CVE-2021-32640

Advisory

Jupytext 1.11.3 updates a dependency of the 'JupyterLab' extension (ws) to fix a vulnerability.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

-------------------

**Changed**
- Jupytext CLI has a new option `--use-source-timestamp` that sets the last modification time of the output file equal to that of the source file (this avoids having to change the timestamp of the source file) ([784](https://github.com/mwouts/jupytext/issues/784))
- In the pre-commit mode, Jupytext now uses the commit timestamp to determine which file in the pair is the most recent ([780](https://github.com/mwouts/jupytext/issues/780))


**Fixed**
- Dependencies of the JupyterLab extension have been upgraded to fix a security vulnerability ([798](https://github.com/mwouts/jupytext/pull/798))
- The `--warn-only` option also applies to pipes. Use this if the pipe may fail, e.g. if you apply `black` on a possibly invalid script ([781](https://github.com/mwouts/jupytext/issues/781))
- Variables assigned from a magic command are commented out in `py` scripts ([781](https://github.com/mwouts/jupytext/issues/781))
- Fixed a round-trip issue on notebooks that have None/null in their metadata ([792](https://github.com/mwouts/jupytext/issues/792))

Resources

• https://pypi.org/project/jupytext
• https://pyup.io/changelogs/jupytext/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32640