[BUG] Relax itables version to >= 2.4.0
- Dominant language
- Jupyter Notebook
- Stars
- 819
- Forks
- 179
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
`graph-notebook==5.2.0` pins `itables>=2.0.0,<=2.1.0` in `pyproject.toml`. This upper bound predates `itables 2.4.0`, in which HTML content in DataFrame cells is escaped by default (fix: [mwouts/itables#346](https://github.com/mwouts/itables/issues/346)). In `itables<=2.1.0`, cell contents are passed verbatim to DataTables and rendered as live HTML/JS.
graph-notebook itself is not affected afaik, but it would be nice to relax itables version to avoid installing a vulnerable dependency
**Environment**
- OS: Ubuntu 24.04
- Browser: Google Chrome
- graph-notebook: 5.2.0
**To Reproduce**
In a fresh JupyterLab environment with `graph-notebook==5.2.0` installed (which pulls `itables==2.1.0`), run:
```python
import pandas as pd
from itables import show
results_df = pd.DataFrame({
"id": [1, 2, 3],
"name": [
"alice",
"bob",
'\\"alert(\'random text\')',
],
})
show(results_df)
```
**Expected behavior**
No live html rendered
Contributor guide
Research direction
Start in pyproject.toml, where graph-notebook pins the itables dependency. Verify that the constraint permits itables 2.4.0 or newer, install graph-notebook in a clean JupyterLab environment, and confirm the reported DataFrame example no longer renders live HTML.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- jupyter, pandas, python
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 82/100