pypi / jupyter-server

jupyter-server

What changed in jupyter-server 2, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-31.

8 security2 new APIs and options1 behavior and defaults5 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

jupyter-server 216 changes

Jupyter Server: 5xx request logging leaks token-bearing Referer header values
2.21.0security advisory release notes
Jupyter Server: Stored XSS in NbconvertFileHandler / NbconvertPostHandler via missing sandbox CSP
2.20.0security advisory
A security fix addresses CVE-2026-44727.
2.20.0release notes
Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path()
2.18.2security advisory
Jupyter Server has a CORS Origin Validation Bypass via re.match() in allow_origin_pat
2.18.0security advisory
Jupyter Server has an open redirection vulnerability in next query parameter
2.18.0security advisory
Jupyter Server: Path Traversal via incorrect startswith() root directory check allows access to sibling directories
2.18.0security advisory
Jupyter Server's Authentication Cookies Remain Valid After Password Reset and Server Restart
2.18.0security advisory

Clients can supply a kernel_id when creating a kernel or session.
2.21.0release notes
A toggle was added to enable curve encryption for all kernels that support it.
2.20.0release notes

Fixes compatibility with Tornado v6.5.9 and later.
2.21.1release notes
Fixes resolvePath handling for home-relative paths.
2.21.0release notes
Wildcard browser redirect files now use the hostname.
2.21.0release notes
The port is now taken from bind_sockets when its port differs.
2.20.0release notes
Terminal output is clarified when ServerApp.ip is set to 0.0.0.0.
2.20.0release notes