fix: remove vulnerable bleach dependency

pyproject.toml

@@ -32,6 +32,11 @@ members = [
 package = false
 required-version = ">=0.7.10"
 
+[tool.uv.sources]
+# Temporary immutable pin to jupyter/nbconvert#2300, which replaces the EOL
+# Bleach dependency with nh3. Return to PyPI after the upstream fix is released.
+nbconvert = { git = "https://github.com/jupyter/nbconvert.git", rev = "1fab6813f44f89017e7bcad27578571447b5b9c2" }
+
 [dependency-groups]
 dev = [
     "jsonpath-ng>=1.5.3,<2",
@@ -51,14 +56,13 @@ docs = [
 ]
 notebooks = [
     "aiohttp>=3.14.3,<4", # 3.14.3 fixes aiohttp security advisories
-    "bleach>=6.4.0,<7", # EOL with no patched release; nbconvert removal tracked at jupyter/nbconvert#2289
     "datasets>=4.0.0,<5",
     "ipykernel>=6.29.0,<7",
     "jupyter>=1.0.0,<2",
     "jupyter-server>=2.20.0,<3", # 2.20.0 fixes jupyter-server security advisory
     "jupyterlab>=4.6.0a5,<5", # 4.6.0a5 fixes security advisory pulled in by jupyter
     "mistune>=3.3.2,<4", # 3.3.2 fixes security advisory pulled in by nbconvert
-    "nbconvert>=7.17.1,<8", # 7.17.1 fixes security advisory pulled in by jupyter
+    "nbconvert>=7.17.1,<8", # commit pin above removes the vulnerable Bleach dependency
     "notebook>=7.6.0a5,<8", # 7.6.0a5 fixes security advisory pulled in by jupyter
     "setuptools>=83.0.0,<84", # 83.0.0 fixes setuptools security advisories pulled in by jupyterlab
     "soupsieve>=2.9.1,<3", # 2.9.1 fixes soupsieve security advisories pulled in by nbconvert