fix: remove vulnerable bleach dependency

[nabinchha]

📋 Summary

Remove the end-of-life Bleach package from the notebook dependency graph to address the email-linkification ReDoS reported as BDSA-2026-15483. Until nbconvert publishes the replacement, pin its immutable upstream patch commit so notebook support is retained with nh3 as the sanitizer.

🔗 Related Issue

Addresses BDSA-2026-15483 from the dependency security scan. Upstream tracking: jupyter/nbconvert#2289 and jupyter/nbconvert#2300.

🔄 Changes

• Remove the direct Bleach constraint from the notebooks dependency group.
• Pin nbconvert to immutable upstream commit 1fab6813f44f89017e7bcad27578571447b5b9c2, which replaces Bleach with nh3.
• Regenerate uv.lock with nh3 0.3.6 and without Bleach.

🔍 Attention Areas

⚠️ Reviewers: Please pay special attention to the following:

• pyproject.toml — this is a temporary immutable Git source pin to an upstream draft PR and should return to a PyPI release after the fix is published.

🧪 Testing

• make test passes (not run; the change is isolated to the notebook dependency group)
• .venv/bin/pytest packages/data-designer/tests/docs -q — 39 passed
• uv lock --check --offline
• nbconvert sanitizer and in-memory notebook execution smoke test
• Confirmed Bleach is absent from uv.lock and the resolved Python environment
• Unit tests added/updated — N/A, no DataDesigner logic changed
• E2E tests added/updated — N/A, dependency-only remediation

✅ Checklist

• Follows commit message conventions
• Commits are signed off (DCO)
• Architecture docs updated — N/A, no architecture change

[greptile-apps]

Greptile Summary

The PR removes Bleach from the notebook dependency graph by pinning nbconvert to an immutable upstream commit that uses nh3.

• Adds a temporary Git source override for nbconvert.
• Regenerates the lockfile to replace Bleach and its orphaned transitive dependencies with nh3.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
pyproject.toml	Adds the immutable nbconvert Git source and removes the direct Bleach notebook constraint without an eligible follow-up defect.
uv.lock	Resolves nbconvert from the pinned commit, adds nh3, and removes Bleach and its unused transitive dependencies.

_{Reviews (2): Last reviewed commit: "Merge branch 'main' into codex/fix-bleac..." | Re-trigger Greptile}

[github-actions]

Code Review — PR #871: fix: remove vulnerable bleach dependency

Author: nabinchha · Base: main · Head: codex/fix-bleach-redos
Scope: 2 files, +43/−49 (pyproject.toml, uv.lock)

Summary

This PR remediates the Bleach email-linkification ReDoS (BDSA-2026-15483) by
removing Bleach from the notebooks dependency group and pinning nbconvert to
an immutable upstream commit (1fab6813…b9c2, jupyter/nbconvert#2300) that
replaces Bleach with nh3. The lockfile is regenerated: bleach, tinycss2,
and webencodings drop out of the resolution and nh3 0.3.6 is added.

The change is correctly scoped and does what it claims. I verified:

• No direct dependents. grep finds no import bleach / from bleach,
  tinycss2, or webencodings usage anywhere under packages/ or scripts/.
  All three were purely transitive via nbconvert's CSS sanitizer, so dropping
  them is safe — the only consumer was nbconvert itself, which now uses nh3.
• Version constraint still satisfied. The [tool.uv.sources] git pin
  resolves to nbconvert version = "7.17.1" in uv.lock, which satisfies the
  retained nbconvert>=7.17.1,<8 specifier in the notebooks group.
• License compliance. nh3 is MIT-licensed, which is in
  dependency-license-policy.toml's allowed_licenses. Additionally,
  notebooks is a dependency group excluded by the --no-dev runtime license
  check (Makefile:461), so it matches the prior treatment of Bleach and adds
  no policy burden.
• Wheel coverage. nh3 0.3.6 provides cp38-abi3 wheels (covering the
  project's requires-python = ">=3.10" through 3.13) plus cp314 — the CI
  docs build runs on Python 3.13 (build-fern-docs.yml), which is covered.

Findings

No correctness bugs found. The items below are low-severity observations about
the temporary git-source pin, which the PR already flags as transitional.

1. [LOW] Git-source pin trades PyPI hash integrity + offline installs for a GitHub build dependency

File: pyproject.toml:36

Switching nbconvert from a PyPI registry source to a git source means uv must
clone and build nbconvert from GitHub at install/sync time, and the lockfile no
longer records a PyPI wheel hash for it (the previous sdist/wheels hash
blocks are removed in uv.lock). Integrity now rests on the immutable full-SHA
rev, which is a reasonable guarantee, but installs (including CI uv sync --group notebooks) now depend on GitHub being reachable and on the source
build succeeding — a fragility the PyPI wheel did not have. This is acceptable
as an explicitly-temporary measure; no change requested. Worth confirming the
docs-build CI (build-fern-docs.yml) has network egress to github.com at
sync time so the notebook build doesn't start failing silently.

2. [LOW / nit] Retained version comment is slightly misleading under a git source

File: pyproject.toml:65

The comment # commit pin above removes the vulnerable Bleach dependency is
fine, but with an active [tool.uv.sources] git override the >=7.17.1,<8
specifier is no longer the source of truth for what gets installed (it only
gates whether the pinned commit's declared version is acceptable). This is
harmless today, but if a future contributor bumps that bound expecting it to
change the installed nbconvert, it won't. Not blocking.

3. [INFO] Revert path depends on manual follow-up

File: pyproject.toml:34-37

Returning to a PyPI release once jupyter/nbconvert#2300 lands is tracked only by
the inline comment and the PR body. The comment is clear and links the upstream
issue/PR, so this is adequate; consider a repo tracking issue if the team wants
a stronger reminder. No action required for merge.

Structural Impact

No pre-computed structural impact analysis (/tmp/structural-impact-871.md) was
available for this run. Manual assessment: the change touches only dependency
declarations and the lockfile — no Python source, no imports, no changes to the
config → engine → interface layering. Blast radius is limited to the
notebooks dev dependency group and the environments that install it (local
notebook conversion and the Fern docs-build CI). No god nodes, import-direction
violations, or cross-package dependency changes are involved.

Verdict

Approve — low risk. The remediation is correct, minimal, and does not affect
any DataDesigner runtime code or public API. The only caveats are inherent to
the temporary git-source pin (GitHub build-time dependency, loss of PyPI hash
verification, manual revert path), all of which the PR explicitly acknowledges
as transitional. No correctness issues found; nothing blocking.