[Snyk] Fix for 2 vulnerabilities

[anaconda-security-bot]

Snyk has created this PR to fix 2 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

• packages/notebook-extension/package.json

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

⚠️ Warning

Failed to update the yarn.lock, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Improper Validation of Specified Quantity in Input SNYK-JS-SPRINTFJS-20532016	738
	Cross-site Scripting (XSS) SNYK-JS-DOMPURIFY-20536984	648

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Cross-site Scripting (XSS)

[anaconda-security-bot]

This update includes a major, high-risk upgrade to @jupyter-notebook/application from a local version to 7.0.0, alongside a low-risk stabilization update for @jupyterlab/notebook.

@jupyter-notebook/application → 7.0.0 (High Risk)

This is a significant architectural upgrade. Jupyter Notebook v7 is a complete rewrite based on the JupyterLab codebase to unify the two platforms. While it aims to preserve the classic document-centric user experience, the underlying technology is entirely different.

Key Breaking Changes:

• Extension Incompatibility: Extensions written for Notebook v6 (and earlier) are not compatible with Notebook v7. Any custom or community extensions must be migrated or replaced with JupyterLab-compatible extensions.
• New Features & UI: The application inherits many features from JupyterLab, including a visual debugger, real-time collaboration, and a new theming system. The user interface, while familiar, is based on new components.
• Backward Compatibility: For projects unable to immediately migrate, the nbclassic package can be used to temporarily restore the Notebook v6 experience.

Recommendation:
This upgrade requires significant validation. All existing Jupyter extensions must be checked for compatibility with Notebook v7 / JupyterLab. Plan for potential refactoring of custom extensions and workflows.

@jupyterlab/notebook v4.5.0-alpha.3 → v4.5.0 (Low Risk)

This is a stabilization release, moving from an alpha version to the final 4.5.0 build. The changes primarily consist of bug fixes, performance enhancements like faster saving for large notebooks, and UI improvements. No breaking API changes are documented for this transition.

Source: Jupyter Notebook 7 Release Announcement, JupyterLab 4.5 Release Announcement

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.