jupyter-server 2.18.0

v2.18.0

on Python PyPI

2.18.0

(Full Changelog)

Security patches

• CVE-2026-40110 GHSA-24qx-w28j-9m6p
• CVE-2025-61669 GHSA-qh7q-6qm3-653w
• CVE-2026-40934 GHSA-5mrq-x3x5-8v8f
• CVE-2026-35397 GHSA-5789-5fc7-67v3

API and Breaking Changes

• Add query param to sanitize HTML in GET /nbconvert/html #1618 (@Yann-P, @Carreau)

Enhancements made

• Update handlers.py to fix ioloop blockers(sync file operations) #1617 (@zolyfarkas-fb, @Carreau)
• Add resolvePath API for resolving kernel-relative paths #1331 (@krassowski, @Carreau, @blink1073)

Bugs fixed

• Move check origin into a util function and add it to websocket #1630 (@Carreau, @Yann-P)
• Fix flaky test_restart_kernel by unsticking nudge() after port-changing restart #1628 (@Carreau, @claude, @krassowski)
• Try to fix flaky test "test_restart_kernel" #1625 (@Carreau)
• Fix potential unraisable pytest error #1624 (@Carreau)
• fix: use %s placeholders in HTTPError to prevent Tornado from doubling % in gateway URLs #1620 (@terminalchai, @krassowski, @ptch314)
• Fix three file descriptor leaks in kernel connection lifecycle (#1506) #1619 (@tonyx93, @Carreau)
• Use web.HTTPError for kernel restart failures #1616 (@YDawn, @Carreau)
• Handle EADDRINUSE and EACCES in _bind_http_server_tcp #1613 (@YDawn, @Zsailer, @minrk)
• Use st_birthtime for file created timestamp on macOS/BSD #1594 (@ktaletsk, @krassowski, @minrk)
• Fix double write when refusing hidden files in contents handler #1585 (@Krish-876, @minrk)
• Close all sockets in _find_http_port explicitly #1584 (@MaryushSoroka, @minrk)
• Fix writing on remote file systems with attribute cache #1574 (@krassowski, @Zsailer)
• Add IdentityProvider.cookie_secret_hook #1569 (@emin63, @minrk)
• fix context pollution #1561 (@dualc, @Zsailer)
• Fix gateway cookie handling #1558 (@kevin-bates, @RRosio, @lresende, @minrk)
• fix connection exception cause high cpu load #1484 (@dualc, @lresende, @minrk)

Maintenance and upkeep improvements

• Start to test on Python 3.13 and 3.14 #1623 (@Carreau)
• Bump actions/create-github-app-token from 2 to 3 in the actions group across 1 directory #1621 (@Carreau)
• Bump brace-expansion from 1.1.12 to 1.1.13 #1615 (@minrk)
• Fix package spec for jupytext #1614 (@krassowski, @Zsailer)
• chore: update pre-commit hooks #1607 (@minrk)
• try to fix ci on windows #1600 (@minrk, @krassowski)
• run prerelease tests on 3.14 #1599 (@minrk)
• Pin sphinx to an older version (<9) to fix docs #1597 (@krassowski, @minrk)
• Restore running all tests for Windows in CI workflow #1581 (@krassowski, @Zsailer)
• Fix flaky test_execution_state test #1579 (@krassowski, @Zsailer)
• Fix failing link check due to a blog post referred in docs changing URL format #1577 (@krassowski, @Zsailer)
• Fix lint on CI, pin ruff to the same version in hatch fmt and pre-commit #1576 (@krassowski, @Zsailer)
• Bump actions/checkout from 5 to 6 in the actions group #1572 (@minrk)
• don't link check npm #1568 (@minrk, @Zsailer)
• Bump brace-expansion from 1.1.11 to 1.1.12 #1546 (@minrk)
• Replace @flaky.flaky decorate with pytest marker #1544 (@mgorny, @minrk)
• chore: update pre-commit hooks #1449 (@minrk)

Documentation improvements

• some docs fixes #1627 (@Carreau, @krassowski)
• Updated dev install instructions #1622 (@bloomsa, @Carreau)
• Fix outdated ContentsManager testing guidance #1611 (@terminalchai, @Zsailer, @lresende, @minrk)
• add missing word 'to' #1596 (@carlfarrington, @krassowski, @minrk)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review.
See our definition of contributors.

(GitHub contributors page for this release)

@blink1073 (activity) | @bloomsa (activity) | @carlfarrington (activity) | @Carreau (activity) | @claude (activity) | @codecov-commenter (activity) | @dualc (activity) | @echarles (activity) | @emin63 (activity) | @fcollonval (activity) | @kevin-bates (activity) | @krassowski (activity) | @Krish-876 (activity) | @ktaletsk (activity) | @lresende (activity) | @MaryushSoroka (activity) | @mgorny (activity) | @minrk (activity) | @ptch314 (activity) | @rgbkrk (activity) | @RRosio (activity) | @terminalchai (activity) | @tonyx93 (activity) | @Yann-P (activity) | @YDawn (activity) | @zolyfarkas-fb (activity) | @Zsailer (activity)