aws / aws/graph-notebook

[BUG] Relax itables version to >= 2.4.0

Open Beginner friendly
#780 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Jupyter Notebook
Stars
819
Forks
179
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**

`graph-notebook==5.2.0` pins `itables>=2.0.0,<=2.1.0` in `pyproject.toml`. This upper bound predates `itables 2.4.0`, in which HTML content in DataFrame cells is escaped by default (fix: [mwouts/itables#346](https://github.com/mwouts/itables/issues/346)). In `itables<=2.1.0`, cell contents are passed verbatim to DataTables and rendered as live HTML/JS.

graph-notebook itself is not affected afaik, but it would be nice to relax itables version to avoid installing a vulnerable dependency

**Environment**
- OS: Ubuntu 24.04
- Browser: Google Chrome
- graph-notebook: 5.2.0

**To Reproduce**
In a fresh JupyterLab environment with `graph-notebook==5.2.0` installed (which pulls `itables==2.1.0`), run:
```python
import pandas as pd
from itables import show
results_df = pd.DataFrame({
"id": [1, 2, 3],
"name": [
"alice",
"bob",
'\\"alert(\'random text\')',
],
})
show(results_df)
```

Image

**Expected behavior**

No live html rendered

Contributor guide

Open the contributing guide

Research direction

Start in pyproject.toml, where graph-notebook pins the itables dependency. Verify that the constraint permits itables 2.4.0 or newer, install graph-notebook in a clean JupyterLab environment, and confirm the reported DataFrame example no longer renders live HTML.

Written by the indexing model from the issue text.

Assessment

Tech stack
jupyter, pandas, python
Domain
security, tooling
Issue type
Bug
Difficulty
1/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
82/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.