code-sandboxes 1.9.13__tar.gz → 1.9.14__tar.gz

{code_sandboxes-1.9.13 → code_sandboxes-1.9.14}/CHANGELOG.md

@@ -8,6 +8,25 @@
 
 ## Unreleased
 
+## 1.9.14
+
+- **`datalayer/python-cpu:2026.09` base channel repinned** to the rebuilt
+  `jupyter-python:0.2.2` (now carrying `jupyter-kernels==1.2.23`) plus the
+  contract layer, digest
+  `sha256:aa5413000bb5b6ecd0a0cf03959b107f0d572f65bf230c08bbdf9a4569775545`,
+  released 2026-09-16 to `environments/base/python-cpu`. Every variant pins the
+  same digest.
+
+## 1.9.13
+
+- **`jupyter-kernels==1.2.23` forced into `sandbox-contract/v1`**: it carries
+  the pooled kernel manager the runtime's Jupyter config selects
+  (`kernel_manager_class = jupyter_kernels.pool.mapping.PooledMappingKernelManager`),
+  replacing the deprecated private `datalayer-kernels`. PyPI serves it, so a
+  resolve satisfies it from the index and the wheelhouse carries no wheel for
+  it; the pin keeps `uv pip sync --require-hashes` from stripping it out of a
+  user environment's image.
+
 ## 1.9.12
 
 - **`owner_repository`, `owner_cache_repository` and `ECR_ENVIRONMENT_PREFIX`

{code_sandboxes-1.9.13 → code_sandboxes-1.9.14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code_sandboxes
-Version: 1.9.13
+Version: 1.9.14
 Project-URL: Home, https://github.com/datalayer/code-sandboxes
 Author-email: Datalayer <info@datalayer.io>
 License: BSD 3-Clause License

{code_sandboxes-1.9.13 → code_sandboxes-1.9.14}/code_sandboxes/__version__.py

@@ -3,4 +3,4 @@
 
 """Code Sandboxes."""
 
-__version__ = "1.9.13"
+__version__ = "1.9.14"

{code_sandboxes-1.9.13 → code_sandboxes-1.9.14}/code_sandboxes/environments/bases.py

@@ -109,8 +109,9 @@ APPROVED_BASES: dict[str, ApprovedBase] = {
     base.ref: base
     for base in (
         # E1-05: jupyter-python:0.2.2 (Ubuntu security packages and conda's own
-        # OpenSSL upgraded, JupyterLab's staging yarn.lock dropped) plus the
-        # contract layer, released 2026-09-14 to environments/base/python-cpu.
+        # OpenSSL upgraded, JupyterLab's staging yarn.lock dropped, jupyter-kernels
+        # installed) plus the contract layer, released 2026-09-16 to
+        # environments/base/python-cpu.
         # One image, so every variant pins the same digest until a variant
         # needs a base of its own. The prior digest, jupyter-python:0.2.1,
         # carried 31 fixable-critical findings the scan (E1-08) blocks every
@@ -125,10 +126,10 @@ APPROVED_BASES: dict[str, ApprovedBase] = {
                     # `.spec.VARIANTS`, spelled out: `spec` imports from this
                     # module, so importing it back here would be circular.
                     ("datalayer", "e2b", "daytona", "modal"),
-                    "sha256:334adf6c2714c8919ef60beeca1db12e3531a391c9dde41932c782f81c432b36",
+                    "sha256:aa5413000bb5b6ecd0a0cf03959b107f0d572f65bf230c08bbdf9a4569775545",
                 )
             },
-            snapshots={"2026.09": "20260914T150000Z"},
+            snapshots={"2026.09": "20260916T120000Z"},
         ),
         # E2-17: jupyter-python-cuda plus the same layer.
         ApprovedBase(