Bump jupyter-server to 2.20.0 to fix CVE-2026-44727

[simsa-st]

Fixes Dependabot alert #236 — the only critical alert currently open on main.

The vulnerability

jupyter-server <= 2.19.0 renders notebook HTML in the nbconvert handlers under the Jupyter origin without a sandbox CSP directive. Because nbconvert's HTMLExporter does not sanitize by default, a notebook carrying an HTML payload in a display_data output yields stored XSS with cookie/token access, full /api/* authority, and kernel RCE.

• Advisory: GHSA-fcw5-x6j4-ccmp / CVE-2026-44727
• CVSS v4 9.3 (critical), CVSS v3.1 5.4, EPSS 0.3%
• Fixed in 2.20.0

It reaches us transitively via the interactive extra (jupyterlab), so it is not installed by the default uv sync that CI runs. Exploitation also requires an authenticated user opening /nbconvert/html/<path> for an attacker-authored notebook — real exposure here is low, but the fix is lock-only.

Commits

1. Bump jupyter-server to 2.20.0 — lockfile only. Alongside the 3-line version/hash swap, a current uv normalizes away the sys_platform markers on ~19 CUDA/pexpect entries. That churn is cosmetic: lock revision stays 3, and uv lock --check passed on the pre-existing lockfile, so the resolution itself is unchanged.
2. Drop the no-op s3 extra from datasets — datasets 4.x no longer ships an s3 extra, so datasets[s3] resolved to plain datasets while making uv warn on every lock operation. S3 support in the baselines extra comes from the explicit botocore/aiobotocore requirements, so nothing is lost and the resolution is byte-identical apart from the metadata line.

Verification

• uv lock --check clean; still 215 packages resolved.
• CI path (uv sync --locked → pytest): 32 passed.
• interactive extra installs jupyter-server 2.20.0; all server extensions validate OK.
• Confirmed the patch is actually present: NbconvertFileHandler/NbconvertPostHandler now append "; sandbox allow-scripts" to the CSP, behind a new nbconvert_csp_sandbox setting (default True) — an escape hatch if any workflow depends on scripts in nbconvert output.
• Smoke-tested against a real dataset (500 val docs): annotations, PDF→image rendering, OCR extraction, and docile_evaluate for both tasks (KILE AP 1.000, LIR f1 1.000 feeding ground truth back as predictions).
• pre-commit passed on both commits.

Not addressed

38 other alerts remain open on main, none critical: pillow (13, high, →12.3.0), mistune (10, medium), jupyterlab (6, high, →4.5.10), aiohttp (3, high), transformers (3, high — needs a major bump past the <5 pin), pytest, setuptools, torch. Most are lock-only and could follow in a separate sweep.

🤖 Generated with Claude Code