Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package python-jupyterlab-templates for
openSUSE:Factory checked in at 2026-10-07 19:31:46
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/python-jupyterlab-templates (Old)
and /work/SRC/openSUSE:Factory/.python-jupyterlab-templates.new.3698736
(New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-jupyterlab-templates"
Wed Oct 7 19:31:46 2026 rev:19 rq:1382827 version:0.5.3
Changes:
--------
---
/work/SRC/openSUSE:Factory/python-jupyterlab-templates/python-jupyterlab-templates.changes
2026-06-27 18:09:26.422759385 +0200
+++
/work/SRC/openSUSE:Factory/.python-jupyterlab-templates.new.3698736/python-jupyterlab-templates.changes
2026-10-07 19:32:33.205510726 +0200
@@ -1,0 +2,10 @@
+Mon Oct 5 12:35:25 UTC 2026 - Markéta Machová <[email protected]>
+
+- CVE-2026-103923: katex: inherited Object.prototype properties in
+ options processing can cause trusted rendering bypasses
+ (bsc#1284036)
+ * CVE-2026-103923.patch
+ * KaTeX chain does not support the secure version yet, therefore
+ patching the vendored package
+
+-------------------------------------------------------------------
New:
----
CVE-2026-103923.patch
----------(New B)----------
New: (bsc#1284036)
* CVE-2026-103923.patch
* KaTeX chain does not support the secure version yet, therefore
----------(New E)----------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ python-jupyterlab-templates.spec ++++++
--- /var/tmp/diff_new_pack.NleD8i/_old 2026-10-07 19:32:34.286555873 +0200
+++ /var/tmp/diff_new_pack.NleD8i/_new 2026-10-07 19:32:34.287555915 +0200
@@ -33,6 +33,8 @@
%include %{_sourcedir}/node_modules.spec.inc
# PATCH-FIX-UPSTREAM update-deps.patch bsc#1259114
Patch0: update-deps.patch
+# PATCH-FIX-UPSTREAM CVE-2026-103923.patch bsc#1284038
+Patch1: CVE-2026-103923.patch
BuildRequires: %{python_module base >= 3.7}
BuildRequires: %{python_module hatch-jupyter-builder}
BuildRequires: %{python_module hatchling}
@@ -70,7 +72,8 @@
Support for jupyter notebook templates in jupyterlab.
%prep
-%autosetup -p1 -n jupyterlab_templates-%{version}
+%setup -q -n jupyterlab_templates-%{version}
+%patch -P 0 -p1
rm js/yarn.lock
rm jupyterlab_templates/labextension/static/*.js
@@ -78,6 +81,10 @@
local-npm-registry %{_sourcedir} install --include=dev --include=peer
popd
+pushd js/node_modules/katex
+%patch -P 1 -p1
+popd
+
%build
pushd js
npm run build
++++++ CVE-2026-103923.patch ++++++
>From 0adf7e77db6915d991803b29699f82b1ccf8d4f4 Mon Sep 17 00:00:00 2001
From: Grigoriy Reshetniak <[email protected]>
Date: Sat, 8 Aug 2026 14:50:46 +0300
Subject: [PATCH] fix: prevent prototype pollution in settings (#4260)
* fix: prevent prototype pollution in settings
* Namespace protection
* trigger checks
---------
Co-authored-by: Erik Demaine <[email protected]>
---
src/Namespace.ts | 7 +++++--
src/Settings.ts | 12 ++++++++----
test/katex-spec.ts | 29 +++++++++++++++++++++++++++++
3 files changed, 42 insertions(+), 6 deletions(-)
diff --git a/src/Namespace.ts b/src/Namespace.ts
index 0053695a4b..6305db4795 100644
--- a/src/Namespace.ts
+++ b/src/Namespace.ts
@@ -81,8 +81,10 @@ export default class Namespace<Value> {
get(name: string): Value | null | undefined {
if (this.current.hasOwnProperty(name)) {
return this.current[name];
- } else {
+ } else if (Object.prototype.hasOwnProperty.call(this.builtins, name)) {
return this.builtins[name];
+ } else {
+ return undefined;
}
}
@@ -111,7 +113,8 @@ export default class Namespace<Value> {
// value is the correct one.
const top = this.undefStack[this.undefStack.length - 1];
if (top && !top.hasOwnProperty(name)) {
- top[name] = this.current[name];
+ top[name] = Object.prototype.hasOwnProperty.call(
+ this.current, name) ? this.current[name] : undefined;
}
}
if (value == null) {
diff --git a/src/Settings.ts b/src/Settings.ts
index da3c505a52..e879241278 100644
--- a/src/Settings.ts
+++ b/src/Settings.ts
@@ -326,7 +326,8 @@ function getDefaultValue<K extends keyof SettingsOptions>(
schema: SchemaEntry<K>,
): Settings[K];
function getDefaultValue(schema: SchemaEntry<keyof SettingsOptions>):
DefaultValue {
- if (schema.default !== undefined) {
+ if (Object.prototype.hasOwnProperty.call(schema, "default") &&
+ schema.default !== undefined) {
return schema.default;
}
const type = Array.isArray(schema.type) ? schema.type[0] : schema.type;
@@ -339,10 +340,13 @@ function applySetting<K extends keyof SettingsOptions>(
options: SettingsOptions,
schema: SchemaEntry<K>,
) {
- const optionValue = options[prop];
+ const optionValue = Object.prototype.hasOwnProperty.call(options, prop)
+ ? options[prop] : undefined;
+ const processor = Object.prototype.hasOwnProperty.call(schema, "processor")
+ ? schema.processor : undefined;
target[prop] = optionValue !== undefined
- ? (schema.processor
- ? schema.processor(optionValue)
+ ? (processor
+ ? processor(optionValue)
: optionValue)
: getDefaultValue(schema);
}
