Bump the uv group across 1 directory with 5 updates by dependabot[bot] · Pull Request #531 · intel/AI-PC-Samples

dependabot · 2026-08-24T16:15:39Z

Bumps the uv group with 5 updates in the /openvino_notebooks/hello-npu directory:

Package	From	To
jupyterlab	`4.5.8`	`4.5.10`
mistune	`3.2.1`	`3.3.0`
pillow	`12.2.0`	`12.3.0`
setuptools	`82.0.1`	`83.0.0`
jupyter-server	`2.19.0`	`2.20.0`

Updates jupyterlab from 4.5.8 to 4.5.10

Release notes

Sourced from jupyterlab's releases.

v4.5.10

4.5.10

(Full Changelog)

Security patches

GHSA-gx64-gj6p-pc4c

GHSA-89vp-jrxv-24w8

GHSA-h5v5-8746-g7mm

GHSA-pppj-hq3g-57pj

GHSA-whvh-wf3x-g77j

Bugs fixed

Backport of security patches to 4.5.x branch #19186 (@krassowski, @MUFFANUJ)

Maintenance and upkeep improvements

Reconfigure 4.5.x branch (4.6.x is new stable) #19060 (@krassowski)

Split external link checks and only run if diff includes a URL #19029 (@MUFFANUJ)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@krassowski (activity) | @MUFFANUJ (activity)

v4.5.9

4.5.9

(Full Changelog)

Bugs fixed

Fix jupyter labextension build crash on webpack ≥ 5.107 #19021 (@Darshan808, @krassowski)

Backport PR #18992: Fix hidden cells after moving collapsed headings #19016 (@MUFFANUJ, @krassowski)

Forbid relative URLs in extensionmanager #19013 (@Yann-P)

Fix XSS in extension manager's homepage_url #19003 (@Yann-P)

Fix toolbar popup row clipping in Safari #18998 (@arun-357)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review.

... (truncated)

Commits

af5f5b3 [ci skip] Publish 4.5.10
be9303f Backport of security patches to 4.5.x branch (#19186)
a555fe1 Reconfigure 4.5.x branch (4.6.x is new stable) (#19060)
8d8cb6d Backport PR #19029 on branch 4.5.x (Split external link checks and only run i...
dd65403 [ci skip] Publish 4.5.9
2693672 Backport PR #18992: Fix hidden cells after moving collapsed headings (#19016)
360c176 Backport PR #18998 on branch 4.5.x (Fix toolbar popup row clipping in Safari)...
e9db010 Fix jupyter labextension build crash on webpack ≥ 5.107 (#19021)
3b8428c Backport PR #19013 on branch 4.5.x (Forbid relative URLs in extensionmanager)...
3c84a84 Backport PR #19003 on branch 4.5.x (Fix XSS in extension manager's `homepage_...
See full diff in compare view

Updates mistune from 3.2.1 to 3.3.0

Release notes

Sourced from mistune's releases.

v3.3.0

   🐞 Bug Fixes

Resolve O(n^2) DoS in parse_link_text (CWE-400) - by bhanugoudm041 (b6b49)

Resolve O(n^2) DoS in parse_link_text (CWE-400)-Type handling/testing done - by bhanugoudm041 (b3af8)

block: Avoid quadratic ref link scans - by @lepture (2b04d)

cli: Add entrypoint and utf-8 output - by @lepture (2f244)

directives: Constrain include targets - by @lepture (1bef3)

formatting: Avoid quadratic marker scans - by @lepture (96d0f)

image: Validate figure width option - by @lepture (e3e51)

inline: Avoid bracket parsing DoS - by @lepture (25f25)

math: Reject currency patterns and cross-line matches in inline math - by @geopanther (566e1)

math: Support display and backtick math - by @lepture (1141e)

renderer: Render plugin list and table nodes - by @lepture (614b0)

renderer: Block encoded unsafe URL schemes - by @lepture (c7101)

toc: Avoid generated id collisions - by @lepture (c4093)

   🏎 Performance

Improve performance - by @lepture (bf95c)

    View changes on GitHub

Changelog

Sourced from mistune's changelog.

Version 3.3.0

Released on Jun 21, 2026

Improve CommonMark compatibility and parser performance.

Add command line entrypoint with UTF-8 output.

Support display and backtick math.

Render plugin list and table nodes in Markdown renderer.

Escape leading block markers in Markdown renderer.

Fix RST renderer for block quotes nested in lists.

Avoid generated heading ID collisions in TOC.

Harden URL, image, figure, and include directive handling.

Fix quadratic scans in inline links, reference links, and formatting markers.

Fix math escaping, currency pattern matching, and cross-line matching.

Commits

15c3b79 chore: release 3.3.0
bdc01ad tests: increase run time on pypy
7cf1814 tests: increase run time for pypy
6dfdc3d tests: add more tests
17c50f6 chore: fix mypy issues
63abe4b chore: use ruff check and format
e6c1b18 chore: resolve mypy issues
dcf8902 test(math): cover escaped math output
c4093c4 fix(toc): avoid generated id collisions
e3e51de fix(image): validate figure width option
Additional commits viewable in compare view

Updates pillow from 12.2.0 to 12.3.0

Release notes

Sourced from pillow's releases.

12.3.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html

Removals

Remove non-image ImageCms modes #9697 [@radarhere]

Documentation

Add release notes for SBOM and performance improvements #9747 [@radarhere]

Add security release notes #9741 [@radarhere]

Add release notes for Python 3.15 beta wheels #9696 [@radarhere]

ImageFont can also be used with ImageText #9597 [@radarhere]

Additional guidelines for security reports #9659 [@wiredfool]

Fixed typo #9636 [@radarhere]

Added CVEs to 12.2.0 release notes #9591 [@radarhere]

Revise development support information in README #9583 [@aclark4life]

Add INCIDENT_RESPONSE.md #9555 [@aclark4life]

Add STRIDE threat model to security docs #9562 [@aclark4life]

Add CVEs to 12.2.0 release notes #9556 [@radarhere]

Update README with revised security policy #9553 [@radarhere]

Update security policy #9552 [@aclark4life]

Update macOS tested Python versions #9534 [@radarhere]

Dependencies

Update dependency harfbuzz to v14.2.1 #9720 [@renovate[bot]]

Update dependency mypy to v2 #9653 [@renovate[bot]]

Update dependency cibuildwheel to v4 #9665 [@renovate[bot]]

Update github-actions #9655 [@renovate[bot]]

Update dependency libavif to v1.4.2 #9652 [@renovate[bot]]

Update dependency lcms2 to v2.19.1 #9651 [@renovate[bot]]

Update dependency check-jsonschema to v0.37.2 #9650 [@renovate[bot]]

Update google/oss-fuzz digest to d872252 #9614 [@renovate[bot]]

Update dependency lcms2 to v2.19 #9609 [@renovate[bot]]

Update dependency libpng to v1.6.58 - autoclosed #9608 [@renovate[bot]]

Update dependency harfbuzz to v14 #9610 [@renovate[bot]]

Update dependency mypy to v1.20.2 #9599 [@renovate[bot]]

Update github-actions #9611 [@renovate[bot]]

Update dependency cibuildwheel to v3.4.1 #9607 [@renovate[bot]]

Move dependency versions to single JSON and enable Renovate #9559 [@hugovk]

Updated raqm to 0.10.5 #9557 [@radarhere]

Update dependency cibuildwheel to v3.4.0 #9532 [@renovate[bot]]

Testing

Remove matrix.os from benchmark #9735 [@radarhere]

Remove references to libavif patch #9734 [@radarhere]

Add benchmark tests #9654 [@akx]

Use reshape() instead of setting NumPy array shape directly #9728 [@radarhere]

... (truncated)

Commits

bb1d8e8 12.3.0 version bump
e63fc48 Add release notes for SBOM and performance improvements (#9747)
13b701b Add release notes for #9679
5564ca7 List methods
a0920fd Speed up ImageChops operations (#9738)
07e9a6c Speed up Image.filter() (#9736)
a94578c Speed up Image.getchannel(), Image.merge(), Image.putalpha() and `Image...
53e02c4 Speed up Image.fill(), Image.linear_gradient() and `Image.radial_gradient...
af03747 Speed up Image.resample() (#9739)
5c9ca56 Speed up alpha_composite, matrix, negative, quantize (#9740)
Additional commits viewable in compare view

Updates setuptools from 82.0.1 to 83.0.0

Changelog

Sourced from setuptools's changelog.

v83.0.0

Features

Require Python 3.10 or later.

Bugfixes

MANIFEST.in matching (via FileList) is now insensitive to Unicode normalization form. A pattern authored in one form (e.g. NFC, as typically saved by editors) now matches a file whose name is stored on disk in another (e.g. NFD, as produced by macOS APFS/HFS+). Previously an exclude, global-exclude, recursive-exclude, or prune rule could silently fail to drop a non-ASCII-named file from the source distribution, publishing it despite the exclusion -- see GHSA-h35f-9h28-mq5c.

Deprecations and Removals

pypa/distutils#334

Commits

6519f72 Bump version: 82.0.1 → 83.0.0
d1151b1 Merge pull request #5250 from pypa/feature/distutils-d7633fbed
a2df31e Capture removal of dry_run parameter in changelog.
00144dc Moved newsfragment to the release where it occurred.
a4a5a2b Add news fragment.
77470c2 Merge https://github.com/pypa/distutils into feature/distutils-d7633fbed
3c43897 Merge pull request #5247 from pypa/copilot/fix-pypy-version-issue
bb6ea66 Bump PyPy from 3.10 to 3.11 in CI workflow
a2bc3ac Fix broken intersphinx reference to build's installation docs
2d6a739 Use stacked parametrize decorators instead of itertools.product
Additional commits viewable in compare view

Updates jupyter-server from 2.19.0 to 2.20.0

Release notes

Sourced from jupyter-server's releases.

v2.20.0

2.20.0

(Full Changelog)

Security fixes

CVE-2026-44727 GHSA-fcw5-x6j4-ccmp

Enhancements made

Fix confusing terminal output when using ServerApp.ip=0.0.0.0 #1643 (@Yann-P, @minrk)

Add a toggle to enable curve encryption for all kernels that support it #1638 (@krassowski, @Carreau, @ianthomas23, @minrk)

Bugs fixed

Grab the port from bind_sockets in case its different #1651 (@choldgraf, @krassowski)

Maintenance and upkeep improvements

Fix test_authorizer having a spurious comma in params #1664 (@krassowski)

Add a reminder to merge GHSA before release #1659 (@Yann-P, @Carreau)

Exclude problematic pywinpty 3.0.4 version #1658 (@krassowski)

ci: explicitly pass base-setup inputs to fix strict validation failures #1626 (@Carreau, @Copilot)

Documentation improvements

Align docs for curve encryption with latest JEP version #1660 (@krassowski, @Carreau)

Remove PGP key from docs #1653 (@Yann-P, @krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@Carreau (activity) | @choldgraf (activity) | @Copilot (activity) | @ianthomas23 (activity) | @krassowski (activity) | @minrk (activity) | @Yann-P (activity)

Changelog

Sourced from jupyter-server's changelog.

2.20.0

(Full Changelog)

Enhancements made

Fix confusing terminal output when using ServerApp.ip=0.0.0.0 #1643 (@Yann-P, @minrk)

Add a toggle to enable curve encryption for all kernels that support it #1638 (@krassowski, @Carreau, @ianthomas23, @minrk)

Bugs fixed

Grab the port from bind_sockets in case its different #1651 (@choldgraf, @krassowski)

Maintenance and upkeep improvements

Fix test_authorizer having a spurious comma in params #1664 (@krassowski)

Add a reminder to merge GHSA before release #1659 (@Yann-P, @Carreau)

Exclude problematic pywinpty 3.0.4 version #1658 (@krassowski)

ci: explicitly pass base-setup inputs to fix strict validation failures #1626 (@Carreau, @Copilot)

Documentation improvements

Align docs for curve encryption with latest JEP version #1660 (@krassowski, @Carreau)

Remove PGP key from docs #1653 (@Yann-P, @krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@Carreau (activity) | @choldgraf (activity) | @Copilot (activity) | @ianthomas23 (activity) | @krassowski (activity) | @minrk (activity) | @Yann-P (activity)

Commits

05a78ad Publish 2.20.0
6cbee8d Merge commit from fork
333e700 Fix test_authorizer having a spurious comma in params (#1664)
cccd543 Fix CI: explicitly pass base-setup inputs to avoid strict validation failures
cd16d71 Align docs for curve encryption with latest JEP version (#1660)
e458061 Add a toggle to enable curve encryption for all kernels that support it (#1638)
0ceeb4f Add note in RELEASE.md
b13f8a2 Markdown does not work.
e885b10 Add GHSA reminder in prep-release
0e28c90 Exclude problematic pywinpty 3.0.4 version (#1658)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the uv group with 5 updates in the /openvino_notebooks/hello-npu directory: | Package | From | To | | --- | --- | --- | | [jupyterlab](https://github.com/jupyterlab/jupyterlab) | `4.5.8` | `4.5.10` | | [mistune](https://github.com/lepture/mistune) | `3.2.1` | `3.3.0` | | [pillow](https://github.com/python-pillow/Pillow) | `12.2.0` | `12.3.0` | | [setuptools](https://github.com/pypa/setuptools) | `82.0.1` | `83.0.0` | | [jupyter-server](https://github.com/jupyter-server/jupyter_server) | `2.19.0` | `2.20.0` | Updates `jupyterlab` from 4.5.8 to 4.5.10 - [Release notes](https://github.com/jupyterlab/jupyterlab/releases) - [Changelog](https://github.com/jupyterlab/jupyterlab/blob/main/RELEASE.md) - [Commits](https://github.com/jupyterlab/jupyterlab/compare/@jupyterlab/lsp@4.5.8...@jupyterlab/lsp@4.5.10) Updates `mistune` from 3.2.1 to 3.3.0 - [Release notes](https://github.com/lepture/mistune/releases) - [Changelog](https://github.com/lepture/mistune/blob/main/docs/changes.rst) - [Commits](lepture/mistune@v3.2.1...v3.3.0) Updates `pillow` from 12.2.0 to 12.3.0 - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@12.2.0...12.3.0) Updates `setuptools` from 82.0.1 to 83.0.0 - [Release notes](https://github.com/pypa/setuptools/releases) - [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst) - [Commits](pypa/setuptools@v82.0.1...v83.0.0) Updates `jupyter-server` from 2.19.0 to 2.20.0 - [Release notes](https://github.com/jupyter-server/jupyter_server/releases) - [Changelog](https://github.com/jupyter-server/jupyter_server/blob/main/CHANGELOG.md) - [Commits](jupyter-server/jupyter_server@v2.19.0...v2.20.0) --- updated-dependencies: - dependency-name: jupyterlab dependency-version: 4.5.10 dependency-type: direct:production dependency-group: uv - dependency-name: mistune dependency-version: 3.3.0 dependency-type: indirect dependency-group: uv - dependency-name: pillow dependency-version: 12.3.0 dependency-type: direct:production dependency-group: uv - dependency-name: setuptools dependency-version: 83.0.0 dependency-type: indirect dependency-group: uv - dependency-name: jupyter-server dependency-version: 2.20.0 dependency-type: indirect dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 24, 2026

dependabot Bot mentioned this pull request Aug 24, 2026

Bump the uv group across 1 directory with 4 updates #530

Closed

Navigation Menu

Uh oh!

Bump the uv group across 1 directory with 5 updates - #531

Bump the uv group across 1 directory with 5 updates#531
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/openvino_notebooks/hello-npu/uv-2e65cae6b7

dependabot Bot commented on behalf of github Aug 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 24, 2026

v4.5.10

4.5.10

Security patches

Bugs fixed

Maintenance and upkeep improvements

Contributors to this release

v4.5.9

4.5.9

Bugs fixed

Contributors to this release

v3.3.0

🐞 Bug Fixes

🏎 Performance

View changes on GitHub

Version 3.3.0

12.3.0

Removals

Documentation

Dependencies

Testing

v83.0.0

Features

Bugfixes

Deprecations and Removals

v2.20.0

2.20.0

Security fixes

Enhancements made

Bugs fixed

Maintenance and upkeep improvements

Documentation improvements

Contributors to this release

2.20.0

Enhancements made

Bugs fixed

Maintenance and upkeep improvements

Documentation improvements

Contributors to this release

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants