Skip to content

[BUG] Relax itables version to >= 2.4.0 #780

Description

Describe the bug

graph-notebook==5.2.0 pins itables>=2.0.0,<=2.1.0 in pyproject.toml. This upper bound predates itables 2.4.0, in which HTML content in DataFrame cells is escaped by default (fix: mwouts/itables#346). In itables<=2.1.0, cell contents are passed verbatim to DataTables and rendered as live HTML/JS.

graph-notebook itself is not affected afaik, but it would be nice to relax itables version to avoid installing a vulnerable dependency

Environment

  • OS: Ubuntu 24.04
  • Browser: Google Chrome
  • graph-notebook: 5.2.0

To Reproduce
In a fresh JupyterLab environment with graph-notebook==5.2.0 installed (which pulls itables==2.1.0), run:

import pandas as pd
from itables import show
results_df = pd.DataFrame({
    "id":   [1, 2, 3],
    "name": [
        "alice",
        "bob",
        '</script>\\"<script>alert(\'random text\')</script>',
    ],
})
show(results_df)
Image

Expected behavior

No live html rendered

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions