chore(deps): update dependency jupyterlab to v4.5.7 [security]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
jupyterlab (changelog)	4.4.2 → 4.5.7

---

JupyterLab LaTeX typesetter links did not enforce noopener attribute

CVE-2025-59842 / GHSA-vvfj-2jqx-52jm

More information

Details

Links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the noopener attribute.

This is deemed to have no impact on the default installations. Theoretically users of third-party LaTeX-rendering extensions could find themselves vulnerable to reverse tabnabbing attacks if:

• links generated by those extensions included target=_blank (no such extensions are known at time of writing) and
• they were to click on a link generated in LaTeX (typically visibly different from other links).

For consistency with handling on other links, new versions of JupyterLab will enforce noopener and target=_blank on all links generated by typesetters. The former will harden the resilience of JupyterLab to extensions with lack of secure defaults in link rendering, and the latter will improve user experience by preventing accidental state loss when clicking on links rendered by LaTeX typesetters.

Impact

Since the official LaTeX typesetter extensions for JupyterLab: jupyterlab-mathjax (default), jupyterlab-mathjax2 and jupyterlab-katex do not include the target=_blank, there is no impact for JupyterLab users.

Patches

JupyterLab 4.4.8

Workarounds

No workarounds are necessary.

References

None

Severity

• CVSS Score: 2.1 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-vvfj-2jqx-52jm
• https://github.com/jupyterlab/jupyterlab/commit/88ef373039a8cc09f27d3814382a512d9033675c
• https://nvd.nist.gov/vuln/detail/CVE-2025-59842
• https://github.com/advisories/GHSA-vvfj-2jqx-52jm

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS

CVE-2026-40171 / GHSA-rch3-82jr-f9w9

More information

Details

Impact

A stored Cross-Site Scripting (XSS) vulnerability in Jupyter Notebook allows attackers to steal authentication tokens from users who open malicious notebook files and interact with elements that the attacker can make look indistinguishable from legitimate controls (single click interaction).

The vulnerability enables complete account takeover through the Jupyter REST API, allowing the attacker to:

1. Read all files
2. Modify/create files
3. Access running kernels and execute arbitrary code
4. Create terminals for shell access

Patches

Jupyter Notebook 7.5.6 and JupyterLab 4.5.7 include patches for this vulnerability.

Workarounds

The help extension can be disabled via CLI:

jupyter labextension disable @​jupyter-notebook/help-extension
jupyter labextension disable @​jupyterlab/help-extension

Hardening

The patched versions include a toggle to disable the command linker functionality altogether, for example via overrides.json:

{
  "@​jupyterlab/apputils-extension:sanitizer": {
    "allowCommandLinker": false
  }
}

Resources

• https://jupyterlab.readthedocs.io/en/latest/user/commands.html#commands-in-markdown-output-and-files

Acknowledgments

Reported by Daniel Teixeira - NVIDIA AI Red Team

Severity

• CVSS Score: 8.4 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/jupyter/notebook/security/advisories/GHSA-rch3-82jr-f9w9
• https://jupyterlab.readthedocs.io/en/latest/user/commands.html#commands-in-markdown-output-and-files
• https://nvd.nist.gov/vuln/detail/CVE-2026-40171
• https://github.com/advisories/GHSA-rch3-82jr-f9w9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request

CVE-2026-42266 / GHSA-37w4-hwhx-4rc4

More information

Details

The allow-list of extensions that can be installed from PyPI Extension Manager (allowed_extensions_uris) is not correctly enforced by JupyterLab prior to 4.5.7. The PyPI Extension Manager was not contained to packages listed on the default PyPI index.

This has security implications for deployments that:

• have allow-listed specific extensions with aim to prevent users from installing packages
• have the kernel and terminals disabled or delegated to remote hosts (thus no access to install packages in the single-user server environment)
• have multi-tenant deployments that is not configured for untrusted users (as per documented on JupyterHub https://jupyterhub.readthedocs.io/en/5.2.1/explanation/websecurity.html)
• have the (default) PyPI Extension Manager enabled

Impact

An authenticated attacker - such as a student in a shared JupyterHub environment or a user in a multi-tenant JupyterLab deployment - can escalate their privileges. This might allow for data exfiltration, lateral movement within the network, and persistent compromise of the server infrastructure.

Patches

JupyterLab v4.5.7 contains the patch.

Users of applications that depend on JupyterLab, such as Notebook v7+, should update jupyterlab package too.

Workarounds

Switch to read-only extension manager by adding the following command line option:

--LabApp.extension_manager=readonly

or the following traitlet:

c.LabApp.extension_manager = 'readonly'

You can confirm that the read-only manager is in use from GUI:

Note: configuration of a PyPI proxy with allow-listed packages is not sufficient to protect from this vulnerability.

References

• allow-list https://jupyterlab.readthedocs.io/en/stable/user/extensions.html#listing-configuration
• https://jupyterhub.readthedocs.io/en/5.2.1/explanation/websecurity.html
• https://jupyterlab.readthedocs.io/en/latest/user/extensions.html#extension-manager-implementations

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-37w4-hwhx-4rc4
• https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.7
• https://jupyterhub.readthedocs.io/en/5.2.1/explanation/websecurity.html
• https://jupyterlab.readthedocs.io/en/latest/user/extensions.html#extension-manager-implementations
• https://nvd.nist.gov/vuln/detail/CVE-2026-42266
• https://github.com/pypa/advisory-database/tree/main/vulns/jupyterlab/PYSEC-2026-164.yaml
• https://github.com/advisories/GHSA-37w4-hwhx-4rc4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

JupyterLab's command linker attributes in HTML enable one-click command execution from untrusted content

CVE-2026-42557 / GHSA-mqcg-5x36-vfcg

More information

Details

JupyterLab's HTML sanitizer allowlists data-commandlinker-command and data-commandlinker-args on button elements, while CommandLinker listens for all click events on document.body and executes the named command without checking whether the element came from trusted JupyterLab UI. A notebook with a pre-saved HTML cell output containing a deceptive button can trigger arbitrary JupyterLab commands - including arbitrary code execution - on a single user click, without any code being submitted for execution by the user.

Impact

An attacker who shares a notebook or a Markdown file - via email, GitHub, or a Binder link - can invoke an arbitrary command upon a single click by the victim. The button can be rendered inside the output area and be visually indistinguishable from a legitimate widget. No kernel needs to start; the HTML output is stored in the notebook file and displayed immediately on open.

Single-click impact

An attacker convincing the victim to click on a single button or link can:

• execute arbitrary code in the available kernels,
• delete files leading to information loss; in principle the loss could be unrecoverable, depending on server configuration and attack complexity,
• open multiple kernels/terminals at once, or create multiple files at once, putting significant stress on the server and thus deny availability for other users when using standalone multi-tenant jupyter-server deployment, and to a lesser degree impact availability on JupyterHub deployments.

The arbitrary code execution will be immediately visible to the user; and can be halted by the timely user intervention. The deletion of files can be silent and go unnoticed for some time.

Multi-click attacks

An attacker who convinces the victim to click on multiple buttons in specific order and to grant access to clipboard (or in scenarios where the user already granted keyboard access) can obtain full access to the terminal and execute arbitrary commands in the environment with access scope that might exceed that of available kernels. Only users of Chromium-based browsers are susceptible to this expanded variant of the attack.

The execution of commands in the terminal would be immediately visible to the user.

Impact of third-party extensions

The impact described above assumes a plain JupyterLab/Notebook installation. In environments with frontend extensions that contribute additional commands the attack surface is increased by the functionality covered by these commands.

Patches

JupyterLab 4.5.7

Workarounds

No workarounds are available for end-users.

Downstream applications inheriting from JupyterFrontEnd or JupyterLab can effectively disable the CommandLinker by passing commandLinker: new CommandLinker({ commands: new CommandRegistry() }) option in the initialization options.

Hardening

The patched versions include a toggle to disable the command linker functionality altogether, for example via overrides.json:

{
  "@​jupyterlab/apputils-extension:sanitizer": {
    "allowCommandLinker": false
  }
}

Resources

• https://jupyterlab.readthedocs.io/en/latest/user/commands.html#commands-in-markdown-files

Severity

• CVSS Score: 8.6 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-mqcg-5x36-vfcg
• https://jupyterlab.readthedocs.io/en/latest/user/commands.html#commands-in-markdown-files
• https://nvd.nist.gov/vuln/detail/CVE-2026-42557
• https://github.com/advisories/GHSA-mqcg-5x36-vfcg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

jupyterlab/jupyterlab (jupyterlab)

v4.5.7

Compare Source

4.5.7

(Full Changelog)

Security patches

• CVE-2026-42557 GHSA-mqcg-5x36-vfcg
• CVE-2026-42266 GHSA-37w4-hwhx-4rc4
• CVE-2026-40171 GHSA-rch3-82jr-f9w9

Bugs fixed

• Video and Audio Content Providers: Fix JupyterLite support #​18652 (@​martinRenou)
• Fix notebook hang when dropping cells #​18808 (@​MUFFANUJ)
• Fix Contextual Help keyboard shortcut reliability and menu Help functionality #​18747 (@​itsmejay80)
• Fix focusing input element when opening a dialog from Command Palette #​18735 (@​Carreau)
• Fix native context menu blocked even when context menu is suppressed #​18753 (@​utsav-develops)
• Fix flaky toolbar item placement in popup #​18618 (@​filipeoliveira05)
• Update terminal default font family to honor macOS system-wide ui-monospace #​18647 (@​flaviomartins)

Maintenance and upkeep improvements

• Fix linting issue #​18819 (@​krassowski)
• Fix syntax for Python 3.9 on 4.5.x branch #​18817 (@​krassowski)
• Remove unused CodeMirror v5 CSS rule #​18785 (@​Carreau)
• Remove unused CSS rule forgotten after CodeMirror migration #​18763 (@​Carreau)
• Remove unused progress bar CSS rule in execution indicator #​18759 (@​Carreau)
• Remove dead .jp-VariableRenderer-TrustButton CSS rule #​18762 (@​Carreau)
• Remove used .jp-Cell-Placeholder CSS rules #​18761 (@​Carreau)

Documentation improvements

• Fix name of option for extension manager implementation in docs #​18788 (@​krassowski)
• Remove 4.5.0 announcement from docs #​18740 (@​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review.
See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​filipeoliveira05 (activity) | @​flaviomartins (activity) | @​itsmejay80 (activity) | @​jtpio (activity) | @​krassowski (activity) | @​martinRenou (activity) | @​MUFFANUJ (activity) | @​utsav-develops (activity)

v4.5.6

Compare Source

4.5.6

(Full Changelog)

Bugs fixed

• Replace scrollback implementation with scroll anchoring outside of full windowing mode #​18522 (@​krassowski)
• Harmonize translation wrappers in Python files to use gettext methods #​18597 (@​tmetzl)
• Remove unimplemented filebrowser:search command #​18593 (@​krassowski)
• Fix status bar focus outlines #​18585 (@​IsabelParedes)
• Fix filebrowser:create-new-file context menu selector #​18588 (@​jtpio)
• Fix single-character code blocks rendering as empty #​18572 (@​soniya-malviy)
• Hide code input in CodeConsole when configured #​18554 (@​agriyakhetarpal)

Maintenance and upkeep improvements

• Update benchmark snapshots even if base snapshots require changes #​18549 (@​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review.
See our definition of contributors.

(GitHub contributors page for this release)

@​agriyakhetarpal (activity) | @​IsabelParedes (activity) | @​jtpio (activity) | @​krassowski (activity) | @​soniya-malviy (activity) | @​tmetzl (activity)

v4.5.5

Compare Source

4.5.5

(Full Changelog)

Bugs fixed

• Fix theme settings broken in non-English locales #​18530 (@​apoorvdarshan)
• Fix comms subshell resource management on disposal and when changing settings #​18531 (@​krassowski)
• Upgrade @codemirror/view, fixing slow selection when line wrapping is enabled #​18479 (@​krassowski)
• Only turn off overflow anchor when windowing is active #​18503 (@​jasongrout)
• Fix table of contents navigation for Markdown files #​18411 (@​itsmevichu)

Maintenance and upkeep improvements

• Update to marked 17.0.2 and mermaid 11.12.3 #​18532 (@​bollwyvl, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review.
See our definition of contributors.

(GitHub contributors page for this release)

@​apoorvdarshan (activity) | @​bollwyvl (activity) | @​itsmevichu (activity) | @​jasongrout (activity) | @​krassowski (activity)

v4.5.4

Compare Source

4.5.4

(Full Changelog)

Bugs fixed

• Avoid using system clipboard in Notebook widget #​18474 (@​brichet)
• Update CodeMirror versions, fixing a few selection issues #​18466 (@​krassowski)
• Fix debugger variable panel to render value 0 properly #​18464 (@​itsmevichu)
• Consider both the content type and pattern match in DocumentRegistry.getFileTypeForModel() #​18409 (@​krassowski)
• false in saveAs to avoid fetching file body #​18379 (@​DeborahOlaboye)

Maintenance and upkeep improvements

• Bump Lumino packages to the 2026.2.5 release, fixing iframe resizing #​18440 (@​jasongrout)

Documentation improvements

• Clarify notebook and cell metadata API changes in JupyterLab 4 #​18304 (@​Krish-876)
• Document a change in the Code Editor source updates via sharedModel in JupyterLab 4 #​18260 (@​Krish-876)
• Fix Contents API fetch documentation of the content default #​18383 (@​ceasermikes002)
• Add AI rules #​18322 (@​jtpio)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review.
See our definition of contributors.

(GitHub contributors page for this release)

@​brichet (activity) | @​ceasermikes002 (activity) | @​DeborahOlaboye (activity) | @​itsmevichu (activity) | @​jasongrout (activity) | @​jtpio (activity) | @​krassowski (activity) | @​Krish-876 (activity)

v4.5.3

Compare Source

4.5.3

(Full Changelog)

Bugs fixed

• Fix error in console when the debugger switch from a module to another #​18352 (@​brichet)
• Fix focus of replace buttons in the document search box #​18362 (@​IsabelParedes)
• Update CodeMirror to latest versions #​18344 (@​krassowski)
• Fix deferred cell loading in defer and contentVisibility windowing mode #​18359 (@​krassowski)
• Backport PR #​18349: Fix "Open With > Editor" for .py files, update @lumino packages to v2026.1.15 #​18351 (@​krassowski, @​aaron-seq)

Maintenance and upkeep improvements

• Fix UI tests: config useSystemClipboardForCells=true for notebook toolbar test #​18335 (@​brichet)
• Remove generated docs files from the repo #​18340 (@​jtpio)

Documentation improvements

• Add installation instructions for JupyterLab with uv #​18363 (@​jimangel)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review.
See our definition of contributors.

(GitHub contributors page for this release)

@​aaron-seq (activity) | @​brichet (activity) | @​IsabelParedes (activity) | @​jimangel (activity) | @​jtpio (activity) | @​krassowski (activity)

v4.5.2

Compare Source

4.5.2

(Full Changelog)

Bugs fixed

• Backport PR #​18250: Make system clipboard opt-in #​18319 (@​Darshan808, @​krassowski)
• Fix empty math block throws codemirror's error #​18308 (@​i-aki-y)
• Fix cell footer width for smaller screens #​18276 (@​MUFFANUJ)
• Fix scrolling to anchor from ToC/links in Markdown and HTML with data attributes #​18208 (@​pranshugupta01)
• Fix merge breaking rendering cell order in defer mode #​18220 (@​krassowski)
• Fix inverted Unicode surrogate checks #​18209 (@​JamesWrigley)

Maintenance and upkeep improvements

• Bump vega-selections from 5.6.0 to 5.6.3 #​18315 (@​dependabot[bot])
• Make the plugin registry slow activation test more robust #​18254 (@​krassowski)
• Bump jws from 3.2.2 to 3.2.3 #​18171 (@​dependabot[bot])
• Remove unused snapshot #​18224 (@​brichet)
• Bump systeminformation from 5.23.14 to 5.27.14 #​18223 (@​dependabot[bot])
• Prevent updating npm next tag for some versions of @jupyterlab/rendermime-interfaces #​18217 (@​jtpio)

Documentation improvements

• Fix broken see-also reference for inspect_request message #​18234 (@​Krish-876)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review.
See our definition of contributors.

(GitHub contributors page for this release)

@​brichet (activity) | @​Darshan808 (activity) | @​i-aki-y (activity) | @​JamesWrigley (activity) | @​jtpio (activity) | @​krassowski (activity) | @​Krish-876 (activity) | @​MUFFANUJ (activity) | @​pranshugupta01 (activity)

v4.5.1

Compare Source

4.5.1

(Full Changelog)

Deprecated features

• Drives: Deprecate the notion of defaultContentProvider #​18169 (@​martinRenou)

Enhancements made

• Detect and log slow plugins #​18181 (@​Darshan808)

Bugs fixed

• Debugger: Fix restart and debug command. #​18115 (@​HaudinFlorence)
• Fix scrollPastEnd for text editors #​18186 (@​Meriem-BenIsmail)
• Enable undo/redo in JSON settings editor #​18165 (@​Meriem-BenIsmail)
• Restore focus after closing the command palette #​18167 (@​Meriem-BenIsmail)
• Restore auto-resizing of the code console input prompts #​17819 (@​jtpio)
• Fix: Safely handle missing args in fileeditor:change-font-size label provider #​18157 (@​prajyot-porje)

Maintenance and upkeep improvements

• Check if the list of commands, tokens and plugins has changed #​18198 (@​jtpio)
• Update to Playwright 1.57.0 #​18151 (@​jtpio)
• Reconfigure 4.5.x branch #​18161 (@​jtpio, @​jasongrout, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review.
See our definition of contributors.

(GitHub contributors page for this release)

@​Darshan808 (activity) | @​FoSuCloud (activity) | @​HaudinFlorence (activity) | @​ianthomas23 (activity) | @​jasongrout (activity) | @​jtpio (activity) | @​krassowski (activity) | @​martinRenou (activity) | @​meeseeksmachine (activity) | @​Meriem-BenIsmail (activity) | @​prajyot-porje (activity) | @​xc2 (activity)

v4.5.0

Compare Source

(Full Changelog)

New features added

• Add terminal search functionality #​17691 (@​ianthomas23)

Enhancements made

• Fix kernel status display in status bar #​18047 (@​Darshan808)
• Introduce DebuggerDisplayRegistry to provide context-aware display names for debugger panels #​18043 (@​arjxn-py)
• Introduce new token for the default IContentProvider #​18027 (@​martinRenou)
• Update Show more outputs button design #​18021 (@​andrii-i)
• Optimize content-visibility application #​18013 (@​Meriem-BenIsmail)
• Show execution count in breakpoints, callstack, and sources panels while debugging in console #​18003 (@​arjxn-py)
• Keep debugger state though kernel restarts #​17972 (@​gjmooney)
• Make DocumentManager dialogs customizable #​17961 (@​Darshan808)
• Systematise how base URL is obtained to allow swapping it more easily #​17952 (@​krassowski)
• Export the ContentProviderRegistry #​17940 (@​martinRenou)
• Make filebrowser breadcrumbs configurable #​17932 (@​Darshan808)
• Switch the default windowing mode to contentVisibility #​17926 (@​Meriem-BenIsmail)
• Pass context down in attachments resolver #​17924 (@​krassowski)
• Allow swapping the empty markdown cell placeholder (and translate it) #​17920 (@​krassowski)
• Enable the minimap for all windowing modes #​17904 (@​Meriem-BenIsmail)
• Debugger: Differentiate selected breakpoints with specific style #​17893 (@​HaudinFlorence)
• Use console for debugger evaluation #​17892 (@​gjmooney)
• Debugger: Visual indicator when debugger is paused #​17891 (@​arjxn-py)
• Add IUserAPIClient to make swapping UserManager easier #​17884 (@​krassowski)
• Provide context about the tag and attribute to the URL resolver #​17882 (@​krassowski)
• Debugger: Show cell execution count in breakpoint/call stack/source panel #​17881 (@​arjxn-py)
• Add file browser menu for creating new Python/R/Julia files #​17848 (@​martinRenou)
• Allow configuring toSkip for the SettingsEditor #​17834 (@​jtpio)
• Use content-visibility to render notebook cells more efficiently #​17822 (@​Meriem-BenIsmail)
• Use toolbar registry for log console #​17814 (@​gjmooney)
• Add a new addExtraLineOnCellMerge setting #​17806 (@​jtpio)
• Update to mermaid 11.10, marked 16.2 #​17800 (@​bollwyvl)
• Allow opening notebooks without starting a kernel #​17798 (@​jtpio)
• Allow to swap the URL resolver #​17784 (@​krassowski)
• Add the "Show Workspace Indicator" command to the palette #​17780 (@​jtpio)
• Auto-switch between light and dark mode when "Synchronize with System Settings" is enabled #​17733 (@​MUFFANUJ)
• Keep cell id when the user changes cell type #​17731 (@​afshin)
• Discover the app directory relative to the installed module #​17721 (@​zanieb)
• Show checkbox and buttons of Dialog component on separate lines #​17696 (@​MUFFANUJ)
• Add types for interrupt messages, and move them from shell to control channel #​17684 (@​krassowski)
• Add fold/unfold commands to menu and command palette #​17677 (@​Darshan808)
• Add a new allowFileUploads setting to the file browser #​17676 (@​jtpio)
• Dockerfile: Install less, vim, and nano #​17670 (@​rschroll)
• Describe args for all commands #​17649 (@​jtpio)
• Add audio-extension and video-extension #​17636 (@​jtpio)
• Add select all command for file browser listing #​17571 (@​RRosio)
• Add a selectionChanged signal to the file browser #​17563 (@​jtpio)
• Auto-open uploaded files with size and settings control #​17556 (@​Darshan808)
• Add a setting to configure the default log level for the Log Console #​17547 (@​jtpio)
• Add a signal when cells are pasted in the Notebook #​17506 (@​brichet)
• Add new CSS rule for expanding linked output to 100% height #​17487 (@​SylvainCorlay)
• Add an optional exportAs method to NbConvert.IManager #​17482 (@​jtpio)
• Reorder extra_labextensions_path to favor defaults #​17476 (@​peytondmurray)
• Use the system clipboard for copying and pasting cells #​17445 (@​yacchin1205)
• Add jump to executing/executed cell button [#​16880](https://redirec

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
graph-sitter	Ignored	Preview	Jun 24, 2026 2:06am