Accepted jupyterlab 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3 (source) into unstable

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 28 Jul 2026 10:11:40 +0200
Source: jupyterlab
Architecture: source
Version: 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed-By: Bastien Roucariès <rouca@debian.org>
Changes:
 jupyterlab (4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3) unstable; urgency=medium
 .
   * Upload to unstable
   * Do not run slow test on slow arch
   * Fix CVE-2026-40171:
     Command linker attributes chained with help command enable
     one-click authentication token theft
   * Fix CVE-2026-42266:
     JupyterLab has an Extension Manager API/GUI Policy Discrepancy,
     allowing 3rd party (malicious) extensions install via POST request
   * Fix CVE-2026-42557:
     Command linker attributes in HTML enable one-click command
     execution from untrusted content
Checksums-Sha1:
 23bceea933025c001524922179e5db766162cb69 6811 jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3.dsc
 eb34b3ea64ee87b0a73937bf0bae5cc72ba81777 1597928 jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig-jupyter-ui-toolkit.tar.xz
 1f0180cf4cbc9d9ffd840133870eb8b7a7be7b2b 97376 jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig-jupyter-ydoc.tar.xz
 76cbeff51ac6b13ca1e7199e40846e205e280ff9 4780 jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig-mini-svg-data-uri.tar.xz
 a561c423a97624071c09945c29ae2bb807b40ef2 19641464 jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig.tar.xz
 3b4b76bc3d2967bd5199ed206ab6bbfe213af1f5 35820 jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3.debian.tar.xz
 cf4de8ca3a9f6652585cb7431ed8f039ad8e0b4b 28199 jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3_source.buildinfo
Checksums-Sha256:
 2d9df4d7584c0814433ba18efb9f4f0fce5caccd4e8f238a8f1242c9393486cc 6811 jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3.dsc
 a5eabc67c064e96bf431307d48b7f5fd8bd4fe32156a270c4b07aee4607ca828 1597928 jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig-jupyter-ui-toolkit.tar.xz
 8afd6186534f2cb6037103c1101211cc6cf21ecf735923157957adb474887784 97376 jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig-jupyter-ydoc.tar.xz
 54bf2f94b9809e10224766d91e9c778cada0f7e07fda42f3071002d6fa010cc7 4780 jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig-mini-svg-data-uri.tar.xz
 cb8948247270001f997aa278b44283d0854d83a657bf5b2431b955d9ee804de1 19641464 jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig.tar.xz
 a46d8fce30aa378cbdfd3917c35977fdaeca016816b94a572b42e72c733eba49 35820 jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3.debian.tar.xz
 b28934ab2e7ba8bd6effa514ee96a0eea557737b5054c472e880560a58f34227 28199 jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3_source.buildinfo
Files:
 60b31c89d6c03709fbe9b450c39e1eed 6811 javascript optional jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3.dsc
 52848eb1b1e253029383dc18606526d1 1597928 javascript optional jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig-jupyter-ui-toolkit.tar.xz
 a65317257cd84125c53cbbf15381fbd1 97376 javascript optional jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig-jupyter-ydoc.tar.xz
 bb699f5f37e7bcae34413fd523a58559 4780 javascript optional jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig-mini-svg-data-uri.tar.xz
 5ba8b17523e2a071860b3e9a5b8b482c 19641464 javascript optional jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig.tar.xz
 57da122aafb0068cedac3586e7ea1fa6 35820 javascript optional jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3.debian.tar.xz
 23cccbe5f8290ff0976b36b2c40cd837 28199 javascript optional jupyterlab_4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3_source.buildinfo

-----BEGIN PGP SIGNATURE-----

wsG7BAEBCgBvBYJqaGSsCRAAOhotqkEIX0cUAAAAAAAeACBzYWx0QG5vdGF0aW9u
cy5zZXF1b2lhLXBncC5vcmfGEyiPqp0PVbu4b/1RpS0ijN1OpRoCUN2WpqE/pxJb
qhYhBF0Bh7lAokW617D1agA6Gi2qQQhfAADz8w//TPC0AxKOK+KxUTIqzqPHZyDD
tBPBk09oLqMgotsv4Q4tInhEhgFDAIKMfCj0U2MCtN/z7Ozwu2RD751iylkTeqnJ
PtNSL3NX+LHcZHcjpEdVrZxUZ92nzCx2pblMDqtXXkO2nhFMLRil+IQUK+bqmqlq
BleAOy2SEIq3ueiotndPs8AXKFmNeZ+uPj8/yx9mAsdZPCLsWEh+yan9TZSNZGOK
J+AxRd2B0AI5LE3jMD6vXEwiJwFNU0n2eUTP7kIkRVyW/zG4IW7ZWbRBfv7epRGZ
hdhojL6dgY5ARi3bImVHFdB0qXzudMUyJ/0+aHroWVG4AsjE38+ouTeEgLeuLTEL
Ir4jOrFYvO7c0FnG25dt/cENVZeQhTdD8UDZpzm2lBYmuApbzKd4/jNNswRZh/EJ
ItqjUCYRTqruaVwXHep5V7LI1k3irDLvjCUtfT5K+uhnwcOVzigaBLVruIBn9EED
XbQHPjw7xuE+AUVJiNY6QFQ8TyPi+CvocUtGtieqcP9a0o3cySYiUdVs6dst+bxL
OIV+/rICWghEfKVP7m3WXGxVeAHHpgntavi21YB1YbP+vo0kczdar99G/7bXb4CW
HQ3pauUpjScC0QPdC4E8gfmvBwB6bkvJYPh7Uy3Ax3B9obLcyhtTjoSpPexNj2c4
9OMWIcu+FIrSSfg/5Wg=
=C2gN
-----END PGP SIGNATURE-----