v2.21.0

2.21.0

(Full Changelog)

Security fixes

• GHSA-c3mw-737p-c7g2 5xx request logging leaked token-bearing Referer header values

Enhancements made

• Show connectable URL for password authentication #1677 (@Sanjays2402, @krassowski)
• Allow clients to supply a kernel_id on kernel/session creation #1655 (@sfc-gh-sbirmiwal, @Zsailer, @krassowski, @minrk)

Bugs fixed

• Fix referer token leak in server logs when the request causes a 500 #1681 (@Yann-P, @krassowski)
• Self-remove event subscriber on WebSocketClosedError #1680 (@Zsailer, @krassowski)
• Use hostname in wildcard browser redirect files #1673 (@sjh9714, @Yann-P, @krassowski)
• Fix resolvePath handling for home-relative paths #1670 (@MUFFANUJ, @krassowski)

Maintenance and upkeep improvements

• Fix downstream failure in traitlets, due to packaging change. #1688 (@Carreau, @krassowski)
• Fix zulip notification on release #1665 (@Yann-P, @Zsailer)
• Drop Pin preventing testing Python 3.15 pre-releases #1662 (@krassowski, @Zsailer)
• Remove condition to skip pending kernels on older jupyter_client versions (no longer needed) #1656 (@krassowski, @Zsailer)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review.
See our definition of contributors.

(GitHub contributors page for this release)

@Carreau (activity) | @krassowski (activity) | @minrk (activity) | @MUFFANUJ (activity) | @Sanjays2402 (activity) | @sfc-gh-sbirmiwal (activity) | @sjh9714 (activity) | @Yann-P (activity) | @Zsailer (activity)