CVE-2022-37601

Advisory

Jupytext 1.14.2 updates its NPM dependency 'loader-utils' to v1.4.1 to include a security fix.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

-------------------

**Fixed**
- The sample notebooks have been normalized with `nbformat.validator.normalize` ([1002](https://github.com/mwouts/jupytext/issues/1002)).
- The warnings in the test suite that we cannot fix are filtered using a new `pytest.ini` file
- We updated the `yarn.lock` file for the jupyter lab extension to address security vulnerabilities ([984](https://github.com/mwouts/jupytext/issues/984), [#1005](https://github.com/mwouts/jupytext/issues/1005), [#1011](https://github.com/mwouts/jupytext/issues/1011))

**Changed**
- The CI uses Python 3.9 rather than 3.7 when testing conda environments

**Added**
- Gnuplot is now supported ([998](https://github.com/mwouts/jupytext/issues/998)) - thanks to [razimantv](https://github.com/razimantv) for this contribution
- We now test Jupytext against Python 3.6 to 3.11 on the CI
- We have added a test to document how to use the folder and prefix matching when pairing notebooks ([974](https://github.com/mwouts/jupytext/issues/974))

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37601