Repository navigation
chore: remove nbconvert workaround after upstream nh3 release #1054
Description
Priority Level
Medium
Task Summary
Track nbconvert's migration away from Bleach and return to an official PyPI release, removing the temporary Git pin and CSS restoration workaround from #1052.
Technical Details & Implementation Plan
Wait for a published nbconvert release that replaces Bleach and includes the HTML-export stylesheets. An upstream PR merge alone is not sufficient.
- Verify the release supports our notebook environments, its resolved dependency graph excludes Bleach, and its wheel contains the lab and classic CSS assets.
- Remove the nbconvert Git override from
pyproject.toml, select the released version, and regenerateuv.lock. - Remove the nbconvert
HATCH_BUILD_NO_HOOKSoverride,docs/scripts/prepare_nbconvert_css.py, and its workaround-specific tests. - Remove
install-notebook-css, its setup calls, theNOTEBOOK_CSSswitch and workflow argument, and the corresponding development documentation. Reassess the uv minimum introduced for this configuration. - Validate fresh dependency installation, Jupytext execution, and HTML export with both lab and classic templates on Python 3.11 and 3.13. Confirm installation uses the released wheel without build-time requests to Jupyter's CSS CDN.
Keep the lean Fern/Colab dependency selections from #976, #1013, and #1032; those jobs do not need the notebook execution runtime.
Investigation / Context
- fix: remove vulnerable bleach dependency #871 introduced the immutable nbconvert source pin to replace the end-of-life Bleach dependency with nh3.
- fix: avoid nbconvert CSS CDN downloads #1052 addresses repeated CSS CDN failures, including the October 19 scheduled notebook build, by disabling the source build hook and restoring CSS separately for HTML export.
- Upstream migration: jupyter/nbconvert#2300, tracking jupyter/nbconvert#2289. The migration PR is still a draft as of October 19, 2026.
- Related upstream CSS download fix: jupyter/nbconvert#2321.
Dependencies
A published nbconvert release containing the Bleach replacement and complete HTML-export assets. Keep this issue open after #1052 merges.
Activity
andreatnvidia commentedon Oct 19, 2026
jupyter/nbconvert#2300 has remained a draft since August 10, with no submitted reviews or published release timeline. We should explore exit paths that we can pursue independently of that PR.
Options worth evaluating:
jupyter execute --inplacecommand for execution. Initial smoke tests preserved outputs and working-directory behavior without nbconvert or Bleach installed. This requires separating execution dependencies from the full Jupyter applications.We should also account for newer upstream security fixes: our current Git pin lacks GHSA-pjvx-prjx-h659, fixed in 7.17.2, which affects certain exports of malicious notebooks.
The follow-up should cover both adopting a suitable upstream release and eliminating our dependency on the workaround through another supported approach.