Skip to content

[Snyk] Security upgrade jupyterlab from 3.6.8 to 4.4.8 #68

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: dev
Choose a base branch
from
Open

[Snyk] Security upgrade jupyterlab from 3.6.8 to 4.4.8 #68

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion requires-ci.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,4 +18,4 @@ pytest-sugar==0.9.6
pyzmq==25.1.2
xlrd>=2.0.1
pytest-rerunfailures
jupyterlab<4.0.0
jupyterlab<4.4.8
Copy link

@gemini-code-assist gemini-code-assist bot Sep 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

This change introduces two critical issues:

  1. Breaking Change: This allows upgrading to JupyterLab v4.x, which is a major version with breaking changes, especially for extensions. The project's JupyterLab extension (@plotly/dash-jupyterlab) is only compatible with JupyterLab v2/v3 (as seen in dash/labextension/package.json which specifies "@jupyterlab/application": "^2.0.0 || ^3.0.0"). This will likely break your CI pipeline.

  2. Ineffective Security Fix: The constraint jupyterlab<4.4.8 does not guarantee a secure version will be installed. It allows any version older than 4.4.8, including potentially vulnerable ones. For a security fix, it's better to pin to a specific fixed version (e.g., jupyterlab==4.4.7) or enforce a minimum version (e.g., jupyterlab>=4.4.7,<5.0.0).

Recommendation:
Do not merge this PR as is. The jupyterlab dependency should be constrained to a 3.x version that contains the security fix, if one exists, to avoid the major version jump. If the fix is only available in v4, the JupyterLab extension must be updated for compatibility, which is a larger effort.