Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package python-nbconvert for
openSUSE:Factory checked in at 2026-11-13 18:30:01
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/python-nbconvert (Old)
and /work/SRC/openSUSE:Factory/.python-nbconvert.new.1251 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-nbconvert"
Fri Nov 13 18:30:01 2026 rev:41 rq:1396973 version:7.17.2
Changes:
--------
--- /work/SRC/openSUSE:Factory/python-nbconvert/python-nbconvert.changes
2026-09-08 17:00:25.438756888 +0200
+++
/work/SRC/openSUSE:Factory/.python-nbconvert.new.1251/python-nbconvert.changes
2026-11-13 18:32:43.604683412 +0100
@@ -1,0 +2,7 @@
+Thu Nov 12 00:01:45 UTC 2026 - Steve Kowalik <[email protected]>
+
+- Update to 7.17.2:
+ * Addresses CVE-2026-114140 (bsc#1286876)
+ * Use org-level security policy
+
+-------------------------------------------------------------------
Old:
----
nbconvert-7.17.1.tar.gz
New:
----
nbconvert-7.17.2.tar.gz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ python-nbconvert.spec ++++++
--- /var/tmp/diff_new_pack.MzEWRV/_old 2026-11-13 18:32:45.915781258 +0100
+++ /var/tmp/diff_new_pack.MzEWRV/_new 2026-11-13 18:32:45.917781343 +0100
@@ -30,10 +30,10 @@
%bcond_with libalternatives
%endif
# X.X.0 gets abbreviated by pythondistdeps
-%define shortversion 7.17.1
+%define shortversion 7.17.2
%{?sle15_python_module_pythons}
Name: python-nbconvert%{psuffix}
-Version: 7.17.1
+Version: 7.17.2
Release: 0
Summary: Conversion of Jupyter Notebooks
License: BSD-3-Clause AND MIT
@@ -41,7 +41,7 @@
Source0:
https://files.pythonhosted.org/packages/source/n/nbconvert/nbconvert-%{version}.tar.gz
# PATCH-FIX-OPENSUSE 0001-fix-XSS-in-text-vnd.mermaid.patch bsc#1269365
gh#jupyter/nbconvert#2294
Patch1: 0001-fix-XSS-in-text-vnd.mermaid.patch
-BuildRequires: %{python_module base >= 3.8}
+BuildRequires: %{python_module base >= 3.9}
BuildRequires: %{python_module hatchling >= 0.25}
BuildRequires: %{python_module pip}
BuildRequires: fdupes
++++++ nbconvert-7.17.1.tar.gz -> nbconvert-7.17.2.tar.gz ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/nbconvert-7.17.1/CHANGELOG.md
new/nbconvert-7.17.2/CHANGELOG.md
--- old/nbconvert-7.17.1/CHANGELOG.md 2020-02-02 01:00:00.000000000 +0100
+++ new/nbconvert-7.17.2/CHANGELOG.md 2020-02-02 01:00:00.000000000 +0100
@@ -2,6 +2,29 @@
<!-- <START NEW CHANGELOG ENTRY> -->
+## 7.17.2
+
+([Full
Changelog](https://github.com/jupyter/nbconvert/compare/v7.17.1...8685e15e2d924fa39be38aeafb6ac859fc254ccc))
+
+### Maintenance and upkeep improvements
+
+- Fix CI: fetch the classic CSS from PyPI, update dead links
[#2327](https://github.com/jupyter/nbconvert/pull/2327)
([@Yann-P](https://github.com/Yann-P), [@Carreau](https://github.com/Carreau),
[@claude](https://github.com/claude))
+
+### Other merged PRs
+
+- Use org-level security policy (jupyter/.github/SECURITY.md)
[#2318](https://github.com/jupyter/nbconvert/pull/2318)
([@Yann-P](https://github.com/Yann-P), [@minrk](https://github.com/minrk))
+
+### Contributors to this release
+
+The following people contributed discussions, new ideas, code and
documentation contributions, and review.
+See [our definition of
contributors](https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports).
+
+([GitHub contributors page for this
release](https://github.com/jupyter/nbconvert/graphs/contributors?from=2026-04-08&to=2026-10-12&type=c))
+
+@Carreau
([activity](https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ACarreau+updated%3A2026-04-08..2026-10-12&type=Issues))
| @claude
([activity](https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aclaude+updated%3A2026-04-08..2026-10-12&type=Issues))
| @GruffElixir
([activity](https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AGruffElixir+updated%3A2026-04-08..2026-10-12&type=Issues))
| @minrk
([activity](https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aminrk+updated%3A2026-04-08..2026-10-12&type=Issues))
| @Yann-P
([activity](https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AYann-P+updated%3A2026-04-08..2026-10-12&type=Issues))
+
+<!-- <END NEW CHANGELOG ENTRY> -->
+
## 7.17.1
This is a security release, fixing two CVEs:
@@ -15,7 +38,7 @@
### Enhancements made
-- Allow configureable WebPDF JavaScript processing timeout
[#2250](https://github.com/jupyter/nbconvert/pull/2250)
([@timkpaine](https://github.com/timkpaine),
[@Carreau](https://github.com/Carreau))
+- Allow configurable WebPDF JavaScript processing timeout
[#2250](https://github.com/jupyter/nbconvert/pull/2250)
([@timkpaine](https://github.com/timkpaine),
[@Carreau](https://github.com/Carreau))
### Bugs fixed
@@ -35,8 +58,6 @@
@akhmerov
([activity](https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aakhmerov+updated%3A2026-01-29..2026-04-08&type=Issues))
| @bollwyvl
([activity](https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Abollwyvl+updated%3A2026-01-29..2026-04-08&type=Issues))
| @Carreau
([activity](https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ACarreau+updated%3A2026-01-29..2026-04-08&type=Issues))
| @ctcjab
([activity](https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Actcjab+updated%3A2026-01-29..2026-04-08&type=Issues))
| @davidbrochart
([activity](https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Adavidbrochart+updated%3A2026-01-29..2026-04-08&type=Issues))
| @Ken-B
([activity](https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AKen-B+updated%3A2026-01-29..2026-04-08&type=Issues))
| @krassowski
([activity](https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Akrassowski+updated%3A2026-01-29..
2026-04-08&type=Issues)) | @mgeier
([activity](https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Amgeier+updated%3A2026-01-29..2026-04-08&type=Issues))
| @minrk
([activity](https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aminrk+updated%3A2026-01-29..2026-04-08&type=Issues))
| @mpacer
([activity](https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Ampacer+updated%3A2026-01-29..2026-04-08&type=Issues))
| @MSeal
([activity](https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AMSeal+updated%3A2026-01-29..2026-04-08&type=Issues))
| @SylvainCorlay
([activity](https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ASylvainCorlay+updated%3A2026-01-29..2026-04-08&type=Issues))
| @takluyver
([activity](https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Atakluyver+updated%3A2026-01-29..2026-04-08&type=Issues))
| @timkpaine
([activity](https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Atimkpaine+upd
ated%3A2026-01-29..2026-04-08&type=Issues))
-<!-- <END NEW CHANGELOG ENTRY> -->
-
## 7.17.0
([Full
Changelog](https://github.com/jupyter/nbconvert/compare/v7.16.6...c9ac1d1040459ed1ff9eb34e9918ce5a87cf9d71))
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/nbconvert-7.17.1/PKG-INFO
new/nbconvert-7.17.2/PKG-INFO
--- old/nbconvert-7.17.1/PKG-INFO 2020-02-02 01:00:00.000000000 +0100
+++ new/nbconvert-7.17.2/PKG-INFO 2020-02-02 01:00:00.000000000 +0100
@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
Name: nbconvert
-Version: 7.17.1
+Version: 7.17.2
Summary: Convert Jupyter Notebooks (.ipynb files) to other formats.
Project-URL: Homepage, https://jupyter.org
Author-email: Jupyter Development Team <[email protected]>
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/nbconvert-7.17.1/SECURITY.md
new/nbconvert-7.17.2/SECURITY.md
--- old/nbconvert-7.17.1/SECURITY.md 2020-02-02 01:00:00.000000000 +0100
+++ new/nbconvert-7.17.2/SECURITY.md 1970-01-01 01:00:00.000000000 +0100
@@ -1,10 +0,0 @@
-# Security Policy
-
-## Reporting a Vulnerability
-
-All IPython and Jupyter security are handled via [email protected].
-You can find more information on the Jupyter website.
https://jupyter.org/security
-
-## Tidelift
-
-You can report security concerns for IPython via the [Tidelift
platform](https://tidelift.com).
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/nbconvert-7.17.1/docs/source/install.rst
new/nbconvert-7.17.2/docs/source/install.rst
--- old/nbconvert-7.17.1/docs/source/install.rst 2020-02-02
01:00:00.000000000 +0100
+++ new/nbconvert-7.17.2/docs/source/install.rst 2020-02-02
01:00:00.000000000 +0100
@@ -24,7 +24,7 @@
conda install nbconvert
-The `Miniconda <https://docs.conda.io/en/latest/miniconda.html>`_ and
`Miniforge <https://github.com/conda-forge/miniforge/>`_ distributions both
provide a minimal conda installation.
+The `Miniconda
<https://www.anaconda.com/docs/getting-started/concepts/anaconda-or-miniconda>`_
and `Miniforge <https://github.com/conda-forge/miniforge/>`_ distributions
both provide a minimal conda installation.
.. important::
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/nbconvert-7.17.1/hatch_build.py
new/nbconvert-7.17.2/hatch_build.py
--- old/nbconvert-7.17.1/hatch_build.py 2020-02-02 01:00:00.000000000 +0100
+++ new/nbconvert-7.17.2/hatch_build.py 2020-02-02 01:00:00.000000000 +0100
@@ -1,13 +1,20 @@
"""Custom build script for hatch backend"""
+import io
import os
import sys
+import zipfile
from urllib.request import urlopen
from hatchling.builders.hooks.plugin.interface import BuildHookInterface
notebook_css_version = "5.4.0"
-notebook_css_url = "https://cdn.jupyter.org/notebook/%s/style/style.min.css"; %
notebook_css_version
+# cdn.jupyter.org is unreliable, so take the same stylesheet from the notebook
wheel on PyPI.
+notebook_css_url = (
+
"https://files.pythonhosted.org/packages/d0/ca/a5a5ac9c839868ceddaa2672c399492ac1dbd4c4ce68f833a72a619fc225/";
+ "notebook-%s-py2.py3-none-any.whl" % notebook_css_version
+)
+notebook_css_member = "notebook/static/style/style.min.css"
jupyterlab_css_version = "4.0.2"
jupyterlab_css_url = (
@@ -28,11 +35,11 @@
template_css_urls = {
"lab": [
- (jupyterlab_css_url, "index.css"),
- (jupyterlab_theme_light_url, "theme-light.css"),
- (jupyterlab_theme_dark_url, "theme-dark.css"),
+ (jupyterlab_css_url, "index.css", None),
+ (jupyterlab_theme_light_url, "theme-light.css", None),
+ (jupyterlab_theme_dark_url, "theme-dark.css", None),
],
- "classic": [(notebook_css_url, "style.css")],
+ "classic": [(notebook_css_url, "style.css", notebook_css_member)],
}
osp = os.path
@@ -40,8 +47,8 @@
templates_dir = osp.join(here, "share", "templates")
-def _get_css_file(template_name, url, filename):
- """Get a css file and download it to the templates dir"""
+def _get_css_file(template_name, url, filename, member):
+ """Get a css file, or the member of the zip archive at url, into the
templates dir"""
directory = osp.join(templates_dir, template_name, "static")
dest = osp.join(directory, filename)
if osp.exists(dest):
@@ -52,6 +59,8 @@
print("Downloading CSS: %s" % url)
try:
css = urlopen(url).read() # noqa: S310
+ if member:
+ css = zipfile.ZipFile(io.BytesIO(css)).read(member)
except Exception as e:
msg = f"Failed to download css from {url}: {e}"
print(msg, file=sys.stderr)
@@ -72,8 +81,8 @@
return
for template_name, resources in template_css_urls.items():
- for url, filename in resources:
- _get_css_file(template_name, url, filename)
+ for url, filename, member in resources:
+ _get_css_file(template_name, url, filename, member)
class CustomHook(BuildHookInterface):
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/nbconvert-7.17.1/nbconvert/_version.py
new/nbconvert-7.17.2/nbconvert/_version.py
--- old/nbconvert-7.17.1/nbconvert/_version.py 2020-02-02 01:00:00.000000000
+0100
+++ new/nbconvert-7.17.2/nbconvert/_version.py 2020-02-02 01:00:00.000000000
+0100
@@ -3,7 +3,7 @@
import re
# Version string must appear intact for versioning
-__version__ = "7.17.1"
+__version__ = "7.17.2"
# Build up version_info tuple for backwards compatibility
pattern = r"(?P<major>\d+).(?P<minor>\d+).(?P<patch>\d+)(?P<rest>.*)"
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/nbconvert-7.17.1/nbconvert/preprocessors/extractoutput.py
new/nbconvert-7.17.2/nbconvert/preprocessors/extractoutput.py
--- old/nbconvert-7.17.1/nbconvert/preprocessors/extractoutput.py
2020-02-02 01:00:00.000000000 +0100
+++ new/nbconvert-7.17.2/nbconvert/preprocessors/extractoutput.py
2020-02-02 01:00:00.000000000 +0100
@@ -114,7 +114,22 @@
if ext is None:
ext = "." + mime_type.rsplit("/")[-1]
if out.metadata.get("filename", ""):
- filename = out.metadata["filename"]
+ fname = out.metadata["filename"]
+ # Sanitize: use only the basename to prevent path
traversal
+ filename = os.path.basename(fname)
+ if not filename:
+ self.log.warning(
+ "Output filename '%s' is invalid (empty
basename), skipping",
+ fname,
+ )
+ continue
+ if filename != fname:
+ self.log.warning(
+ "Output filename '%s' contained path
components, "
+ "using basename '%s'",
+ fname,
+ filename,
+ )
if not filename.endswith(ext):
filename += ext
else:
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/nbconvert-7.17.1/tests/preprocessors/test_extractoutput.py
new/nbconvert-7.17.2/tests/preprocessors/test_extractoutput.py
--- old/nbconvert-7.17.1/tests/preprocessors/test_extractoutput.py
2020-02-02 01:00:00.000000000 +0100
+++ new/nbconvert-7.17.2/tests/preprocessors/test_extractoutput.py
2020-02-02 01:00:00.000000000 +0100
@@ -4,6 +4,7 @@
# Distributed under the terms of the Modified BSD License.
import json
+import os
from nbconvert.preprocessors.extractoutput import ExtractOutputPreprocessor
@@ -84,3 +85,24 @@
# Verify equivalence of extracted outputs.
self.assertEqual(sorted(outputs), sorted(reference_files))
+
+ def test_filename_path_traversal(self):
+ """Are path components stripped from output filename metadata?"""
+ for name in ["/tmp/evil.png", "../../evil.png", "sub/evil.png"]:
+ nb = self.build_notebook()
+ nb.cells[0].outputs[6].metadata["filename"] = name
+ res = self.build_resources()
+ res["output_files_dir"] = "nb_files"
+ nb, res = self.build_preprocessor()(nb, res)
+ expected = os.path.join("nb_files", "evil.png")
+
self.assertEqual(nb.cells[0].outputs[6].metadata.filenames["image/png"],
expected)
+ self.assertEqual(res["outputs"][expected], b"g")
+
+ def test_filename_empty_basename(self):
+ """Is an output whose filename metadata has an empty basename
skipped?"""
+ nb = self.build_notebook()
+ nb.cells[0].outputs[6].metadata["filename"] = "../../../tmp/"
+ res = self.build_resources()
+ nb, res = self.build_preprocessor()(nb, res)
+ self.assertNotIn("image/png",
nb.cells[0].outputs[6].metadata.get("filenames", {}))
+ self.assertNotIn(b"g", res["outputs"].values())
