Update dependency jupyter-server to v1.15.4 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
jupyter-server	==1.12.0 -> ==1.15.4

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2022-24757

Impact

What kind of vulnerability is it?

Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter Server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server.

Patches

Has the problem been patched? What versions should users upgrade to?

Upgrade to Jupyter Server version 1.15.4

For more information

If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list [email protected].

Credit: @​3coins for reporting. Thank you!

---

Release Notes

jupyter-server/jupyter_server (jupyter-server)

v1.15.4

Compare Source

v1.15.3

Compare Source

(Full Changelog)

Bugs fixed

• Fix server-extension paths (3rd time's the charm) #​734 (@​minrk)
• Revert "Server extension paths (#​730)" #​732 (@​blink1073)

Maintenance and upkeep improvements

• Avoid usage of ipython_genutils #​718 (@​blink1073)

Contributors to this release

(GitHub contributors page for this release)

@​blink1073 | @​codecov-commenter | @​minrk

v1.15.2

Compare Source

(Full Changelog)

Bugs fixed

• Server extension paths #​730 (@​minrk)
• allow handlers to work without an authorizer in the Tornado settings #​717 (@​Zsailer)

Maintenance and upkeep improvements

• Skip nbclassic downstream tests for now #​725 (@​blink1073)

Contributors to this release

(GitHub contributors page for this release)

@​blink1073 | @​minrk | @​Zsailer

v1.15.1

Compare Source

(Full Changelog)

Bugs fixed

• Revert "Reuse ServerApp.config_file_paths for consistency (#​715)" #​728 (@​blink1073)

Contributors to this release

(GitHub contributors page for this release)

@​blink1073

v1.15.0

Compare Source

(Full Changelog)

New features added

• Add authorization layer to server request handlers #​165 (@​Zsailer)

Enhancements made

• Validate notebooks once per fetch or save #​724 (@​kevin-bates)
• Register pre/post save hooks, call them sequentially #​696 (@​davidbrochart)

Bugs fixed

• Implement Required Methods in Async Manner #​721 (@​jhamet93)
• Call pre_save_hook only on first chunk of large files #​716 (@​davidbrochart)
• Reuse ServerApp.config_file_paths for consistency #​715 (@​minrk)
• serverapp: Use .absolute() instead of .resolve() for symlinks #​712 (@​EricCousineau-TRI)
• Fall back to legacy protocol if selected_subprotocol raises exception #​706 (@​davidbrochart)
• Fix FilesHandler not meet RFC 6713 #​701 (@​Wh1isper)

Maintenance and upkeep improvements

• Clean up CI #​723 (@​blink1073)
• Clean up activity recording #​722 (@​blink1073)
• Clean up Dependency Handling #​707 (@​blink1073)
• Add Minimum Requirements Test #​704 (@​blink1073)
• Clean up handling of tests #​700 (@​blink1073)
• Refresh precommit #​698 (@​blink1073)
• Use pytest-github-actions-annotate-failures #​694 (@​blink1073)

Documentation improvements

• Add WebSocket wire protocol documentation #​693 (@​davidbrochart)

Contributors to this release

(GitHub contributors page for this release)

@​blink1073 | @​codecov-commenter | @​davidbrochart | @​echarles | @​EricCousineau-TRI | @​jhamet93 | @​kevin-bates | @​minrk | @​vidartf | @​welcome | @​Wh1isper | @​Zsailer

v1.13.5

Compare Source

(Full Changelog)

Enhancements made

• Protocol alignment #​657 (@​davidbrochart)

Bugs fixed

• Fix to remove potential memory leak on Jupyter Server ZMQChannelHandler code #​682 (@​Vishwajeet0510)
• Pin pywintpy for now #​681 (@​blink1073)
• Fix the non-writable path deletion error #​670 (@​vkaidalov)
• make unit tests backwards compatible without pending kernels #​669 (@​Zsailer)

Maintenance and upkeep improvements

• Clean up full install test #​689 (@​blink1073)
• Update trigger_precommit.yml #​687 (@​blink1073)
• Add Auto Pre-Commit #​685 (@​blink1073)
• Fix a typo #​683 (@​krassowski)
• (temporarily) skip pending kernels unit tests on Windows CI #​673 (@​Zsailer)

Contributors to this release

(GitHub contributors page for this release)

@​blink1073 | @​codecov-commenter | @​davidbrochart | @​echarles | @​github-actions | @​jasongrout | @​krassowski | @​maartenbreddels | @​SylvainCorlay | @​Vishwajeet0510 | @​vkaidalov | @​welcome | @​Wh1isper | @​Zsailer

v1.13.4

Compare Source

(Full Changelog)

Bugs fixed

• Fix nbconvert handler run_sync() #​667 (@​davidbrochart)

Contributors to this release

(GitHub contributors page for this release)

@​codecov-commenter | @​davidbrochart | @​Zsailer

v1.13.3

Compare Source

(Full Changelog)

Enhancements made

• More updates to unit tests for pending kernels work #​662 (@​Zsailer)

Bugs fixed

• bump traitlets dependency #​663 (@​Zsailer)

Contributors to this release

(GitHub contributors page for this release)

@​Zsailer

v1.13.2

Compare Source

(Full Changelog)

Enhancements made

• Don't block the event loop when exporting with nbconvert #​655 (@​davidbrochart)
• Add more awaits for pending kernel in unit tests #​654 (@​Zsailer)
• Print IPv6 url as hostname or enclosed in brackets #​652 (@​op3)

Bugs fixed

• Run pre_save_hook before model check #​643 (@​davidbrochart)
• handle KeyError when get session #​641 (@​ccw630)

Maintenance and upkeep improvements

• Clean up deprecations #​650 (@​blink1073)
• Update branch references #​646 (@​blink1073)
• pyproject.toml: clarify build system version #​634 (@​adamjstewart)

Contributors to this release

(GitHub contributors page for this release)

@​adamjstewart | @​blink1073 | @​ccw630 | @​codecov-commenter | @​davidbrochart | @​echarles | @​fcollonval | @​kevin-bates | @​op3 | @​welcome | @​Wh1isper | @​Zsailer

v1.13.1

Compare Source

(Full Changelog)

Bugs fixed

• nudge both the shell and control channels #​636 (@​Zsailer)

Maintenance and upkeep improvements

• Fix macos pypy check #​632 (@​blink1073)

Contributors to this release

(GitHub contributors page for this release)

@​blink1073 | @​codecov-commenter | @​Zsailer

v1.13.0

Compare Source

(Full Changelog)

Enhancements made

• Persistent session storage #​614 (@​Zsailer)

Bugs fixed

• Nudge on the control channel instead of the shell #​628 (@​JohanMabille)

Maintenance and upkeep improvements

• Clean up downstream tests #​629 (@​blink1073)
• Clean up version info handling #​620 (@​blink1073)

Contributors to this release

(GitHub contributors page for this release)

@​blink1073 | @​codecov-commenter | @​echarles | @​JohanMabille | @​jtpio | @​Zsailer

v1.12.1

Compare Source

(Full Changelog)

Bugs fixed

• Await _finish_kernel_start #​617 (@​jtpio)

Maintenance and upkeep improvements

• Update to Python 3.10 in the CI workflows #​618 (@​jtpio)
• Use maintainer-tools base setup action #​616 (@​blink1073)

Contributors to this release

(GitHub contributors page for this release)

@​blink1073 | @​codecov-commenter | @​jtpio

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.