Bumps [jupyterlab](https://github.com/jupyterlab/jupyterlab) from 4.6.1 to 4.6.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jupyterlab/jupyterlab/releases">jupyterlab's releases</a>.</em></p> <blockquote> <h2>v4.6.2</h2> <h2>4.6.2</h2> <p>(<a href="https://github.com/jupyterlab/jupyterlab/compare/v4.6.1...f1beab4a2027af4719d6edc07d52d6cf5a39a432">Full Changelog</a>)</p> <h3>Security patches</h3> <ul> <li>GHSA-gx64-gj6p-pc4c: Image viewer allows XSS when opening malicious image in new browser tab</li> <li>GHSA-89vp-jrxv-24w8: PyPI extension blocklist package-name canonicalization bypass</li> <li>GHSA-h5v5-8746-g7mm: PluginManager lock-rule enforcement bypass</li> <li>GHSA-pppj-hq3g-57pj: Cross-site scripting (XSS) via crafted settings file (<code>overrides.json</code>)</li> <li>GHSA-whvh-wf3x-g77j: Allowlist/blocklist check in <code>PyPIExtensionManager.install()</code> not enforced for direct callers (missing <code>await</code>)</li> </ul> <h3>Bugs fixed</h3> <ul> <li>Backport of security patches to <code>4.6.x</code> branch <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19185">#19185</a> (<a href="https://github.com/krassowski"><code>@krassowski</code></a>, <a href="https://github.com/MUFFANUJ"><code>@MUFFANUJ</code></a>)</li> <li>Fix resolving platform-specific shortcuts in keyboard shortcuts <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19112">#19112</a> (<a href="https://github.com/krassowski"><code>@krassowski</code></a>)</li> <li>Clear stale Table of Contents error markers <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19143">#19143</a> (<a href="https://github.com/MUFFANUJ"><code>@MUFFANUJ</code></a>)</li> <li>Fix stale document load after rename during initialization <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19144">#19144</a> (<a href="https://github.com/MUFFANUJ"><code>@MUFFANUJ</code></a>)</li> <li>Fix notebook initialization stealing focus <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19149">#19149</a> (<a href="https://github.com/MUFFANUJ"><code>@MUFFANUJ</code></a>)</li> <li>Fix spurious 3s kernel restart delay <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19126">#19126</a> (<a href="https://github.com/afshin"><code>@afshin</code></a>)</li> <li>Stabilize Open in Terminal Galata test on Firefox <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19152">#19152</a> (<a href="https://github.com/MUFFANUJ"><code>@MUFFANUJ</code></a>)</li> <li>Fix bottom activity bar restoring as collapsed <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19136">#19136</a> (<a href="https://github.com/MUFFANUJ"><code>@MUFFANUJ</code></a>)</li> <li>Handle invalid file browser drag target <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19122">#19122</a> (<a href="https://github.com/GagandeepSingh20"><code>@GagandeepSingh20</code></a>)</li> <li>Stabilize flaky Firefox notebook Galata tests <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19008">#19008</a> (<a href="https://github.com/MUFFANUJ"><code>@MUFFANUJ</code></a>)</li> </ul> <h3>Maintenance and upkeep improvements</h3> <ul> <li>Update Jupyter Releaser GitHub Actions <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19145">#19145</a> (<a href="https://github.com/jtpio"><code>@jtpio</code></a>)</li> </ul> <h3>Documentation improvements</h3> <ul> <li>Fix a typo in release notes <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19116">#19116</a> (<a href="https://github.com/krassowski"><code>@krassowski</code></a>)</li> <li>Update migration guide - 4.6 was released <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19108">#19108</a> (<a href="https://github.com/krassowski"><code>@krassowski</code></a>)</li> </ul> <h3>Other merged PRs</h3> <ul> <li>Bump brace-expansion from 1.1.11 to 1.1.16 in /jupyterlab/tests/mock_packages/test_no_hyphens <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19179">#19179</a> (<a href="https://github.com/apps/dependabot"><code>@dependabot[bot]</code></a>)</li> <li>Bump axios from 1.16.0 to 1.18.1 <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19178">#19178</a> (<a href="https://github.com/apps/dependabot"><code>@dependabot[bot]</code></a>)</li> </ul> <h3>Contributors to this release</h3> <p>The following people contributed discussions, new ideas, code and documentation contributions, and review. See <a href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports">our definition of contributors</a>.</p> <p>(<a href="https://github.com/jupyterlab/jupyterlab/graphs/contributors?from=2026-06-29&to=2026-07-21&type=c">GitHub contributors page for this release</a>)</p> <p><a href="https://github.com/afshin"><code>@afshin</code></a> (<a href="https://github.com/search?q=repo%3Ajupyterlab%2Fjupyterlab+involves%3Aafshin+updated%3A2026-06-29..2026-07-21&type=Issues">activity</a>) | <a href="https://github.com/GagandeepSingh20"><code>@GagandeepSingh20</code></a> (<a href="https://github.com/search?q=repo%3Ajupyterlab%2Fjupyterlab+involves%3AGagandeepSingh20+updated%3A2026-06-29..2026-07-21&type=Issues">activity</a>) | <a href="https://github.com/jtpio"><code>@jtpio</code></a> (<a href="https://github.com/search?q=repo%3Ajupyterlab%2Fjupyterlab+involves%3Ajtpio+updated%3A2026-06-29..2026-07-21&type=Issues">activity</a>) | <a href="https://github.com/krassowski"><code>@krassowski</code></a> (<a href="https://github.com/search?q=repo%3Ajupyterlab%2Fjupyterlab+involves%3Akrassowski+updated%3A2026-06-29..2026-07-21&type=Issues">activity</a>) | <a href="https://github.com/MUFFANUJ"><code>@MUFFANUJ</code></a> (<a href="https://github.com/search?q=repo%3Ajupyterlab%2Fjupyterlab+involves%3AMUFFANUJ+updated%3A2026-06-29..2026-07-21&type=Issues">activity</a>)</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jupyterlab/jupyterlab/commit/150ba51f1c840edc399597a86a6fc3ed24ef60be"><code>150ba51</code></a> [ci skip] Publish 4.6.2</li> <li><a href="https://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432"><code>f1beab4</code></a> Backport of security patches to <code>4.6.x</code> branch (<a href="https://redirect.github.com/jupyterlab/jupyterlab/issues/19185">#19185</a>)</li> <li><a href="https://github.com/jupyterlab/jupyterlab/commit/abdd427f25fb2bd912b3549056795c420b8bd48c"><code>abdd427</code></a> Backport PR <a href="https://redirect.github.com/jupyterlab/jupyterlab/issues/19112">#19112</a> on branch 4.6.x (Fix resolving platform-specific shortcuts...</li> <li><a href="https://github.com/jupyterlab/jupyterlab/commit/98a615c45e9c0cc19034843bde2847b82d2c5a83"><code>98a615c</code></a> Backport PR <a href="https://redirect.github.com/jupyterlab/jupyterlab/issues/19143">#19143</a> on branch 4.6.x (Clear stale Table of Contents error marke...</li> <li><a href="https://github.com/jupyterlab/jupyterlab/commit/1ec91a43a74b5750abec50dd89732ad169545023"><code>1ec91a4</code></a> Backport PR <a href="https://redirect.github.com/jupyterlab/jupyterlab/issues/19179">#19179</a> on branch 4.6.x (Bump brace-expansion from 1.1.11 to 1.1.1...</li> <li><a href="https://github.com/jupyterlab/jupyterlab/commit/8d66183966a5f155683df6ebd4717b089e0935d4"><code>8d66183</code></a> Backport PR <a href="https://redirect.github.com/jupyterlab/jupyterlab/issues/19178">#19178</a> on branch 4.6.x (Bump axios from 1.16.0 to 1.18.1) (<a href="https://redirect.github.com/jupyterlab/jupyterlab/issues/19180">#19180</a>)</li> <li><a href="https://github.com/jupyterlab/jupyterlab/commit/34ca550c634df450f9319aa1fec87c1698f7e98a"><code>34ca550</code></a> Backport PR <a href="https://redirect.github.com/jupyterlab/jupyterlab/issues/19144">#19144</a> on branch 4.6.x (Fix stale document load after rename duri...</li> <li><a href="https://github.com/jupyterlab/jupyterlab/commit/172a7f6886c3e0fd935a2237a743a1446e1a8ae4"><code>172a7f6</code></a> Backport PR <a href="https://redirect.github.com/jupyterlab/jupyterlab/issues/19149">#19149</a> on branch 4.6.x (Fix notebook initialization stealing focu...</li> <li><a href="https://github.com/jupyterlab/jupyterlab/commit/34e178282b6536cee8bcff5a8eddc5f9407c3cd2"><code>34e1782</code></a> Backport PR <a href="https://redirect.github.com/jupyterlab/jupyterlab/issues/19126">#19126</a> on branch 4.6.x (Fix spurious 3s kernel restart delay) (<a href="https://redirect.github.com/jupyterlab/jupyterlab/issues/1">#1</a>...</li> <li><a href="https://github.com/jupyterlab/jupyterlab/commit/57e5afd1d19952c22fd0dce414b955061a3e2c4e"><code>57e5afd</code></a> Backport PR <a href="https://redirect.github.com/jupyterlab/jupyterlab/issues/19152">#19152</a> on branch 4.6.x (Stabilize Open in Terminal Galata test on...</li> <li>Additional commits viewable in <a href="https://github.com/jupyterlab/jupyterlab/compare/@jupyterlab/lsp@4.6.1...@jupyterlab/lsp@4.6.2">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=jupyterlab&package-manager=uv&previous-version=4.6.1&new-version=4.6.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/iceberg-python/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>