============ 9.x Series ============ .. _version 9.16: IPython 9.16 ------------ Summary ~~~~~~~ This release contains two security-hardening fixes — HTML-attribute escaping in the display objects and closing an arbitrary-code-execution path in completion — a new ``cell_meta`` field on :class:`~IPython.core.interactiveshell.ExecutionInfo`, several completion, autoreload, and path-handling fixes, and two backwards-incompatible changes (:magic:`lsmagic` default output and the removal of long-deprecated APIs). It also includes a large amount of internal typing, test, and CI modernization. - :ghpull:`15337` Resolve attribute annotations under the policy in :func:`~IPython.core.guarded_eval.eval_node` - :ghpull:`15335` Make :magic:`lsmagic` return plain text by default - :ghpull:`15334` Escape URLs and file names interpolated into display HTML attributes - :ghpull:`15332` Add yakuake to the list of Kitty-compatible terminals - :ghpull:`15330` Add version information to deprecation warnings - :ghpull:`15317` Only substitute ``~`` in :func:`~IPython.utils.path.compress_user` on a path-component boundary - :ghpull:`15314` Refactor banner property logic - :ghpull:`15310` Deprecation cleanup and decorator-dependency removal - :ghpull:`15289` Make caller locals visible to nested scopes in embedded shells - :ghpull:`15288` Limit file completions to path contexts - :ghpull:`15287` Centralize image format handling - :ghpull:`15285` Disable path elision in tab-completion with ``min_elide=0`` - :ghpull:`15276` Make :class:`~IPython.display.Image` with ``retina=True`` work with WebP - :ghpull:`15275` Fix memory leak and error handling in the LLM autosuggester - :ghpull:`15274` Reload ``__kwdefaults__``, ``__annotations__``, and ``__type_params__`` in autoreload - :ghpull:`15273` Close the history database during shell shutdown - :ghpull:`15266` Add test covering ``%%timeit`` cell magic output format with multiline code - :ghpull:`15260` Fix doctest prompt stripping regression - :ghpull:`15071` Add ``cell_meta`` to :class:`~IPython.core.interactiveshell.ExecutionInfo` and pass it through :meth:`~IPython.core.interactiveshell.InteractiveShell.run_cell` In addition, this release lands a broad sweep of internal maintenance: strict ``mypy`` type checking and many new annotations, ``pyupgrade``/modernized type annotations, additional ``ruff`` rules, narrowed bare ``except:`` clauses, removal of the deprecated ``IPython.utils.py3compat`` module, new test coverage, and a number of test-suite resource-leak and CI fixes. Security Hardening ~~~~~~~~~~~~~~~~~~~ Two fixes close paths that could execute unintended code or inject markup: - Values passed to the display objects were interpolated unescaped into quoted HTML attributes, so a quote character could close the attribute and have the remainder parsed as markup. :class:`~IPython.display.Image` and :class:`~IPython.display.Video` (``src``), :class:`~IPython.display.IFrame` and its :class:`~IPython.display.YouTubeVideo`/:class:`~IPython.display.VimeoVideo`/:class:`~IPython.display.ScribdDocument` subclasses (``src``, ``width``, ``height``, reachable through the id argument), :class:`~IPython.display.Audio` (url and ``element_id``), and the :class:`~IPython.display.FileLinks` formatter (names read off disk) now escape these values. For example ``YouTubeVideo('abc">