Debian Patches

Status for jupyterlab/4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-1

Patch Description Author Forwarded Bugs Origin Last update
0001-drop-useless-and-unavailable-plugins.patch drop useless and unavailable plugins Yadd <yadd@debian.org> not-needed 2023-12-19
0002-Use-system-provided-yarn.js.patch use system-provided yarnpkg Yadd <yadd@debian.org> not-needed debian 2024-06-02
0003-fix-package-list.patch fix packages list Yadd <yadd@debian.org> not-needed 2023-09-02
0004-fix-build.patch fix build Yadd <yadd@debian.org> not-needed 2023-05-03
0005-disable-prettier.patch disable prettier Yadd <yadd@debian.org> not-needed 2023-09-02
0006-update-to-vscode-ws-jsonrpc-3.patch update to vscode-ws-jsonrpc 3 Yadd <yadd@debian.org> not-needed 2023-05-08
0007-tsc-workaround.patch tsc workaround Yadd <yadd@debian.org> not-needed 2023-09-02
0008-dont-try-to-update-libs.patch don't try to update @jupyterlab/* libraries Yadd <yadd@debian.org> not-needed 2023-09-20
0009-fix-for-minimatch-9.patch fix for minimatch 9 Yadd <yadd@debian.org> not-needed 2023-12-18
0010-reproducible.patch render build partially reproducible Yadd <yadd@debian.org> not-needed 2024-08-10
0011-fix-for-supports-color-10.patch fix for node-supports-color 10 Xavier Guimard <yadd@debian.org> not-needed debian 2025-11-07
0012-Port-to-glob-10.patch Port to glob@10 Bastien Roucariès <rouca@debian.org> not-needed 2025-12-03
0013-test-timeout.patch Add timeout for test Bastien Roucariès <rouca@debian.org> not-needed 2026-03-21
0014-Port-to-recent-commander.patch Port to recent commander Bastien Roucariès <rouca@debian.org> not-needed 2026-05-22
0015-Remove-filesize-rollup-plugin-depends.patch Remove filesize rollup plugin depends Bastien Roucariès <rouca@debian.org> not-needed 2026-06-04
0016-Disable-mairmaid-support.patch Disable mairmaid support
Not ready for debian		 Bastien Roucariès <rouca@debian.org> not-needed 2026-06-12
0017-Remove-mermaid-from-top-application.patch Remove mermaid from top application Bastien Roucariès <rouca@debian.org> not-needed 2026-06-12
0018-Drop-mermaid.patch Drop mermaid Bastien Roucariès <rouca@debian.org> not-needed 2026-06-13
0019-Fix-test-that-fail.patch Fix test that fail Bastien Roucariès <rouca@debian.org> not-needed 2026-06-13
0020-Avoid-a-webpack-crash.patch Avoid a webpack crash Bastien Roucariès <rouca@debian.org> not-needed 2026-06-19
0021-Fix-a-typescript-error.patch Fix a typescript error Bastien Roucariès <rouca@debian.org> not-needed 2026-06-26
0022-Increase-start-timeout-for-cells.patch Increase start timeout for cells Bastien Roucariès <rouca@debian.org> not-needed 2026-07-20
CVE-2026-40171_CVE-2026-42557.patch Merge commit from fork
* Ask before executing if not trusted

* Add an option to disable command linker in sanitiazer settings

* Add Markdown Viewer trust command

* Nicer dialog

* Simplify

* Clarify

* More rpecise docs

* Fix tests

* Replace relaiance on `.jp-mod-trusted` with a deidcated registry

* Port fix for CVE-2026-40171 / GHSA-rch3-82jr-f9w9 too

* Add `unmarkTrusted()`

* Handle local links directly rather than via command linker

* Mark Markdown cells in trusted notebooks as trusted for command linker purposes		 Michał Krassowski yes upstream backport, https://github.com/jupyterlab/jupyterlab/commit/c5f522db11d0d20a2be5887186952d6b7144b6b6 2026-04-29
CVE-2026-42266.patch Merge commit from fork
* Enforce PyPI naming of extensions on the server side

Prevents installing malicious extensions through git (e.g.
git+https://github.com/attacker/malicious-extension.git) or other URIs.
Primary fix for GHSA-37w4-hwhx-4rc4.

* Enforce that the install version is PEP440-compliant

* Enforce package allowlist/blacklist on server side install

GHSA-37w4-hwhx-4rc4

* Split allowlist logic and PyPI-specific logic

* Ignore ruff's complaint on tmp/local-pkg		 Yann Pellegrini <3519082+Yann-P@users.noreply.github.com> no 2026-04-29

All known versions for source package 'jupyterlab'

Links