Accepted jupyterlab 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-1 (source) into experimental

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 21 Jul 2026 18:57:10 +0200
Source: jupyterlab
Architecture: source
Version: 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-1
Distribution: experimental
Urgency: medium
Maintainer: Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed-By: Bastien Roucariès <rouca@debian.org>
Changes:
 jupyterlab (4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-1) experimental; urgency=medium
 .
   * New upstream release
   * Fix CVE-2026-40171:
     Command linker attributes chained with help command enable
     one-click authentication token theft
   * Fix CVE-2026-42266:
     JupyterLab has an Extension Manager API/GUI Policy Discrepancy,
     allowing 3rd party (malicious) extensions install via POST request
   * Fix CVE-2026-42557:
     Command linker attributes in HTML enable one-click command
     execution from untrusted content
Checksums-Sha1:
 43538755bbc32c0bc36d8779d6e6ca0793cf00b5 6801 jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-1.dsc
 eb34b3ea64ee87b0a73937bf0bae5cc72ba81777 1597928 jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig-jupyter-ui-toolkit.tar.xz
 1f0180cf4cbc9d9ffd840133870eb8b7a7be7b2b 97376 jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig-jupyter-ydoc.tar.xz
 76cbeff51ac6b13ca1e7199e40846e205e280ff9 4780 jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig-mini-svg-data-uri.tar.xz
 a561c423a97624071c09945c29ae2bb807b40ef2 19641464 jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig.tar.xz
 b32b23195b9d8c20a6a84c8743b21452e1dd988b 35036 jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-1.debian.tar.xz
 c0976ed0c12989331fc41995848de11f14fd43cb 28207 jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-1_source.buildinfo
Checksums-Sha256:
 b8ec29834f495f8aa63e5773cdfb7d9b2de751ea443eac2854f287ca0ddbd768 6801 jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-1.dsc
 a5eabc67c064e96bf431307d48b7f5fd8bd4fe32156a270c4b07aee4607ca828 1597928 jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig-jupyter-ui-toolkit.tar.xz
 8afd6186534f2cb6037103c1101211cc6cf21ecf735923157957adb474887784 97376 jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig-jupyter-ydoc.tar.xz
 54bf2f94b9809e10224766d91e9c778cada0f7e07fda42f3071002d6fa010cc7 4780 jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig-mini-svg-data-uri.tar.xz
 cb8948247270001f997aa278b44283d0854d83a657bf5b2431b955d9ee804de1 19641464 jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig.tar.xz
 d6d5fa190ec3f13695838ddff1a336f7f0797f5431f4db05734b2484aea45325 35036 jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-1.debian.tar.xz
 5263c980ce763ff9b732c66e43624c2fbf29c358283eb4126b2c727ae71c3c46 28207 jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-1_source.buildinfo
Files:
 5d43a2d6030ab7118f5f0e07dc6f5186 6801 javascript optional jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-1.dsc
 52848eb1b1e253029383dc18606526d1 1597928 javascript optional jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig-jupyter-ui-toolkit.tar.xz
 a65317257cd84125c53cbbf15381fbd1 97376 javascript optional jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig-jupyter-ydoc.tar.xz
 bb699f5f37e7bcae34413fd523a58559 4780 javascript optional jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig-mini-svg-data-uri.tar.xz
 5ba8b17523e2a071860b3e9a5b8b482c 19641464 javascript optional jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig.tar.xz
 ab6cc04c8521c7219a9fe0a0a9871413 35036 javascript optional jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-1.debian.tar.xz
 e9abf3f72a10fd2b0cf73285c4ae2c27 28207 javascript optional jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

wsG7BAEBCgBvBYJqX6UrCRAAOhotqkEIX0cUAAAAAAAeACBzYWx0QG5vdGF0aW9u
cy5zZXF1b2lhLXBncC5vcmcJmeq7mlcMNB9PPeZVX4t0I7XrFm4YPGyCQ/luV7H6
+xYhBF0Bh7lAokW617D1agA6Gi2qQQhfAABbew//dAQ2r5NEuoVZ8D5cAEESar8n
nJNFBiGKUz/a9GkPPrO30PqdcS/iODddDZ6IyxipVCuvmXEA6Q35co0qfUK9Ye07
yHBSbgNVqzgl6m2xnNOCkq2PXsLeKn9sn3h6KwozxcEhWuNt5TNrjuYV/046h/2S
32iq47jzdxhyPxAE8RaRDmGOzxzDx68aJffAU2EWvwECmHziBYvgE7DmtrtUVmsi
wAd65FGHFpydzN4O/ANPMXvTAPhAVGLPg3CrucpgZJ8X7OcTL21YD6NMNR5OYt/Q
OC2oAOyPM4JnT4gwc8N2vVMIMnrOWt+sohI8SIk8xGPccsR7I82dEerrHdVv8xVY
yjNiGgCkQMvjUO00JaOC6hD90lAnkYkmjOdCcWbQS6gnhrJYTktJCQvpw9y/lFx2
ENeKK5XqoFxjPGJjPZldG3/XWMrDMCe56voROsWn/U4VsDUqGoRtRgxrluaBP1Np
t5tHcJZmBmG+K1/3rAb5/cxFuLmXp99i4KeiplStG67R2hA12w3pKiAuC5p5W8Fg
k9TiWeMwZdVr/0M5gb8A2nfIstS2QKG7YrtFhndV9HdZfzxY48+n+2sHNcf665be
Rf2QOazOqZA6KTHj9plser86yWGuHj5Ll/TpyI8Y8/jlvy92lVz/rOrDm3VabLB/
jZP3WqGUv+hP+4n0us4=
=bNSN
-----END PGP SIGNATURE-----