#19767·jupyterlab

Tornado v6.5.9 has breaking change regarding following symlinks

Author: veoxCreated Sep 14, 2026Updated Sep 15, 2026

Labelsbugstatus:Needs Triage

Description

JupyterLab - at least when installed in a virtualenv, but I suspect not limited to that - is not able to serve files.

From latest Tornado (released a few hours ago):

https://github.com/tornadoweb/tornado/releases/tag/v6.5.9

.StaticFileHandler no longer follows symlinks outside of the static root directory. Applications that wish to continue the previous behavior may set the new argument allowed_symlink_directory to the directory (an ancestor of the static root) that should be used for symlink validation.

Reproduce

For completeness sake:

bash

cd armon
virtualenv .virtualenv/`basename $(pwd)` && source .virtualenv/`basename $(pwd)`/bin/activate
pip install jupyterlab
jupyter lab --ip=jonesie

A tab opens in a browser. Console shows:

[E 2026-09-14 22:40:36.509 ServerApp] Uncaught exception GET /static/lab/main.3cf434267b315d6a22fe.js?v=3cf434267b315d6a22fe (192.168.1.133)
    HTTPServerRequest(protocol='http', host='jonesie:8888', method='GET', uri='/static/lab/main.3cf434267b315d6a22fe.js?v=3cf434267b315d6a22fe', version='HTTP/1.1', remote_ip='192.168.1.133')
    Traceback (most recent call last):
      File "/home/veox/src/armon/.virtualenv/armon/lib/python3.14/site-packages/tornado/web.py", line 1887, in _execute
        result = await result
                 ^^^^^^^^^^^^
      File "/home/veox/src/armon/.virtualenv/armon/lib/python3.14/site-packages/tornado/web.py", line 2822, in get
        self.absolute_path = self.validate_absolute_path(self.root, absolute_path)
                             ~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^
      File "/home/veox/src/armon/.virtualenv/armon/lib/python3.14/site-packages/jupyter_server/base/handlers.py", line 1067, in validate_absolute_path
        return super().validate_absolute_path(root, absolute_path)
               ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^
      File "/home/veox/src/armon/.virtualenv/armon/lib/python3.14/site-packages/tornado/web.py", line 3027, in validate_absolute_path
        absolute_path = self._resolve_symlink_target(absolute_path)
      File "/home/veox/src/armon/.virtualenv/armon/lib/python3.14/site-packages/tornado/web.py", line 3092, in _resolve_symlink_target
        allowed_directory = os.path.realpath(self.allowed_symlink_directory)
                                             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    AttributeError: 'FileFindHandler' object has no attribute 'allowed_symlink_directory'
[E 2026-09-14 22:40:36.512 ServerApp] {
      "Host": "jonesie:8888",
      "Accept": "*/*",
      "Referer": "http://jonesie:8888/lab",
      "User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0"
    }
[E 2026-09-14 22:40:36.512 ServerApp] 500 GET /static/lab/main.3cf434267b315d6a22fe.js?v=3cf434267b315d6a22fe ([email protected]) 3.53ms referer=http://jonesie:8888/lab

Expected behavior

Browser shows login page, loads favicon, etc.

Quickest workaround

Downgrade tornado.

bash

pip install tornado==6.5.8

Context

Operating System and version: Arch Linux (rolling)
Browser and version: Firefox 155 (not a browser issue)
JupyterLab version: tried 4.6.3 and 4.5.4 - I suspect all

Source: jupyterlab/jupyterlab

View original on GitHub View discussion on GitHub