando@debian.org>  Tue, 14 Nov 2023 11:44:52 +0100

python3-jupyterlab (4.0.8+ds1-1) unstable; urgency=medium

  * New upstream release.
  * Exclude yarn.js.

 -- Roland Mas <lolando@debian.org>  Sat, 11 Nov 2023 14:10:59 +0100

node-jupyterlab (4.0.5+ds1+~cs2.4.6-3) experimental; urgency=medium

  * Build:
    + @jupyterlab/galata
    + @jupyterlab/galata-extension
    + @jupyterlab/buildutils
  * Add build dependencies to:
    + node-playwright
    + node-stdlib
  * Embed systeminformation for build only
  * Add patch to don't try to update @jupyterlab/* libraries
  * Set dependencies

 -- Yadd <yadd@debian.org>  Wed, 20 Sep 2023 11:44:37 +0400

node-jupyterlab (4.0.5+ds1+~cs2.4.6-2) experimental; urgency=medium

  * Build:
    + @jupyterlab/terminal
    + @jupyterlab/terminal-extension
    + @jupyterlab/metapackage
    + @jupyterlab/mathjax-extension
    + @jupyterlab/application-top
  * Add build dependencies to:
    + node-xterm >= 5
    + node-d3-delaunay
    + node-d3-geo-projection
    + node-find-root
    + node-html-loader
    + node-mathjax-full
    + node-micromatch
    + node-path-browserify
    + node-process
    + node-sort-package-json
    , node-source-map-loader
    + node-style-loader
    + node-xterm >= 5

 -- Yadd <yadd@debian.org>  Mon, 18 Sep 2023 12:29:39 +0400

node-jupyterlab (4.0.5+ds1+~cs2.4.6-1) experimental; urgency=medium

  * Build:
    + @jupyterlab/debugger, @jupyterlab/debugger-extension
    + @jupyterlab/template
    + @jupyterlab/tooltip-extension
    + @jupyterlab/builder
    + @jupyterlab/json-extension
    + @jupyterlab/vega5-extension
    + @jupyterlab/testing
  * Embed mini-svg-data-uri
  * Add build dependencies:
    + node-geojson, node-lodash-packages, node-react-json-tree,
      node-simulate-event, node-vega, node-vega-lite, node-vega-embed,
      node-vscode-debugprotocol, node-xtend

 -- Yadd <yadd@debian.org>  Wed, 13 Sep 2023 13:52:06 +0400

node-jupyterlab (4.0.5+ds1+~1.0.2-1) experimental; urgency=medium

  * debian/watch: no alpha releases
  * New upstream version 4.0.5+ds1+~1.0.2
  * Update patches

 -- Yadd <yadd@debian.org>  Sat, 02 Sep 2023 07:47:19 +0400

node-jupyterlab (4.0.2+ds1+~1.0.2-2) experimental; urgency=medium

  * build @jupyterlab/nconvert-css

 -- Yadd <yadd@debian.org>  Mon, 17 Jul 2023 18:00:27 +0400

node-jupyterlab (4.0.2+ds1+~1.0.2-1) experimental; urgency=medium

  * New upstream version 4.0.2+ds1+~1.0.2
  * Unfuzz patches
  * Add build dependency to node-lezer-markdown

 -- Yadd <yadd@debian.org>  Fri, 14 Jul 2023 10:41:37 +0400

node-jupyterlab (4.0.0~rc1+ds1+~1.0.2-1) experimental; urgency=medium

  * Initial release (Closes: #1035651)

 -- Yadd <yadd@debian.org>  Wed, 05 Jul 2023 15:43:54 +0400

python3-jupyterlab (3.6.3-4) unstable; urgency=medium

  * Add missing runtime dependency on node-jupyterlab.

 -- Roland Mas <lolando@debian.org>  Fri, 21 Jul 2023 18:27:15 +0200

python3-jupyterlab (3.6.3-3) unstable; urgency=medium

  * Clean up build-dependencies since the Javascript parts are no longer
    built from this source package.

 -- Roland Mas <lolando@debian.org>  Fri, 21 Jul 2023 18:14:12 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog jupyterlab`.
