Bump nbconvert from 7.16.6 to 7.17.0 by dependabot[bot] · Pull Request #18 · hms-dbmi/DQVis-Generation

dependabot · 2026-02-09T22:20:29Z

Bumps nbconvert from 7.16.6 to 7.17.0.

Release notes

v7.17.0

7.17.0

(Full Changelog)

Enhancements made

Add support for arbitrary browser arguments #2227 (@shreve, @Carreau, @krassowski)

Bugs fixed

Fix QtPNGExporter returning empty bytes on macOS #2264 (@h3pdesign, @Carreau, @QuLogic)

Fix CVE-2025-53000: Secure Inkscape Windows path (registry first + block CWD) #2261 (@h3pdesign, @krassowski, @mberlanda, @minrk, @salmankadaya, @th3gowtham)

Fix get_export_names and get_exporter default args #2228 (@shreve, @krassowski)

PyPA-Compliant Summary #2226 (@hackowitz-af, @Carreau)

Maintenance and upkeep improvements

avoid cov environment on free-threaded Pythons #2267 (@minrk)

update pre-commit, and fix all issues. #2238 (@Carreau)

Drop test on 3.9, test on 3.13, 3.14, 3.14t #2237 (@Carreau)

Bump the actions group across 1 directory with 2 updates #2231 (@Carreau, @krassowski)

Replace @flaky.flaky decorate with pytest marker #2229 (@mgorny, @Carreau)

update to mermaid 11.10.0 #2224 (@bollwyvl, @krassowski)

Drop support for Python 3.8, fix the CI tests #2221 (@shreve, @minrk)

Documentation improvements

Use intersphinx_registry #2232 (@Carreau, @krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@bollwyvl (activity) | @Carreau (activity) | @h3pdesign (activity) | @hackowitz-af (activity) | @krassowski (activity) | @mberlanda (activity) | @mgorny (activity) | @minrk (activity) | @MSeal (activity) | @QuLogic (activity) | @salmankadaya (activity) | @shreve (activity) | @th3gowtham (activity)

Changelog

Sourced from nbconvert's changelog.

7.17.0

(Full Changelog)

Enhancements made

Add support for arbitrary browser arguments #2227 (@shreve, @Carreau, @krassowski)

Bugs fixed

Fix QtPNGExporter returning empty bytes on macOS #2264 (@h3pdesign, @Carreau, @QuLogic)

Fix CVE-2025-53000: Secure Inkscape Windows path (registry first + block CWD) #2261 (@h3pdesign, @krassowski, @mberlanda, @minrk, @salmankadaya, @th3gowtham)

Fix get_export_names and get_exporter default args #2228 (@shreve, @krassowski)

PyPA-Compliant Summary #2226 (@hackowitz-af, @Carreau)

Maintenance and upkeep improvements

avoid cov environment on free-threaded Pythons #2267 (@minrk)

update pre-commit, and fix all issues. #2238 (@Carreau)

Drop test on 3.9, test on 3.13, 3.14, 3.14t #2237 (@Carreau)

Bump the actions group across 1 directory with 2 updates #2231 (@Carreau, @krassowski)

Replace @flaky.flaky decorate with pytest marker #2229 (@mgorny, @Carreau)

update to mermaid 11.10.0 #2224 (@bollwyvl, @krassowski)

Drop support for Python 3.8, fix the CI tests #2221 (@shreve, @minrk)

Documentation improvements

Use intersphinx_registry #2232 (@Carreau, @krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@bollwyvl (activity) | @Carreau (activity) | @h3pdesign (activity) | @hackowitz-af (activity) | @krassowski (activity) | @mberlanda (activity) | @mgorny (activity) | @minrk (activity) | @MSeal (activity) | @QuLogic (activity) | @salmankadaya (activity) | @shreve (activity) | @th3gowtham (activity)

Commits

21b35d8 Publish 7.17.0
c9ac1d1 Fix CVE-2025-53000: Secure Inkscape Windows path (registry first + block CWD)...
b13276d avoid cov environment on free-threaded Pythons (#2267)
7c7055f [pre-commit.ci] auto fixes from pre-commit.com hooks
74f3ddd Fix QtPNGExporter returning empty bytes on macOS
216550b fix links
39777ac try to comment fialing test
7b591ca ruff-check
6ec7638 parent
59414b3 fix mypy
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [nbconvert](https://github.com/jupyter/nbconvert) from 7.16.6 to 7.17.0. - [Release notes](https://github.com/jupyter/nbconvert/releases) - [Changelog](https://github.com/jupyter/nbconvert/blob/main/CHANGELOG.md) - [Commits](jupyter/nbconvert@v7.16.6...v7.17.0) --- updated-dependencies: - dependency-name: nbconvert dependency-version: 7.17.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

dbmi-svc-checkmarx · 2026-02-09T22:22:57Z

Checkmarx One – Scan Summary & Details – ca9ef8f5-6d85-4766-bf5a-7ee082d5ce35

New Issues (21)

Checkmarx found the following issues in this Pull Request

#	Issue	Source File / Package	Checkmarx Insight
1	CVE-2024-58340	Python-langchain-0.3.23	details Recommended version: 1.2.4 Description: LangChain contains a Regular Expression Denial-of-Service (ReDoS) vulnerability in the "MRKLOutputParser.parse()" method ("libs/langchain/langchain... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
2	CVE-2025-65106	Python-langchain-core-0.3.51	details Recommended version: 0.3.81 Description: LangChain is a framework for building agents and LLM-powered applications. Affected versions are through 0.3.79, 0.4.0.dev0, and 1.0.0 through 1.0.... Attack Vector: NETWORK Attack Complexity: LOW Exploitable Path: from_template@/paraphraser.py - ... - get_template_variables@...ompts/string.py Vulnerable Package
3	CVE-2025-66418	Python-urllib3-2.3.0	details Recommended version: 2.6.3 Description: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression ch... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
4	CVE-2025-66471	Python-urllib3-2.3.0	details Recommended version: 2.6.3 Description: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
5	CVE-2025-67221	Python-orjson-3.10.16	details Recommended version: 3.11.7 Description: The "orjson.dumps" function in orjson does not limit recursion for deeply nested JSON documents. Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
6	CVE-2025-67725	Python-tornado-6.4.2	details Recommended version: 6.5.3 Description: Tornado is a Python web framework and asynchronous networking library. In versions through 6.5.2, a single maliciously crafted HTTP request can blo... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
7	CVE-2025-67726	Python-tornado-6.4.2	details Recommended version: 6.5.3 Description: Tornado is a Python web framework and asynchronous networking library. Versions through 6.5.2 use an inefficient algorithm when parsing parameters ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
8	CVE-2025-68664	Python-langchain-core-0.3.51	details Recommended version: 0.3.81 Description: LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.x prior to 1.2.5, a serialization injecti... Attack Vector: NETWORK Attack Complexity: LOW Exploitable Path: dumps@/multi_step_generation.py - ... - _dump_pydantic_models@...ore/load/dump.py Vulnerable Package
9	CVE-2025-69223	Python-aiohttp-3.11.14	details Recommended version: 3.13.3 Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions through 3.13.2 allow a zip bomb to be used to execute a Do... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
10	CVE-2026-21441	Python-urllib3-2.3.0	details Recommended version: 2.6.3 Description: urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
11	CVE-2025-67724	Python-tornado-6.4.2	details Recommended version: 6.5.3 Description: Tornado is a Python web framework and asynchronous networking library. In versions through 6.5.2 , the supplied reason phrase is used unescaped in ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
12	CVE-2025-68146	Python-filelock-3.18.0	details Recommended version: 3.20.3 Description: filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check-Time-of-Use (TOCTOU) race condition allows lo... Attack Vector: LOCAL Attack Complexity: HIGH Vulnerable Package
13	CVE-2025-68480	Python-marshmallow-3.26.1	details Recommended version: 3.26.2 Description: Marshmallow is a lightweight library for converting complex objects to and from simple Python datatypes. In versions from 3.0.0rc1 prior to 3.26.2 ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
14	CVE-2025-69224	Python-aiohttp-3.11.14	details Recommended version: 3.13.3 Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions through 3.13.2 and 4.x through 4.0.0a1 of the Python HTTP ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
15	CVE-2025-69226	Python-aiohttp-3.11.14	details Recommended version: 3.13.3 Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions through 3.13.2 and 4.x through 4.0.0a1, enable an attacker... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
16	CVE-2025-69227	Python-aiohttp-3.11.14	details Recommended version: 3.13.3 Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions through 3.13.2 and 4.x through 4.0.0a1 allow for an infini... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
17	CVE-2025-69228	Python-aiohttp-3.11.14	details Recommended version: 3.13.3 Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions through 3.13.2 and 4.x through 4.0.0a1 allow a request to ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
18	CVE-2025-69229	Python-aiohttp-3.11.14	details Recommended version: 3.13.3 Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions through 3.13.2 and 4.x through 4.0.0a1, handling of chu... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
19	CVE-2026-22701	Python-filelock-3.18.0	details Recommended version: 3.20.3 Description: filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the "SoftFileLock... Attack Vector: LOCAL Attack Complexity: HIGH Vulnerable Package
20	CVE-2025-69225	Python-aiohttp-3.11.14	details Recommended version: 3.13.3 Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions through 3.13.2 and 4.x through 4.0.0a1 contain parser logi... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
21	CVE-2025-69230	Python-aiohttp-3.11.14	details Recommended version: 3.13.3 Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions through 3.13.2, reading multiple invalid cookies can le... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR

dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Feb 9, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump nbconvert from 7.16.6 to 7.17.0#18

Bump nbconvert from 7.16.6 to 7.17.0#18
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/pip/nbconvert-7.17.0

dependabot bot commented on behalf of github Feb 9, 2026

Uh oh!

dbmi-svc-checkmarx commented Feb 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot bot commented on behalf of github Feb 9, 2026

v7.17.0

7.17.0

Enhancements made

Bugs fixed

Maintenance and upkeep improvements

Documentation improvements

Contributors to this release

7.17.0

Enhancements made

Bugs fixed

Maintenance and upkeep improvements

Documentation improvements

Contributors to this release

Uh oh!

dbmi-svc-checkmarx commented Feb 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant