Bump jupyterlab from 4.2.2 to 4.5.7 in /experiments/agentcompany/openhands by dependabot[bot] · Pull Request #22 · scaleapi/lhaw

dependabot · 2026-04-30T18:12:14Z

Bumps jupyterlab from 4.2.2 to 4.5.7.

Release notes

v4.5.7

4.5.7

(Full Changelog)

Security patches

CVE-2026-42557 GHSA-mqcg-5x36-vfcg

CVE-2026-42266 GHSA-37w4-hwhx-4rc4

CVE-2026-40171 GHSA-rch3-82jr-f9w9

Bugs fixed

Video and Audio Content Providers: Fix JupyterLite support #18652 (@martinRenou)

Fix notebook hang when dropping cells #18808 (@MUFFANUJ)

Fix Contextual Help keyboard shortcut reliability and menu Help functionality #18747 (@itsmejay80)

Fix focusing input element when opening a dialog from Command Palette #18735 (@Carreau)

Fix native context menu blocked even when context menu is suppressed #18753 (@utsav-develops)

Fix flaky toolbar item placement in popup #18618 (@filipeoliveira05)

Update terminal default font family to honor macOS system-wide ui-monospace #18647 (@flaviomartins)

Maintenance and upkeep improvements

Fix linting issue #18819 (@krassowski)

Fix syntax for Python 3.9 on 4.5.x branch #18817 (@krassowski)

Remove unused CodeMirror v5 CSS rule #18785 (@Carreau)

Remove unused CSS rule forgotten after CodeMirror migration #18763 (@Carreau)

Remove unused progress bar CSS rule in execution indicator #18759 (@Carreau)

Remove dead .jp-VariableRenderer-TrustButton CSS rule #18762 (@Carreau)

Remove used .jp-Cell-Placeholder CSS rules #18761 (@Carreau)

Documentation improvements

Fix name of option for extension manager implementation in docs #18788 (@krassowski)

Remove 4.5.0 announcement from docs #18740 (@krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@Carreau (activity) | @filipeoliveira05 (activity) | @flaviomartins (activity) | @itsmejay80 (activity) | @jtpio (activity) | @krassowski (activity) | @martinRenou (activity) | @MUFFANUJ (activity) | @utsav-develops (activity)

v4.5.6

4.5.6

... (truncated)

Commits

f514041 [ci skip] Publish 4.5.7
66fe9ad Backport PR #18652 on branch 4.5.x (Video and Audio Content Providers: Fix Ju...
f4455fa Fix syntax for Python 3.9 on 4.5.x branch (#18817)
d2322b5 Backport PR #18819 on branch 4.5.x (Fix linting issue) (#18820)
5d9cb8c Merge commit from fork
1de120b Merge commit from fork
6926100 Backport PR #18808 on branch 4.5.x (Fix notebook hang when dropping cells) (#...
67e6e88 Backport PR #18647 on branch 4.5.x (Update default font family to honor macOS...
bf21eb9 Backport PR #18747 on branch 4.5.x (Fix Contextual Help keyboard shortcut rel...
73cafa5 Backport PR #18788 on branch 4.5.x (Fix name of option for extension manager ...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Greptile Summary

This is a Dependabot security bump of jupyterlab from 4.2.2 to 4.5.7 in experiments/agentcompany/openhands/requirements.txt. The update patches three CVEs (CVE-2026-42557, CVE-2026-42266, CVE-2026-40171) and includes several bug fixes (notebook hang on cell drop, dialog focus, context menu).

Confidence Score: 5/5

Safe to merge — single-line security patch bump with no code changes.

Only one line changes: the pinned version of jupyterlab. The new version addresses known CVEs and has no breaking changes within the 4.x series. No other dependencies are affected.

No files require special attention.

Important Files Changed

Filename	Overview
experiments/agentcompany/openhands/requirements.txt	Bumps jupyterlab from 4.2.2 to 4.5.7, picking up three CVE security patches and several bug fixes.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[requirements.txt] -->|was| B[jupyterlab==4.2.2\nVulnerable to CVE-2026-42557\nCVE-2026-42266\nCVE-2026-40171]
    A -->|now| C[jupyterlab==4.5.7\nAll three CVEs patched\nBug fixes included]
    B -->|Dependabot bump| C

_{Reviews (1): Last reviewed commit: "Bump jupyterlab in /experiments/agentcom..." | Re-trigger Greptile}

Bumps [jupyterlab](https://github.com/jupyterlab/jupyterlab) from 4.2.2 to 4.5.7. - [Release notes](https://github.com/jupyterlab/jupyterlab/releases) - [Changelog](https://github.com/jupyterlab/jupyterlab/blob/main/RELEASE.md) - [Commits](https://github.com/jupyterlab/jupyterlab/compare/@jupyterlab/lsp@4.2.2...@jupyterlab/lsp@4.5.7) --- updated-dependencies: - dependency-name: jupyterlab dependency-version: 4.5.7 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-04-30T18:30:49Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	jupyterlab@4.2.2 ⏵ 4.5.7		⁺¹⁷			⁺¹⁰

View full report

socket-security · 2026-04-30T18:30:51Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Telemetry collection: pypi `jupyterlab` Note: The source code contains telemetry functionality that raises privacy concerns due to the collection and transmission of user data without explicit consent. This behavior could be classified as malicious if users are unaware of the data being sent. Further scrutiny is needed to ensure compliance with privacy standards. From: experiments/agentcompany/openhands/requirements.txt → `pypi/jupyterlab@4.5.7` ℹ Read more on: This package \| This alert \| What is telemetry? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/jupyterlab@4.5.7`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Telemetry collection: pypi `jupyterlab` Note: The source code contains telemetry functionality that raises privacy concerns due to the collection and transmission of user data without explicit consent. This behavior could be classified as malicious if users are unaware of the data being sent. Further scrutiny is needed to ensure compliance with privacy standards. From: experiments/agentcompany/openhands/requirements.txt → `pypi/jupyterlab@4.5.7` ℹ Read more on: This package \| This alert \| What is telemetry? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/jupyterlab@4.5.7`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Apr 30, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump jupyterlab from 4.2.2 to 4.5.7 in /experiments/agentcompany/openhands#22

Bump jupyterlab from 4.2.2 to 4.5.7 in /experiments/agentcompany/openhands#22
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/pip/experiments/agentcompany/openhands/jupyterlab-4.5.7

dependabot Bot commented on behalf of github Apr 30, 2026 •

edited by greptile-apps Bot

Loading

Uh oh!

socket-security Bot commented Apr 30, 2026

Uh oh!

socket-security Bot commented Apr 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Apr 30, 2026 • edited by greptile-apps Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v4.5.7

4.5.7

Security patches

Bugs fixed

Maintenance and upkeep improvements

Documentation improvements

Contributors to this release

v4.5.6

4.5.6

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

socket-security Bot commented Apr 30, 2026

Uh oh!

socket-security Bot commented Apr 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Apr 30, 2026 •

edited by greptile-apps Bot

Loading