Debian Patches

Status for jupyterlab/4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-4

Patch Description Author Forwarded Bugs Origin Last update
0001-drop-useless-and-unavailable-plugins.patch drop useless and unavailable plugins Yadd <yadd@debian.org> not-needed 2023-12-19
0002-Use-system-provided-yarn.js.patch use system-provided yarnpkg Yadd <yadd@debian.org> not-needed debian 2024-06-02
0003-fix-package-list.patch fix packages list Yadd <yadd@debian.org> not-needed 2023-09-02
0004-fix-build.patch fix build Yadd <yadd@debian.org> not-needed 2023-05-03
0005-disable-prettier.patch disable prettier Yadd <yadd@debian.org> not-needed 2023-09-02
0006-update-to-vscode-ws-jsonrpc-3.patch update to vscode-ws-jsonrpc 3 Yadd <yadd@debian.org> not-needed 2023-05-08
0007-tsc-workaround.patch tsc workaround Yadd <yadd@debian.org> not-needed 2023-09-02
0008-dont-try-to-update-libs.patch don't try to update @jupyterlab/* libraries Yadd <yadd@debian.org> not-needed 2023-09-20
0009-fix-for-minimatch-9.patch fix for minimatch 9 Yadd <yadd@debian.org> not-needed 2023-12-18
0010-reproducible.patch render build partially reproducible Yadd <yadd@debian.org> not-needed 2024-08-10
0011-fix-for-supports-color-10.patch fix for node-supports-color 10 Xavier Guimard <yadd@debian.org> not-needed debian 2025-11-07
0012-Port-to-glob-10.patch Port to glob@10 Bastien Roucariès <rouca@debian.org> not-needed 2025-12-03
0013-test-timeout.patch Add timeout for test Bastien Roucariès <rouca@debian.org> not-needed 2026-03-21
0014-Port-to-recent-commander.patch Port to recent commander Bastien Roucariès <rouca@debian.org> not-needed 2026-05-22
0015-Remove-filesize-rollup-plugin-depends.patch Remove filesize rollup plugin depends Bastien Roucariès <rouca@debian.org> not-needed 2026-06-04
0016-Disable-mairmaid-support.patch Disable mairmaid support
Not ready for debian		 Bastien Roucariès <rouca@debian.org> not-needed 2026-06-12
0017-Remove-mermaid-from-top-application.patch Remove mermaid from top application Bastien Roucariès <rouca@debian.org> not-needed 2026-06-12
0018-Drop-mermaid.patch Drop mermaid Bastien Roucariès <rouca@debian.org> not-needed 2026-06-13
0019-Fix-test-that-fail.patch Fix test that fail Bastien Roucariès <rouca@debian.org> not-needed 2026-06-13
0020-Avoid-a-webpack-crash.patch Avoid a webpack crash Bastien Roucariès <rouca@debian.org> not-needed 2026-06-19
0021-Fix-a-typescript-error.patch Fix a typescript error Bastien Roucariès <rouca@debian.org> not-needed 2026-06-26
0022-Increase-start-timeout-for-cells.patch Increase start timeout for cells Bastien Roucariès <rouca@debian.org> not-needed 2026-07-20
CVE-2026-40171_CVE-2026-42557.patch Merge commit from fork
* Ask before executing if not trusted

* Add an option to disable command linker in sanitiazer settings

* Add Markdown Viewer trust command

* Nicer dialog

* Simplify

* Clarify

* More rpecise docs

* Fix tests

* Replace relaiance on `.jp-mod-trusted` with a deidcated registry

* Port fix for CVE-2026-40171 / GHSA-rch3-82jr-f9w9 too

* Add `unmarkTrusted()`

* Handle local links directly rather than via command linker

* Mark Markdown cells in trusted notebooks as trusted for command linker purposes		 Michał Krassowski yes upstream backport, https://github.com/jupyterlab/jupyterlab/commit/c5f522db11d0d20a2be5887186952d6b7144b6b6 2026-04-29
CVE-2026-42266.patch Merge commit from fork
* Enforce PyPI naming of extensions on the server side

Prevents installing malicious extensions through git (e.g.
git+https://github.com/attacker/malicious-extension.git) or other URIs.
Primary fix for GHSA-37w4-hwhx-4rc4.

* Enforce that the install version is PEP440-compliant

* Enforce package allowlist/blacklist on server side install

GHSA-37w4-hwhx-4rc4

* Split allowlist logic and PyPI-specific logic

* Ignore ruff's complaint on tmp/local-pkg		 Yann Pellegrini <3519082+Yann-P@users.noreply.github.com> no 2026-04-29
0025-Increase-time-out-for-test.patch Increase time out for test Bastien Roucariès <rouca@debian.org> not-needed 2026-07-22
0026-Fix-build-with-typescript-6.patch Fix build with typescript 6
TypeScript 6 makes "moduleResolution": "node" (a.k.a. node10) a fatal
deprecation error (TS5107), and it also enables "strict" by default,
whereas TypeScript 5 leaves it off.		 Xavier Guimard <yadd@debian.org> not-needed 2026-08-16
CVE-2026-67338.patch Fix XSS in extension manager's `homepage_url` (#19003)
<!--
Thanks for contributing to JupyterLab!
Please fill out the following items to submit a pull request.
See the contributing guidelines for more information:
https://github.com/jupyterlab/jupyterlab/blob/main/CONTRIBUTING.md
-->

<!-- Note issue numbers this pull request addresses (should be at least
one, see contributing guidelines above). -->

<!-- Note any other pull requests that address this issue and how this
pull request is different. -->

https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-vmhf-c436-hxj4

<!-- Describe the code changes and how they address the issue. -->

Restrict protocols in <a href to avoid `javascript:` leading to XSS

<!-- Describe any visual or user interaction changes and how they
address the issue. -->

<!-- For visual changes, include before and after screenshots or
GIF/mp4/other video demo here. -->

Nothing visible

<!-- Describe any backwards-incompatible changes to JupyterLab public
APIs. -->

- **NO**: Some or all of the content of this PR was generated by AI.
- **NO**: The human author has carefully reviewed this PR and run this
code (keep this PR "draft" until the answer is YES)
- AI tools and models used: <!-- FILL IN -->

Security note: opening this as a regular PR on purpose as the vuln is
minor and GHSAs are a pain to work with: no CI, easy to miss private
forks when releasing a new version.		 Yann Pellegrini <3519082+Yann-P@users.noreply.github.com> no 2026-06-10
CVE-2026-73415_73416_73417_73626_73627.patch Backport of security patches to `4.5.x` branch (#19186)
Fixes for:
- GHSA-gx64-gj6p-pc4c
- GHSA-89vp-jrxv-24w8
- GHSA-h5v5-8746-g7mm
- GHSA-pppj-hq3g-57pj
- GHSA-whvh-wf3x-g77j

Slight departure from normal process due to GitHub private forks being
broken, see https://github.com/jupyter/security/issues/126.		 Michał Krassowski no https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c 2026-07-21

All known versions for source package 'jupyterlab'

Links