v4.6.2
Fixed 7
- Fix resolving platform-specific shortcuts in keyboard shortcuts
- Clear stale Table of Contents error markers
- Fix stale document load after rename during initialization
- Fix notebook initialization stealing focus
- Fix spurious 3s kernel restart delay
- Fix bottom activity bar restoring as collapsed
- Handle invalid file browser drag target
Security 5
- Fix image viewer XSS vulnerability when opening malicious image in new browser tab
- Fix PyPI extension blocklist package-name canonicalization bypass
- Fix PluginManager lock-rule enforcement bypass
- Fix cross-site scripting (XSS) vulnerability via crafted settings file (overrides.json)
- Fix allowlist/blocklist check in PyPIExtensionManager.install() not enforced for direct callers
4.6.2
Security patches
- GHSA-gx64-gj6p-pc4c: Image viewer allows XSS when opening malicious image in new browser tab
- GHSA-89vp-jrxv-24w8: PyPI extension blocklist package-name canonicalization bypass
- GHSA-h5v5-8746-g7mm: PluginManager lock-rule enforcement bypass
- GHSA-pppj-hq3g-57pj: Cross-site scripting (XSS) via crafted settings file (
overrides.json) - GHSA-whvh-wf3x-g77j: Allowlist/blocklist check in
PyPIExtensionManager.install()not enforced for direct callers (missingawait)
Bugs fixed
- Backport of security patches to
4.6.xbranch #19185 (@krassowski, @MUFFANUJ) - Fix resolving platform-specific shortcuts in keyboard shortcuts #19112 (@krassowski)
- Clear stale Table of Contents error markers #19143 (@MUFFANUJ)
- Fix stale document load after rename during initialization #19144 (@MUFFANUJ)
- Fix notebook initialization stealing focus #19149 (@MUFFANUJ)
- Fix spurious 3s kernel restart delay #19126 (@afshin)
- Stabilize Open in Terminal Galata test on Firefox #19152 (@MUFFANUJ)
- Fix bottom activity bar restoring as collapsed #19136 (@MUFFANUJ)
- Handle invalid file browser drag target #19122 (@GagandeepSingh20)
- Stabilize flaky Firefox notebook Galata tests #19008 (@MUFFANUJ)
Maintenance and upkeep improvements
Documentation improvements
- Fix a typo in release notes #19116 (@krassowski)
- Update migration guide - 4.6 was released #19108 (@krassowski)
Other merged PRs
- Bump brace-expansion from 1.1.11 to 1.1.16 in /jupyterlab/tests/mock_packages/test_no_hyphens #19179 (@dependabot[bot])
- Bump axios from 1.16.0 to 1.18.1 #19178 (@dependabot[bot])
Contributors to this release
The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.
(GitHub contributors page for this release)
@afshin (activity) | @GagandeepSingh20 (activity) | @jtpio (activity) | @krassowski (activity) | @MUFFANUJ (activity)