Fix high-severity Dependabot security alerts in requirements.txt

[Copilot]

Two HIGH-severity vulnerabilities affecting Windows users were flagged in pinned dependencies. Both involve unintended information/code exposure via path handling on Windows.

Changes

• jupyter_server 2.6.0 → 2.14.1 — fixes GHSA-hrw6-wg82-cm62 (CVE-2024-35178): Windows user password hash disclosed via server logs
• nbconvert 7.6.0 → 7.17.0 — fixes GHSA-xm59-rqc7-hhvf (CVE-2025-53000): Uncontrolled search path enabling arbitrary code execution on Windows

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• api.osv.dev
  • Triggering command: `/usr/bin/python3 python3 -c
    import json, urllib.request

packages = [
('anyio', '3.7.0'),
('notebook', '6.5.4'),
('Jinja2', '3.1.6'),
('tornado', '6.5.1'),
('jupyter_server', '2.6.0'),
('nbconvert', '7.6.0'),
('idna', '3.7'),
('numpy', '1.25.0'),` (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Resolve depenabot alerts and prepare PRs.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.