Bump jupytext from 1.19.3 to 1.19.5

[dependabot]

Bumps jupytext from 1.19.3 to 1.19.5.

Release notes

Sourced from jupytext's releases.

Version 1.19.5

Changed

• Harden the github action (#1569). Thanks to Peyton Murray for this PR
• The JupyterLab extension is now built with jupyter-builder - Thanks to Mahendra Paipuri for this PR (#1590)
• zizmor and pre-commit are now required to pass before any other CI job runs, and the extension lint is now part of pre-commit (#1594)
• Enabled TypeScript strict null checks in the JupyterLab extension - Thanks to Michał Krassowski for this PR (#1586)

Fixed

• Detecting IPython help/shell commands no longer takes quadratic time on lines made of whitespace - Thanks to Naveed for this PR (#1582)
• Fixed unguarded access to the languageInfo.extensions array, which could still make Jupytext show notebook icons for Python files when the kernel metadata was incomplete - Thanks to Michał Krassowski for this PR (#1584)

Security

• marimo_py_to_notebook now reuses its secure (0600, mkstemp-backed) temporary files instead of closing and reopening them by name, which removed the safe permissions and left a window for a symlink attack on shared machines (#1568). Thanks to Naveed for reporting and fixing this!

Version 1.19.4

Changed

• Jupytext's documentation is now at https://jupytext.org! (#1538)
• We have moved Jupytext to its own Jupytext organization (#1546)
• Updated the JupyterLab extension production dependencies (12 patch updates) (#1541)
• We require pandoc<3.10 on the CI as pandoc converts the "3.10" string to a float, which then causes issues in Jupytext (#1545)
• Fixed the CI so that tests also run on scheduled runs, and so that jupyterfs tests are skipped when their initialization fails (#1539)
• In the CI, the extension is build using a dedicated build pixi environment.

Fixed

• We now support unicode characters while dumping YAML (#1542)

Added

• A new custom_language_magics option is available (#1491). Thanks to steovd for making the PR!

Security

• Fixed GHSA-m22c-4q2m-m5wr: the update-playwright-snapshots workflow was triggerable by any user via an issue_comment event. It now checks that the comment author is an OWNER, MEMBER, or COLLABORATOR before running (#1535)
• Set persist-credentials: false on all workflow checkout steps as defense-in-depth, preventing a live GITHUB_TOKEN from being left in .git/config where attacker-controlled build hooks could read it. This is strictly required only for update-playwright-snapshots (fixed above), but applies to all workflows so they remain safe if their scope is later extended.

Changelog

Sourced from jupytext's changelog.

1.19.5 (2026-07-21)

Changed

• Harden the github action (#1569). Thanks to Peyton Murray for this PR
• The JupyterLab extension is now built with jupyter-builder - Thanks to Mahendra Paipuri for this PR (#1590)
• zizmor and pre-commit are now required to pass before any other CI job runs, and the extension lint is now part of pre-commit (#1594)
• Enabled TypeScript strict null checks in the JupyterLab extension - Thanks to Michał Krassowski for this PR (#1586)

Fixed

• Detecting IPython help/shell commands no longer takes quadratic time on lines made of whitespace - Thanks to Naveed for this PR (#1582)
• Fixed unguarded access to the languageInfo.extensions array, which could still make Jupytext show notebook icons for Python files when the kernel metadata was incomplete - Thanks to Michał Krassowski for this PR (#1584)

Security

• marimo_py_to_notebook now reuses its secure (0600, mkstemp-backed) temporary files instead of closing and reopening them by name, which removed the safe permissions and left a window for a symlink attack on shared machines (#1568). Thanks to Naveed for reporting and fixing this!

1.19.4 (2026-06-21)

Changed

• Jupytext's documentation is now at https://jupytext.org! (#1538)
• We have moved Jupytext to its own Jupytext organization (#1546)
• Updated the JupyterLab extension production dependencies (12 patch updates) (#1541)
• We require pandoc<3.10 on the CI as pandoc converts the "3.10" string to a float, which then causes issues in Jupytext (#1545)
• Fixed the CI so that tests also run on scheduled runs, and so that jupyterfs tests are skipped when their initialization fails (#1539)
• In the CI, the extension is build using a dedicated build pixi environment.

Fixed

• We now support unicode characters while dumping YAML (#1542)

Added

• A new custom_language_magics option is available (#1491). Thanks to steovd for making the PR!

Security

• Fixed GHSA-m22c-4q2m-m5wr: the update-playwright-snapshots workflow was triggerable by any user via an issue_comment event. It now checks that the comment author is an OWNER, MEMBER, or COLLABORATOR before running (#1535)
• Set persist-credentials: false on all workflow checkout steps as defense-in-depth, preventing a live GITHUB_TOKEN from being left in .git/config where attacker-controlled build hooks could read it. This is strictly required only for update-playwright-snapshots (fixed above), but applies to all workflows so they remain safe if their scope is later extended.

Commits

• 3132c6c Version 1.19.5
• d8d4d14 build(deps): bump axios from 1.16.0 to 1.18.1 in /jupyterlab in the jupytext-...
• 1a6fde9 build(deps): bump the actions-dependencies group with 3 updates
• 0068463 build(deps): bump astro
• 58c1eb9 build(deps): bump the jupytext-extension-dependencies group across 2 director...
• af6134e Migrate to jupyter-builder for building frontend extension (#1590)
• bb0de16 build(deps): bump the actions-dependencies group across 1 directory with 8 up...
• 555b4c2 avoid quadratic backtracking in help/bash magic regex
• f24a3b7 reuse secure temp files in marimo_py_to_notebook
• d53e2f1 Require zizmor and precommit on ci (#1594)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Looks like jupytext is up-to-date now, so this is no longer needed.