2.20.0

(Full Changelog)

Security fixes

• CVE-2026-44727 GHSA-fcw5-x6j4-ccmp

Enhancements made

• Fix confusing terminal output when using ServerApp.ip=0.0.0.0 #1643 (@Yann-P, @minrk)
• Add a toggle to enable curve encryption for all kernels that support it #1638 (@krassowski, @Carreau, @ianthomas23, @minrk)

Bugs fixed

• Grab the port from bind_sockets in case its different #1651 (@choldgraf, @krassowski)

Maintenance and upkeep improvements

• Fix test_authorizer having a spurious comma in params #1664 (@krassowski)
• Add a reminder to merge GHSA before release #1659 (@Yann-P, @Carreau)
• Exclude problematic pywinpty 3.0.4 version #1658 (@krassowski)
• ci: explicitly pass base-setup inputs to fix strict validation failures #1626 (@Carreau, @Copilot)

Documentation improvements

• Align docs for curve encryption with latest JEP version #1660 (@krassowski, @Carreau)
• Remove PGP key from docs #1653 (@Yann-P, @krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review.
See our definition of contributors.

(GitHub contributors page for this release)

@Carreau (activity) | @choldgraf (activity) | @Copilot (activity) | @ianthomas23 (activity) | @krassowski (activity) | @minrk (activity) | @Yann-P (activity)

2.19.0

(Full Changelog)

Enhancements made

• Return unresolved stanza when kernel scope is unavailable for resolvePath (instead of failing with 404) #1641 (@MUFFANUJ, @Carreau, @krassowski)

Bugs fixed

• Recreate notary store on failure to prevent save deadlock and data loss #1640 (@krassowski, @Carreau)

Maintenance and upkeep improvements

• Restore the test skip marks with updated compatibility reason #1646 (@krassowski, @Carreau)
• Drop Python 3.9 #1644 (@krassowski, @Zsailer)
• Bump minimatch from 3.1.2 to 3.1.5 #1606 (@Carreau, @minrk)

Other merged PRs

• Update pytest requirement from <9,>=7.0 to >=7.0,<10 #1647 (@Carreau)
• fix: use percent-placeholder args in HTTPError to prevent Tornado from doubling percent signs in gateway URLs #1642 (@terminalchai, @Carreau)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review.
See our definition of contributors.

(GitHub contributors page for this release)

@Carreau (activity) | @ianthomas23 (activity) | @krassowski (activity) | @minrk (activity) | @MUFFANUJ (activity) | @terminalchai (activity) | @Zsailer (activity)

2.18.2

(Full Changelog)

Bugs fixed

• Fix saving user avatar URL #1637 (@brichet, @krassowski)
• Fix path resolution if root_dir is a filesystem root #1636 (@Yann-P, @krassowski)

Maintenance and upkeep improvements

• Add Zulip notification when a release is complete #1634 (@Yann-P, @Carreau)
• chore: update pre-commit hooks #1633 (@Carreau)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review.
See our definition of contributors.

(GitHub contributors page for this release)

@brichet (activity) | @Carreau (activity) | @krassowski (activity) | @Yann-P (activity)

2.18.1

(Full Changelog)

Bugs fixed

• Prevent reconnect stalls from orphaned kernel_info requests #1632 (@krassowski, @Copilot, @jtpio, @tonyx93)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review.
See our definition of contributors.

(GitHub contributors page for this release)

@Copilot (activity) | @jtpio (activity) | @krassowski (activity) | @tonyx93 (activity)

2.18.0

(Full Changelog)

Security patches

• CVE-2026-40110 GHSA-24qx-w28j-9m6p
• CVE-2025-61669 GHSA-qh7q-6qm3-653w
• CVE-2026-40934 GHSA-5mrq-x3x5-8v8f
• CVE-2026-35397 GHSA-5789-5fc7-67v3

API and Breaking Changes

• Add query param to sanitize HTML in GET /nbconvert/html #1618 (@Yann-P, @Carreau)

Enhancements made

• Update handlers.py to fix ioloop blockers(sync file operations) #1617 (@zolyfarkas-fb, @Carreau)
• Add resolvePath API for resolving kernel-relative paths #1331 (@krassowski, @Carreau, @blink1073)

Bugs fixed

• Move check origin into a util function and add it to websocket #1630 (@Carreau, @Yann-P)
• Fix flaky test_restart_kernel by unsticking nudge() after port-changing restart #1628 (@Carreau, @claude, @krassowski)
• Try to fix flaky test "test_restart_kernel" #1625 (@Carreau)
• Fix potential unraisable pytest error #1624 (@Carreau)
• fix: use %s placeholders in HTTPError to prevent Tornado from doubling % in gateway URLs #1620 (@terminalchai, @krassowski, @ptch314)
• Fix three file descriptor leaks in kernel connection lifecycle (#1506) #1619 (@tonyx93, @Carreau)
• Use web.HTTPError for kernel restart failures #1616 (@YDawn, @Carreau)
• Handle EADDRINUSE and EACCES in _bind_http_server_tcp #1613 (@YDawn, @Zsailer, @minrk)
• Use st_birthtime for file created timestamp on macOS/BSD #1594 (@ktaletsk, @krassowski, @minrk)
• Fix double write when refusing hidden files in contents handler #1585 (@Krish-876, @minrk)
• Close all sockets in _find_http_port explicitly #1584 (@MaryushSoroka, @minrk)
• Fix writing on remote file systems with attribute cache #1574 (@krassowski, @Zsailer)
• Add IdentityProvider.cookie_secret_hook #1569 (@emin63, @minrk)
• fix context pollution #1561 (@dualc, @Zsailer)
• Fix gateway cookie handling #1558 (@kevin-bates, @RRosio, @lresende, @minrk)
• fix connection exception cause high cpu load #1484 (@dualc, @lresende, @minrk)

Maintenance and upkeep improvements

• Start to test on Python 3.13 and 3.14 #1623 (@Carreau)
• Bump actions/create-github-app-token from 2 to 3 in the actions group across 1 directory #1621 (@Carreau)
• Bump brace-expansion from 1.1.12 to 1.1.13 #1615 (@minrk)
• Fix package spec for jupytext #1614 (@krassowski, @Zsailer)
• chore: update pre-commit hooks #1607 (@minrk)
• try to fix ci on windows #1600 (@minrk, @krassowski)
• run prerelease tests on 3.14 #1599 (@minrk)
• Pin sphinx to an older version (<9) to fix docs #1597 (@krassowski, @minrk)
• Restore running all tests for Windows in CI workflow #1581 (@krassowski, @Zsailer)
• Fix flaky test_execution_state test #1579 (@krassowski, @Zsailer)
• Fix failing link check due to a blog post referred in docs changing URL format #1577 (@krassowski, @Zsailer)
• Fix lint on CI, pin ruff to the same version in hatch fmt and pre-commit #1576 (@krassowski, @Zsailer)
• Bump actions/checkout from 5 to 6 in the actions group #1572 (@minrk)
• don't link check npm #1568 (@minrk, @Zsailer)
• Bump brace-expansion from 1.1.11 to 1.1.12 #1546 (@minrk)
• Replace @flaky.flaky decorate with pytest marker #1544 (@mgorny, @minrk)
• chore: update pre-commit hooks #1449 (@minrk)

Documentation improvements

• some docs fixes #1627 (@Carreau, @krassowski)
• Updated dev install instructions #1622 (@bloomsa, @Carreau)
• Fix outdated ContentsManager testing guidance #1611 (@terminalchai, @Zsailer, @lresende, @minrk)
• add missing word 'to' #1596 (@carlfarrington, @krassowski, @minrk)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review.
See our definition of contributors.

(GitHub contributors page for this release)

@blink1073 (activity) | @bloomsa (activity) | @carlfarrington (activity) | @Carreau (activity) | @claude ([activity](https://github.com/sea...

2.17.0

(Full Changelog)

Enhancements made

• Avoid redundant call to _get_os_path in _dir_model #1547 (@joeyutong)
• Allow specifying extra params to scrub from logs #1538 (@jtpio)
• Add a logger to the ExtensionPoint API #1523 (@Zsailer)
• Allow user to update identity values #1518 (@brichet)

Bugs fixed

• Fix FileNotFoundError handling in rename_file methods #1548 (@aws-jasakshi)
• Use stdlib override when possible #1532 (@edrogers)
• CORS is not checked when browsing files. check origin now #1459 #1465 (@gogasca)

Maintenance and upkeep improvements

• Bump the actions group across 1 directory with 2 updates #1551 (@dependabot)
• Fix the failing "Test Lint" check on CI #1540 (@jtpio)

Contributors to this release

(GitHub contributors page for this release)

@aws-jasakshi | @brichet | @dependabot | @edrogers | @gogasca | @joeyutong | @jtpio | @minrk | @vidartf | @Zsailer

2.16.0

(Full Changelog)

Enhancements made

• If ServerApp.ip is ipv6 use [::1] as local_url #1495 (@manics)
• Don't hide .so,.dylib files by default #1457 (@nokados)
• Add async start hook to ExtensionApp API #1417 (@Zsailer)

Bugs fixed

• Update meetings notes link and zoom link #1517 (@krassowski)
• Fallback to direct write for readonly dirs and use temp path for checkpoints #1516 (@Darshan808)
• Check file permissions before making tmp file #1513 (@RRosio)
• Validate extension name before toggling through CLI #1509 (@Darshan808)
• Fix for #1479 : Incorrect usage of i18n format #1500 (@kjayan)
• Fix handling of missing parent header in record activity #1498 (@davidbrochart)
• display_url: Don't duplicate public_url and local_url if they are the same #1494 (@manics)

Maintenance and upkeep improvements

• tests: install test-functional requirements for Jupytext downstream tests #1510 (@MaicoTimmerman)

Documentation improvements

• Update websocket-protocols documentation to reflect implementation #1508 (@ark-1)
• Update Security Section in the Jupyter Server Documentation #1505 (@kjayan)
• Update Contribution Page for Jupyter Server #1499 (@kjayan)
• Fix typo in metric description #1486 (@yuvipanda)

Contributors to this release

(GitHub contributors page for this release)

@ark-1 | @bollwyvl | @Darshan808 | @davidbrochart | @kjayan | @krassowski | @MaicoTimmerman | @manics | @minrk | @nokados | @RRosio | @vidartf | @yuvipanda | @Zsailer

2.15.0

(Full Changelog)

Enhancements made

• Better error message when starting kernel for session. #1478 (@Carreau)
• Add a traitlet to disable recording HTTP request metrics #1472 (@yuvipanda)
• prometheus: Expose 3 activity metrics #1471 (@yuvipanda)
• Add prometheus info metrics listing server extensions + versions #1470 (@yuvipanda)
• Add prometheus metric with version information #1467 (@yuvipanda)
• Better hash format error message #1442 (@fcollonval)

Bugs fixed

• Return HTTP 400 when attempting to post an event with an unregistered schema #1463 (@afshin)
• write server extension list to stdout #1451 (@minrk)
• don't let ExtensionApp jpserver_extensions be overridden by config #1447 (@minrk)
• Pass session_id during Websocket connect #1440 (@gogasca)
• Do not log environment variables passed to kernels #1437 (@krassowski)
• extensions: render default templates with default static_url #1435 (@minrk)
• Improve the busy/idle execution state tracking for kernels. #1429 (@ojarjur)

Maintenance and upkeep improvements

• Donation link NF -> LF #1485 (@Carreau)
• Handle newer jupyter_events wants string version, drop 3.8 #1481 (@Carreau)
• Ignore unclosed sqlite connection in traits #1477 (@cjwatson)

Documentation improvements

• add comments to explain signal handling under jupyterhub #1452 (@oliver-sanders)

Contributors to this release

(GitHub contributors page for this release)

@afshin | @blink1073 | @bloomsa | @bollwyvl | @Carreau | @cjwatson | @davidbrochart | @dependabot | @epignot | @fcollonval | @gogasca | @hansepac | @holzman | @IITII | @krassowski | @lresende | @manics | @markypizz | @minrk | @mwouts | @ojarjur | @oliver-sanders | @pre-commit-ci | @Timeroot | @tornaria | @welcome | @Wh1isper | @yuvipanda | @Zsailer

2.14.2

(Full Changelog)

Bugs fixed

• Pass session_id during Websocket connect #1440 (@gogasca)
• Do not log environment variables passed to kernels #1437 (@krassowski)

Maintenance and upkeep improvements

• chore: update pre-commit hooks #1441 (@pre-commit-ci)
• chore: update pre-commit hooks #1427 (@pre-commit-ci)

Documentation improvements

• Update documentation for cookie_secret #1433 (@krassowski)
• Add Changelog for 2.14.1 #1430 (@blink1073)
• Update simple extension examples: _jupyter_server_extension_points #1426 (@manics)

Contributors to this release

(GitHub contributors page for this release)

@blink1073 | @gogasca | @krassowski | @manics | @pre-commit-ci

2.14.1

(Full Changelog)

Enhancements made

• Removing excessive logging from reading local files #1420 (@lresende)

Security Fix

• Filefind: avoid handling absolute paths

Maintenance and upkeep improvements

• Use hatch fmt command #1424 (@blink1073)
• chore: update pre-commit hooks #1421 (@pre-commit-ci)

Contributors to this release

(GitHub contributors page for this release)

@blink1073 | @lresende | @pre-commit-ci