jupyterhub - Debian Package Tracker

general

source: jupyterhub (main)
version: 5.2.1+ds1-5
maintainer: Debian Python Team (DMD)
uploaders: Roland Mas [DMD] – Debian PaN Maintainers (archive) [DMD]
arch: all
std-ver: 4.7.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 3.0.0+ds1-1
stable: 5.2.1+ds1-4
testing: 5.2.1+ds1-5
unstable: 5.2.1+ds1-5

versioned links

3.0.0+ds1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.2.1+ds1-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.2.1+ds1-5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

jupyterhub (1 bugs: 0, 1, 0, 0)

action needed

Marked for autoremoval on 19 September due to python-libcst, towncrier: #1143428, #1144936 high

Version 5.2.1+ds1-5 of jupyterhub is marked for autoremoval from testing on Sat 19 Sep 2026. It depends (transitively) on python-libcst, towncrier, affected by #1143428, #1144936. You should try to prevent the removal by fixing these RC bugs.

Created: 2026-08-01 Last update: 2026-08-31 16:32

A new upstream version is available: 6.0.0b3 high

A new upstream version 6.0.0b3 is available, you should consider packaging it.

Created: 2026-03-14 Last update: 2026-08-31 15:03

3 security issues in sid high

There are 3 open security issues in sid.

3 important issues:

CVE-2026-33709: JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to version 5.4.4, an open redirect vulnerability in JupyterHub allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a JupyterHub page, bypassing JupyterHub's check to prevent this. This issue has been patched in version 5.4.4.
CVE-2026-40864: JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. In versions 4.1.0 through 5.4.4, XSRF protection (updated in 4.1.0) inappropriately treated requests with Sec-Fetch-Mode: no-cors as same-origin requests, bypassing XSRF checks. The JSON API is not affected, only HTTP form endpoints, such as /hub/spawn and /hub/accept-share, meaning attackers could trigger server spawn (but not access the server) and if the attacker is a JupyterHub user permitted to share access to their server, cause a user to accept a share and have access to the attacker's server. This issue has been fixed in version 5.4.5. If developers are unable to immediately upgrade, they can temporarily mitigate this issue by dropping requests to JupyterHub with Sec-Fetch-Mode: no-cors if they are using a reverse proxy.
CVE-2026-54338: JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.

Created: 2026-04-04 Last update: 2026-08-31 08:32

3 security issues in forky high

There are 3 open security issues in forky.

3 important issues:

CVE-2026-33709: JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to version 5.4.4, an open redirect vulnerability in JupyterHub allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a JupyterHub page, bypassing JupyterHub's check to prevent this. This issue has been patched in version 5.4.4.
CVE-2026-40864: JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. In versions 4.1.0 through 5.4.4, XSRF protection (updated in 4.1.0) inappropriately treated requests with Sec-Fetch-Mode: no-cors as same-origin requests, bypassing XSRF checks. The JSON API is not affected, only HTTP form endpoints, such as /hub/spawn and /hub/accept-share, meaning attackers could trigger server spawn (but not access the server) and if the attacker is a JupyterHub user permitted to share access to their server, cause a user to accept a share and have access to the attacker's server. This issue has been fixed in version 5.4.5. If developers are unable to immediately upgrade, they can temporarily mitigate this issue by dropping requests to JupyterHub with Sec-Fetch-Mode: no-cors if they are using a reverse proxy.
CVE-2026-54338: JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.

Created: 2026-04-04 Last update: 2026-08-31 08:32

Failed to analyze the VCS repository. Please troubleshoot and fix the issue. high

vcswatch reports that there is an error with this package's VCS, or the debian/changelog file inside it. Please check the error shown below and try to fix it. You might have to update the VCS URL in the debian/control file to point to the correct repository.

error: RPC failed; HTTP 503 curl 22 The requested URL returned error: 503 fatal: expected 'acknowledgments'

Created: 2026-08-27 Last update: 2026-08-27 10:51

Does not build reproducibly during testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2025-06-07 Last update: 2026-08-31 17:01

Depends on packages which need a new maintainer normal

The packages that jupyterhub depends on which need a new maintainer are:

prototypejs (#863697)
- Depends: libjs-prototype
node-node-sass (#1012550)
- Build-Depends: node-node-sass

Created: 2021-11-27 Last update: 2026-08-31 14:30

lintian reports 3 warnings normal

Lintian reports 3 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2025-05-29 Last update: 2026-03-14 16:01

3 low-priority security issues in trixie low

There are 3 open security issues in trixie.

3 issues left for the package maintainer to handle:

CVE-2026-33709: (needs triaging) JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to version 5.4.4, an open redirect vulnerability in JupyterHub allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a JupyterHub page, bypassing JupyterHub's check to prevent this. This issue has been patched in version 5.4.4.
CVE-2026-40864: (needs triaging) JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. In versions 4.1.0 through 5.4.4, XSRF protection (updated in 4.1.0) inappropriately treated requests with Sec-Fetch-Mode: no-cors as same-origin requests, bypassing XSRF checks. The JSON API is not affected, only HTTP form endpoints, such as /hub/spawn and /hub/accept-share, meaning attackers could trigger server spawn (but not access the server) and if the attacker is a JupyterHub user permitted to share access to their server, cause a user to accept a share and have access to the attacker's server. This issue has been fixed in version 5.4.5. If developers are unable to immediately upgrade, they can temporarily mitigate this issue by dropping requests to JupyterHub with Sec-Fetch-Mode: no-cors if they are using a reverse proxy.
CVE-2026-54338: (needs triaging) JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-04-04 Last update: 2026-08-31 08:32

debian/patches: 2 patches to forward upstream low

Among the 2 debian patches available in version 5.2.1+ds1-5 of the package, we noticed the following issues:

2 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-03-14 17:00

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.3).

Created: 2026-03-31 Last update: 2026-03-31 15:01

news

[rss feed]

[2026-03-19] jupyterhub 5.2.1+ds1-5 MIGRATED to testing (Debian testing watch)
[2026-03-14] Accepted jupyterhub 5.2.1+ds1-5 (source) into unstable (Alexandre Detiste)
[2025-06-07] jupyterhub 5.2.1+ds1-4 MIGRATED to testing (Debian testing watch)
[2025-05-28] Accepted jupyterhub 5.2.1+ds1-4 (source) into unstable (Picca Frédéric-Emmanuel)
[2025-05-07] Accepted jupyterhub 5.2.1+ds1-3 (source) into unstable (Picca Frédéric-Emmanuel)
[2025-03-22] jupyterhub 5.2.1+ds1-2 MIGRATED to testing (Debian testing watch)
[2025-03-16] Accepted jupyterhub 5.2.1+ds1-2 (source) into unstable (Colin Watson)
[2024-12-08] jupyterhub 5.2.1+ds1-1 MIGRATED to testing (Debian testing watch)
[2024-12-03] Accepted jupyterhub 5.2.1+ds1-1 (source) into unstable (Roland Mas)
[2024-10-05] jupyterhub 5.0.0+ds1-4 MIGRATED to testing (Debian testing watch)
[2024-09-29] Accepted jupyterhub 5.0.0+ds1-4 (source) into unstable (Roland Mas)
[2024-09-13] jupyterhub 5.0.0+ds1-3 MIGRATED to testing (Debian testing watch)
[2024-07-26] Accepted jupyterhub 5.0.0+ds1-3 (source) into unstable (Roland Mas)
[2024-07-23] Accepted jupyterhub 5.0.0+ds1-2 (source) into unstable (Alexandre Detiste)
[2024-06-09] Accepted jupyterhub 5.0.0+ds1-1 (source) into unstable (Roland Mas)
[2024-06-04] jupyterhub REMOVED from testing (Debian testing watch)
[2022-11-21] jupyterhub 3.0.0+ds1-1 MIGRATED to testing (Debian testing watch)
[2022-11-16] Accepted jupyterhub 3.0.0+ds1-1 (source) into unstable (Roland Mas)
[2022-10-20] jupyterhub 2.0.0+ds1-2.1 MIGRATED to testing (Debian testing watch)
[2022-10-15] Accepted jupyterhub 2.0.0+ds1-2.1 (source) into unstable (Michael Biebl)
[2022-01-19] jupyterhub 2.0.0+ds1-2 MIGRATED to testing (Debian testing watch)
[2022-01-19] jupyterhub 2.0.0+ds1-2 MIGRATED to testing (Debian testing watch)
[2022-01-13] Accepted jupyterhub 2.0.0+ds1-2 (source) into unstable (Roland Mas)
[2021-12-25] jupyterhub 2.0.0+ds1-1 MIGRATED to testing (Debian testing watch)
[2021-12-04] Accepted jupyterhub 2.0.0+ds1-1 (source) into unstable (Roland Mas)
[2021-11-27] Accepted jupyterhub 1.4.1+ds2-1 (source all) into unstable, unstable (Debian FTP Masters) (signed by: Roland Mas)

bugs [bug history graph]

all: 7
RC: 0
I&N: 6
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian (0, 3)
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 5.2.1+ds1-5