Merge branch 'master' into phase3/e2e-copilot-fixes

Author: krassowski

.github/dependabot.yml

@@ -6,3 +6,26 @@ updates:
     schedule:
       # Check for updates to GitHub Actions every week
       interval: "weekly"
+
+  # npm version updates (security updates run automatically regardless of this)
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    # Wait a week after a release is published before opening a bump for it, so a
+    # freshly published (or later yanked/compromised) version isn't picked up on
+    # day zero.
+    cooldown:
+      default-days: 7
+    groups:
+      # Roll routine minor/patch bumps into one PR to keep the noise down
+      minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+    ignore:
+      # @types/node tracks the Node version Electron bundles (24 for Electron 42),
+      # not the newest types, so skip major bumps here.
+      - dependency-name: "@types/node"
+        update-types: ["version-update:semver-major"]

.github/workflows/e2e.yml

@@ -83,7 +83,11 @@ jobs:
           ver=$(awk '$1=="-" && $2=="jupyterlab" {print $3}' env_installer/jlab_server.yaml)
           [[ "$ver" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo "unexpected jupyterlab pin '$ver' in jlab_server.yaml (want exact x.y.z)"; exit 1; }
           python3 -m venv "$RUNNER_TEMP/jlab-venv"
-          "$RUNNER_TEMP/jlab-venv/bin/pip" install --quiet "jupyterlab==$ver"
+          # jupyterlab pulls in ipykernel, so the venv already has a python3
+          # kernel for the cell-run test. ipywidgets is one of the extensions the
+          # app bundles (see jlab_server.yaml); install it so the widget-render
+          # test can confirm a labextension actually draws through the WebContentsView.
+          "$RUNNER_TEMP/jlab-venv/bin/pip" install --quiet "jupyterlab==$ver" ipywidgets
           echo "JLAB_TEST_PYTHON_PATH=$RUNNER_TEMP/jlab-venv/bin/python" >> "$GITHUB_ENV"
       # xvfb is Linux-only; on macOS the runner has a real display, so run the
       # suite directly. Same yarn test:e2e command on both legs.

.github/workflows/publish.yml

@@ -23,7 +23,7 @@ jobs:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
-          node-version: '20.x'
+          node-version: '24.x'
           cache: 'yarn'
       - run: yarn install --frozen-lockfile
       - run: yarn test:coverage
@@ -59,7 +59,7 @@ jobs:
       - name: Install node
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
-          node-version: '20.x'
+          node-version: '24.x'
           cache: 'yarn'
 
       - name: Install dependencies

.github/workflows/releasepr.yml

@@ -12,7 +12,12 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-      
+        with:
+          # Read-only checkout: the default token is never persisted into the git
+          # config. The write-capable app token is only introduced at the push
+          # step below.
+          persist-credentials: false
+
       - name: Get package info
         shell: bash
         id: package-info
@@ -34,18 +39,31 @@ jobs:
             return releaseWithTag ? 'true' : 'false'
           result-encoding: string
 
-      - name: Make changes to pull request
+      - name: Create release pull request
         if: steps.pre-release-exists.outputs.result == 'true'
-        run: date +%s > auto-release.log
+        env:
+          APP_VERSION: ${{ steps.package-info.outputs.version }}
+          GH_TOKEN: ${{ secrets.JLAB_APP_TOKEN }}
+        run: |
+          set -eux
+          # git checkout -b fails if the branch already exists, which keeps a
+          # re-run from opening a duplicate release PR.
+          BRANCH_NAME="release-v${APP_VERSION}"
+          git checkout -b "${BRANCH_NAME}"
+          git config user.name "JupyterLab Desktop Bot"
+          git config user.email 'jupyterlab-bot@users.noreply.github.com'
 
-      - name: Create Release pull request
-        if: steps.pre-release-exists.outputs.result == 'true'
-        uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6
-        with:
-          token: ${{ secrets.JLAB_APP_TOKEN }}
-          commit-message: Update auto-release logs
-          branch: release-v${{ steps.package-info.outputs.version}}
-          title: 'Release v${{ steps.package-info.outputs.version}}'
-          body: |
-            Release v${{ steps.package-info.outputs.version}}
-          draft: false
+          date +%s > auto-release.log
+          git add auto-release.log
+          git commit -m "Update auto-release logs"
+          # Checkout ran with persist-credentials: false. Wire the app token in
+          # through gh's credential helper just for this push, so it never lands
+          # in the git config or the command log; git push then uses GH_TOKEN.
+          gh auth setup-git
+          git push origin "HEAD:refs/heads/${BRANCH_NAME}"
+
+          gh pr create \
+            --head "${BRANCH_NAME}" \
+            --base "${GITHUB_REF_NAME}" \
+            --title "Release v${APP_VERSION}" \
+            --body "Release v${APP_VERSION}"

.github/workflows/sync_lab_release.yml

@@ -93,7 +93,7 @@ jobs:
       - name: Install Node
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
-          node-version: '20.x'
+          node-version: '24.x'
 
       - name: Install npm dependencies
         run: |

.github/workflows/zizmor.yml

@@ -0,0 +1,41 @@
+# Static analysis of the GitHub Actions workflows with zizmor.
+# https://github.com/zizmorcore/zizmor
+name: GitHub Actions security (zizmor)
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # upload-sarif needs this to publish results
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+
+      - name: Run zizmor
+        # Report only for now. The existing workflows still have findings to work
+        # through, so this uploads results to the Security tab instead of failing
+        # the build. Flip to a hard gate once they're cleared. No token is passed,
+        # so zizmor runs offline (skips the online-only audits) and avoids the API
+        # rate limits its docs warn about.
+        continue-on-error: true
+        run: uvx zizmor@1.25.2 --format=sarif . > results.sarif
+
+      - name: Upload SARIF
+        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+        with:
+          sarif_file: results.sarif
+          category: zizmor

package.json

@@ -10,7 +10,7 @@
     "test:unit:watch": "vitest",
     "test:coverage": "vitest run --coverage",
     "test:e2e": "playwright test",
-    "clean": "rimraf build dist",
+    "clean": "node scripts/rm.js build dist",
     "watch:tsc": "tsc -w",
     "watch:assets": "node ./scripts/extract.js && node ./scripts/copyassets.js watch",
     "watch": "concurrently \"yarn watch:tsc\" \"yarn watch:assets\" ",
@@ -30,19 +30,19 @@
     "dist:osx-arm64-dev": "yarn build && CSC_IDENTITY_AUTO_DISCOVERY=false electron-builder --macos --arm64 --publish never",
     "dist:win-64": "yarn build && electron-builder --win --publish never",
     "dist:win-arm64": "yarn build && yarn electron-builder --arm64 --publish never",
-    "update_workflow_conda_lock": "cd workflow_env && rimraf *.lock && conda-lock --kind explicit -f publish_env.yaml && cd -",
-    "update_conda_lock": "cd env_installer && rimraf *.lock && conda-lock --kind explicit -f jlab_server.yaml && cd -",
-    "clean_env_installer": "rimraf ./env_installer/jlab_server.tar.gz && rimraf ./env_installer/jlab_server",
+    "update_workflow_conda_lock": "node scripts/rm.js workflow_env/*.lock && cd workflow_env && conda-lock --kind explicit -f publish_env.yaml && cd -",
+    "update_conda_lock": "node scripts/rm.js env_installer/*.lock && cd env_installer && conda-lock --kind explicit -f jlab_server.yaml && cd -",
+    "clean_env_installer": "node scripts/rm.js ./env_installer/jlab_server.tar.gz && node scripts/rm.js ./env_installer/jlab_server",
     "create_env_installer": "yarn clean_env_installer && conda-lock install --no-validate-platform --prefix ./env_installer/jlab_server ./env_installer/conda-${ENV_PLATFORM}.lock && yarn copy_extras_to_bundled_env && conda pack -p ./env_installer/jlab_server -o ./env_installer/jlab_server.tar.gz",
     "create_env_installer:linux-64": "ENV_PLATFORM=linux-64 yarn create_env_installer",
     "create_env_installer:linux-aarch64": "ENV_PLATFORM=linux-aarch64 yarn create_env_installer",
     "create_env_installer:osx-64": "ENV_PLATFORM=osx-64 yarn create_env_installer",
     "create_env_installer:osx-arm64": "ENV_PLATFORM=osx-arm64 yarn create_env_installer",
     "create_env_installer:win-64": "yarn clean_env_installer && conda-lock install --no-validate-platform --prefix ./env_installer/jlab_server ./env_installer/conda-win-64.lock && yarn copy_extras_to_bundled_env && conda pack -p ./env_installer/jlab_server -o ./env_installer/jlab_server.tar.gz",
-    "extract_env_installer:osx": "cd ./env_installer && rimraf jlab_server_extracted && mkdir jlab_server_extracted && tar -xzf jlab_server.tar.gz -C jlab_server_extracted && cd -",
+    "extract_env_installer:osx": "node scripts/rm.js env_installer/jlab_server_extracted && cd ./env_installer && mkdir jlab_server_extracted && tar -xzf jlab_server.tar.gz -C jlab_server_extracted && cd -",
     "extract_env_installer:osx-64": "yarn extract_env_installer:osx",
     "extract_env_installer:osx-arm64": "yarn extract_env_installer:osx",
-    "compress_env_installer:osx": "rimraf ./env_installer/jlab_server.tar.gz && cd ./env_installer/jlab_server_extracted && tar -czf ../jlab_server.tar.gz . && cd -",
+    "compress_env_installer:osx": "node scripts/rm.js ./env_installer/jlab_server.tar.gz && cd ./env_installer/jlab_server_extracted && tar -czf ../jlab_server.tar.gz . && cd -",
     "compress_env_installer:osx-64": "yarn compress_env_installer:osx",
     "compress_env_installer:osx-arm64": "yarn compress_env_installer:osx",
     "check_version_match": "node scripts/buildutil.js --check-version-match",
@@ -157,6 +157,7 @@
       "darkModeSupport": true,
       "hardenedRuntime": true,
       "gatekeeperAssess": false,
+      "minimumSystemVersion": "12.0.0",
       "artifactName": "${productName}-${arch}.${ext}",
       "extraResources": [
         {
@@ -182,54 +183,49 @@
   "repository": "https://github.com/jupyterlab/jupyterlab-desktop",
   "license": "BSD-3-Clause",
   "devDependencies": {
+    "@electron/notarize": "^3.1.1",
     "@eslint/js": "^10.0.1",
     "@jupyter-notebook/web-components": "0.9.1",
-    "@leeoniya/ufuzzy": "1.0.14",
-    "@playwright/test": "^1.59.1",
-    "@types/ejs": "^3.1.0",
-    "@types/js-yaml": "^4.0.3",
+    "@leeoniya/ufuzzy": "1.0.19",
+    "@playwright/test": "^1.61.0",
+    "@types/ejs": "^3.1.5",
+    "@types/js-yaml": "^4.0.9",
     "@types/node": "^24",
-    "@types/semver": "^7.3.4",
-    "@types/tar": "^6.1.5",
-    "@types/yargs": "^17.0.18",
-    "@vitest/coverage-v8": "^4.1.5",
-    "electron": "^27.0.2",
-    "electron-builder": "^24.9.1",
-    "electron-notarize": "^1.2.2",
+    "@types/semver": "^7.7.1",
+    "@types/yargs": "^17.0.35",
+    "@vitest/coverage-v8": "^4.1.9",
+    "electron": "^42.4.0",
+    "electron-builder": "^26.15.3",
     "electron-playwright-helpers": "^2.1.0",
     "eslint": "^10.5.0",
     "eslint-config-prettier": "^10.1.8",
-    "fs-extra": "~9.1.0",
     "globals": "^17.6.0",
-    "istextorbinary": "^6.0.0",
-    "meow": "^6.0.1",
-    "node-watch": "^0.7.4",
+    "istextorbinary": "^9.5.0",
     "prettier": "~2.1.1",
     "read-package-tree": "^5.1.6",
-    "rimraf": "~3.0.0",
-    "shx": "^0.3.4",
+    "shx": "^0.4.0",
     "typescript": "^6.0.0",
-    "typescript-eslint": "^8.61.0",
-    "vitest": "^4.1.5",
-    "webpack": "^5.76.0",
+    "typescript-eslint": "^8.61.1",
+    "vitest": "^4.1.9",
+    "webpack": "^5.107.2",
     "webpack-cli": "^4.5.0"
   },
   "resolutions": {
     "serialize-javascript": "^6.0.2",
     "micromatch": "^4.0.8"
   },
   "dependencies": {
-    "@lumino/signaling": "^1.10.0",
-    "ejs": "^3.1.10",
-    "electron-log": "^4.4.8",
-    "fast-xml-parser": "^5.8.0",
+    "@lumino/signaling": "^2.1.5",
+    "ejs": "^6.0.1",
+    "electron-log": "^5.4.4",
+    "fast-xml-parser": "^5.9.0",
     "fix-path": "^3.0.0",
-    "js-yaml": "^4.1.0",
-    "semver": "^7.5.4",
-    "tar": "^6.2.1",
-    "update-electron-app": "^2.0.1",
-    "which": "^2.0.2",
-    "winreg": "^1.2.4",
-    "yargs": "^17.6.2"
+    "js-yaml": "^5.2.0",
+    "semver": "^7.8.4",
+    "tar": "^7.5.16",
+    "update-electron-app": "^3.2.0",
+    "which": "^7.0.0",
+    "winreg": "^1.2.5",
+    "yargs": "^17.7.2"
   }
 }

scripts/buildutil.js

@@ -1,51 +1,33 @@
-const meow = require('meow');
-const fs = require('fs-extra');
+const { parseArgs } = require('util');
+const fs = require('fs');
 const path = require('path');
 const semver = require('semver');
 const yaml = require('js-yaml');
 
+// Native replacements for the fs-extra helpers this script used.
+const readJSONSync = p => JSON.parse(fs.readFileSync(p, 'utf8'));
+const copySync = (src, dest) => fs.cpSync(src, dest, { recursive: true });
+
 const pkgjsonFilePath = path.resolve(__dirname, '../package.json');
 
-const cli = meow(
-  `
-    Usage
-      $ node buildutil <options>
-
-    Options
-      --check-version-match         check for JupyterLab version match
-      --update-binary-sign-list     update binary list to sign for macOS
-      --copy-extras-to-bundled-env  copy extra files from extras to bundled environment installer
-      --platform                    platform for --update-binary-sign-list. osx-64 or osx-arm64
-
-    Other options:
-      --help                        show usage information
-      --version                     show version information
-
-    Examples
-      $ node buildutil --check-version-match
-`,
-  {
-    flags: {
-      checkVersionMatch: {
-        type: 'boolean',
-        default: false
-      },
-      updateBinarySignList: {
-        type: 'boolean',
-        default: false
-      },
-      platform: {
-        type: 'string',
-        default: 'osx-64'
-      }
-    }
+// node buildutil <options>
+//   --check-version-match         check for JupyterLab version match
+//   --update-binary-sign-list     update binary list to sign for macOS
+//   --copy-extras-to-bundled-env  copy extras into the bundled environment
+//   --platform <osx-64|osx-arm64> platform for --update-binary-sign-list
+const { values: flags } = parseArgs({
+  options: {
+    'check-version-match': { type: 'boolean', default: false },
+    'update-binary-sign-list': { type: 'boolean', default: false },
+    'copy-extras-to-bundled-env': { type: 'boolean', default: false },
+    platform: { type: 'string', default: 'osx-64' }
   }
-);
+});
 
-if (cli.flags.checkVersionMatch) {
+if (flags['check-version-match']) {
   // parse application version
   const pkgjsonFileData = fs.existsSync(pkgjsonFilePath)
-    ? fs.readJSONSync(pkgjsonFilePath)
+    ? readJSONSync(pkgjsonFilePath)
     : undefined;
   if (!pkgjsonFileData) {
     console.error('package.json not found!');
@@ -91,7 +73,7 @@ if (cli.flags.checkVersionMatch) {
   process.exit(0);
 }
 
-if (cli.flags.updateBinarySignList) {
+if (flags['update-binary-sign-list']) {
   const { isBinary } = require('istextorbinary');
   const envInstallerDir = path.resolve('env_installer', 'jlab_server');
 
@@ -172,10 +154,7 @@ if (cli.flags.updateBinarySignList) {
 
   const binaries = findBinariesInDirectory(envInstallerDir);
   const fileContent = binaries.join('\n');
-  const signListFile = path.join(
-    'env_installer',
-    `sign-${cli.flags.platform}.txt`
-  );
+  const signListFile = path.join('env_installer', `sign-${flags.platform}.txt`);
 
   fs.writeFileSync(signListFile, `${fileContent}\n`);
 
@@ -184,11 +163,11 @@ if (cli.flags.updateBinarySignList) {
   process.exit(0);
 }
 
-if (cli.flags.copyExtrasToBundledEnv) {
+if (flags['copy-extras-to-bundled-env']) {
   const envExtrasDir = path.resolve('env_installer', 'extras');
   const envInstallerDir = path.resolve('env_installer', 'jlab_server');
 
-  fs.copySync(envExtrasDir, envInstallerDir, { recursive: true });
+  copySync(envExtrasDir, envInstallerDir);
 
   console.log(
     `Finished copying env extras from \n\t"${envExtrasDir}" to \n\t"${envInstallerDir}"`