Bump jupyter-server from 2.14.1 to 2.20.0 in /experiments/agentcompany/openhands

[dependabot]

Bumps jupyter-server from 2.14.1 to 2.20.0.

Release notes

Sourced from jupyter-server's releases.

v2.20.0

2.20.0

(Full Changelog)

Security fixes

• CVE-2026-44727 GHSA-fcw5-x6j4-ccmp

Enhancements made

• Fix confusing terminal output when using ServerApp.ip=0.0.0.0 #1643 (@​Yann-P, @​minrk)
• Add a toggle to enable curve encryption for all kernels that support it #1638 (@​krassowski, @​Carreau, @​ianthomas23, @​minrk)

Bugs fixed

• Grab the port from bind_sockets in case its different #1651 (@​choldgraf, @​krassowski)

Maintenance and upkeep improvements

• Fix test_authorizer having a spurious comma in params #1664 (@​krassowski)
• Add a reminder to merge GHSA before release #1659 (@​Yann-P, @​Carreau)
• Exclude problematic pywinpty 3.0.4 version #1658 (@​krassowski)
• ci: explicitly pass base-setup inputs to fix strict validation failures #1626 (@​Carreau, @​Copilot)

Documentation improvements

• Align docs for curve encryption with latest JEP version #1660 (@​krassowski, @​Carreau)
• Remove PGP key from docs #1653 (@​Yann-P, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​choldgraf (activity) | @​Copilot (activity) | @​ianthomas23 (activity) | @​krassowski (activity) | @​minrk (activity) | @​Yann-P (activity)

v2.19.0

2.19.0

(Full Changelog)

Enhancements made

... (truncated)

Changelog

Sourced from jupyter-server's changelog.

2.20.0

(Full Changelog)

Enhancements made

• Fix confusing terminal output when using ServerApp.ip=0.0.0.0 #1643 (@​Yann-P, @​minrk)
• Add a toggle to enable curve encryption for all kernels that support it #1638 (@​krassowski, @​Carreau, @​ianthomas23, @​minrk)

Bugs fixed

• Grab the port from bind_sockets in case its different #1651 (@​choldgraf, @​krassowski)

Maintenance and upkeep improvements

• Fix test_authorizer having a spurious comma in params #1664 (@​krassowski)
• Add a reminder to merge GHSA before release #1659 (@​Yann-P, @​Carreau)
• Exclude problematic pywinpty 3.0.4 version #1658 (@​krassowski)
• ci: explicitly pass base-setup inputs to fix strict validation failures #1626 (@​Carreau, @​Copilot)

Documentation improvements

• Align docs for curve encryption with latest JEP version #1660 (@​krassowski, @​Carreau)
• Remove PGP key from docs #1653 (@​Yann-P, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​choldgraf (activity) | @​Copilot (activity) | @​ianthomas23 (activity) | @​krassowski (activity) | @​minrk (activity) | @​Yann-P (activity)

2.19.0

(Full Changelog)

Enhancements made

• Return unresolved stanza when kernel scope is unavailable for resolvePath (instead of failing with 404) #1641 (@​MUFFANUJ, @​Carreau, @​krassowski)

Bugs fixed

• Recreate notary store on failure to prevent save deadlock and data loss #1640 (@​krassowski, @​Carreau)

Maintenance and upkeep improvements

... (truncated)

Commits

• 05a78ad Publish 2.20.0
• 6cbee8d Merge commit from fork
• 333e700 Fix test_authorizer having a spurious comma in params (#1664)
• cccd543 Fix CI: explicitly pass base-setup inputs to avoid strict validation failures
• cd16d71 Align docs for curve encryption with latest JEP version (#1660)
• e458061 Add a toggle to enable curve encryption for all kernels that support it (#1638)
• 0ceeb4f Add note in RELEASE.md
• b13f8a2 Markdown does not work.
• e885b10 Add GHSA reminder in prep-release
• 0e28c90 Exclude problematic pywinpty 3.0.4 version (#1658)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Greptile Summary

• Bumps jupyter_server from 2.14.1 to 2.20.0 for the OpenHands experiment requirements.

Confidence Score: 4/5

The dependency update is not ready to merge because the frozen OpenHands environment contains incompatible Jupyter package pins.

The change is limited to one requirements file, and dependency resolution evidence confirms the pinned versions conflict during environment recreation.

experiments/agentcompany/openhands/requirements.txt

T-Rex Logs

What T-Rex did

• I reproduced the unsatisfiable dependency pins by running a fresh venv and a full OpenHands requirements dry-run, which failed due to pyairports==2.1.1 being unavailable.
• I ran a minimal constraints file with jupyter-events==0.10.0 and jupyter_server==2.20.0, and the resolver exited with a failure due to ResolutionImpossible.
• The minimal resolver output shows jupyter-server 2.20.0 depends on jupyter-events>=0.11.0, which conflicts with the pinned jupyter-events==0.10.0.
• The full requirements dry-run was first blocked by the unrelated pyairports package, blocking progress on the pin-resolution.
• I compared the base and head commits and observed that the jupyter_server pin changed from 2.14.1 in the base to 2.20.0 in the head.

_{Ran code and verified through T-Rex}

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
experiments/agentcompany/openhands/requirements.txt:79
**Unsatisfiable dependency pins**

`jupyter_server==2.20.0` requires `jupyter-events>=0.11.0`, but this requirements file still pins `jupyter-events==0.10.0` on line 75. A fresh install of this frozen environment can fail dependency resolution, so the OpenHands experiment environment cannot be recreated until `jupyter-events` is bumped to a compatible version or this server bump is held back.

_{Reviews (1): Last reviewed commit: "Bump jupyter-server in /experiments/agen..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	jupyter-server@​2.14.1 ⏵ 2.20.0		+75

View full report

[greptile-apps]

Unsatisfiable dependency pins

jupyter_server==2.20.0 requires jupyter-events>=0.11.0, but this requirements file still pins jupyter-events==0.10.0 on line 75. A fresh install of this frozen environment can fail dependency resolution, so the OpenHands experiment environment cannot be recreated until jupyter-events is bumped to a compatible version or this server bump is held back.

Artifacts

Repro: minimal constraints file with the conflicting Jupyter pins

• Contains supporting evidence from the run (text/plain; charset=utf-8).

Repro: pip resolver failure showing jupyter-server 2.20.0 requires jupyter-events>=0.11.0 while jupyter-events==0.10.0 is pinned

• Keeps the command output available without making the summary code-heavy.

Repro: full requirements pip dry-run attempt blocked first by unrelated pyairports package availability

• Keeps the command output available without making the summary code-heavy.

_{Ran code and verified through T-Rex}

Prompt To Fix With AI

This is a comment left during a code review.
Path: experiments/agentcompany/openhands/requirements.txt
Line: 79

Comment:
**Unsatisfiable dependency pins**

`jupyter_server==2.20.0` requires `jupyter-events>=0.11.0`, but this requirements file still pins `jupyter-events==0.10.0` on line 75. A fresh install of this frozen environment can fail dependency resolution, so the OpenHands experiment environment cannot be recreated until `jupyter-events` is bumped to a compatible version or this server bump is held back.

How can I resolve this? If you propose a fix, please make it concise.