feat: Bundle notebook renderers (#272)

* feat: integrate notebook renderers and fix ipywidget configuration

Replace external dependency on ms-toolsai.jupyter-renderers with
integrated renderer functionality bundled directly in the extension.

Build system changes:
- Switch renderers build from webpack to esbuild
- Add esbuild entries for notebook-renderer, ipywidgets-renderer,
  ipywidgets7, ipywidgets8, and ipywidgetsKernel
- Copy renderer source from vscode-notebook-renderers into src/renderers/

Package.json renderer configuration:
- Add deepnote-ipywidget-renderer with MIME type support
- Add jupyter-notebook preloads for ipywidget scripts
- Update renderer entrypoints to use new bundled paths

IPyWidget fixes:
- Change DefaultCommTarget from 'deepnote.widget' to 'jupyter.widget'
- Change WIDGET_MIMETYPE from deepnote to standard jupyter MIME types
- Update renderer messaging channel IDs to 'deepnote-ipywidget-renderer'
- Fix hardcoded comm target in ipyWidgetMessageDispatcher

Kernel interface updates:
- Add registerCommTarget to IKernelConnection interface
- Add kernelSession property to rawKernelConnection
- Update rawSessionConnection to implement new interface methods

Other improvements:
- Add logging for widget kernel communication
- Update renderer version checker for integrated renderers
- Fix plotView renderer communication imports
- Simplify fixJupyterLabRenderers() in postInstall.js

* fix version

* fix: address CodeRabbit review feedback

- Fix async function returning JSX instead of component in transforms.tsx
- Remove debug "Hello World" message in builtinRendererHooks.ts
- Fix subshellId to delegate to realKernel instead of hardcoded null
- Add error handling for vegaEmbed and fix memory leak in disposeOutputItem
- Update preload.ts comment (remove outdated webpack reference)
- Fix declaration order in type definition files
- Fix typo "them" -> "theme" in vegaRenderer.ts
- Simplify boolean return in isMimeTypeSupported
- Reorder clipboard support check before creating ClipboardItem

* fix: address remaining CodeRabbit review feedback

Accessibility improvements in render.tsx:
- Add alt attribute to img element
- Add type="button" to all button elements
- Remove redundant role="button" attributes
- Add title elements to SVGs for screen readers
- Add aria-hidden="true" to decorative SVGs
- Add onFocus/onBlur keyboard handlers alongside mouse events

Consolidate duplicated type definitions:
- Create src/renderers/shared/types.ts with shared message types
- Update client/constants.ts to re-export from shared types
- Update extension/constants.ts to re-export from shared types

Update dependencies:
- Update path-browserify from ^0.0.1 to ^1.0.1

* fix(security): resolve npm audit vulnerabilities

- Fix vega-functions XSS vulnerability (high severity)
- Fix vega-selections XSS vulnerability (high severity)
- Fix prismjs DOM Clobbering vulnerability (moderate severity)
- Downgrade @nteract/transform-vega from 7.0.10 to 7.0.6

All 7 vulnerabilities resolved, npm audit now passes.

* fix: remove elkjs dependency due to EPL-2.0 license incompatibility

Add npm override to replace @mermaid-js/layout-elk with empty-pkg (MIT).
This removes elkjs from the dependency tree while preserving Mermaid
diagram functionality (uses default dagre layout instead of ELK).

Dependency chain removed:
@mermaid-js/layout-elk → elkjs (EPL-2.0)

* fix: add stub for @nteract/presentational-components to fix esbuild error

The @nteract/transform-vega package imports @nteract/presentational-components
but doesn't declare it as a dependency. Instead of adding the full package
(which has 4 moderate vulnerabilities via prismjs), create a minimal stub
that only exports the Error component actually used.

This resolves the CI build failure:
"Could not resolve @nteract/presentational-components"

* tilde

* cr feedback

* Remove RendererVersionChecker

Author: Artmann

build/ci/postInstall.js

@@ -91,7 +91,8 @@ function makeVariableExplorerAlwaysSorted() {
 }
 
 function fixJupyterLabRenderers() {
-    const warnings = [];
+    // This fix is no longer needed as modern JupyterLab versions don't use marked directly
+    // Kept for backwards compatibility with older versions
     ['node_modules/@jupyterlab/cells/lib/widget.js', 'node_modules/@jupyterlab/rendermime/lib/renderers.js'].forEach(
         (file) => {
             const filePath = path.join(__dirname, '..', '..', file);
@@ -101,15 +102,12 @@ function fixJupyterLabRenderers() {
             const textToReplace = `import marked from 'marked'`;
             const textToReplaceWith = `import { marked } from 'marked'`;
             const fileContents = fs.readFileSync(filePath, 'utf8').toString();
-            if (fileContents.indexOf(textToReplace) === -1 && fileContents.indexOf(textToReplaceWith) === -1) {
-                warnings.push('Unable to find Jupyter marked usage to replace!');
+            if (fileContents.indexOf(textToReplace) !== -1) {
+                fs.writeFileSync(filePath, fileContents.replace(textToReplace, textToReplaceWith));
+                console.log(colors.green(file + ' file updated (marked import fix)'));
             }
-            fs.writeFileSync(filePath, fileContents.replace(textToReplace, `import { marked } from 'marked'`));
         }
     );
-    if (warnings.length === 2) {
-        throw new Error(warnings[0] + '\n' + warnings[1]);
-    }
 }
 
 /**

build/esbuild/build.ts

@@ -68,7 +68,12 @@ const commonExternals = [
     'ansi-regex' // Used by regexp utils
 ];
 // Create separate copies to avoid shared-state mutations
-const webExternals = [...commonExternals];
+// For web, add Node.js native modules that can't run in browser
+const webExternals = [
+    ...commonExternals,
+    'canvas', // Native module used by vega for server-side rendering, not needed in browser
+    'mathjax-electron' // Uses Node.js path module, MathJax rendering handled differently in browser
+];
 const desktopExternals = [...commonExternals, ...deskTopNodeModulesToExternalize];
 const bundleConfig = getBundleConfiguration();
 const isDevbuild = !process.argv.includes('--production');
@@ -243,7 +248,16 @@ function createConfig(
     const releaseVersionScriptFile = isPreRelease ? 'release.pre-release.js' : 'release.stable.js';
     const alias: Record<string, string> = {
         moment: path.join(extensionFolder, 'build', 'webpack', 'moment.js'),
-        'vscode-jupyter-release-version': path.join(__dirname, releaseVersionScriptFile)
+        'vscode-jupyter-release-version': path.join(__dirname, releaseVersionScriptFile),
+        // Stub for @nteract/presentational-components to avoid pulling in vulnerable dependencies
+        '@nteract/presentational-components': path.join(
+            extensionFolder,
+            'src',
+            'renderers',
+            'client',
+            'stubs',
+            'nteract-presentational-components.tsx'
+        )
     };
     // Use ESM entry for jsonc-parser to avoid UMD internal require() issues when bundling
     if (target === 'desktop') {
@@ -410,9 +424,33 @@ async function buildAll() {
             path.join(extensionFolder, 'src', 'webviews', 'webview-side', 'bigNumberComparisonSettings', 'index.tsx'),
             path.join(extensionFolder, 'dist', 'webviews', 'webview-side', 'bigNumberComparisonSettings', 'index.js'),
             { target: 'web', watch: watchAll }
+        ),
+        // Notebook renderers (integrated from jupyter-renderers)
+        build(
+            path.join(extensionFolder, 'src', 'renderers', 'client', 'index.tsx'),
+            path.join(extensionFolder, 'dist', 'renderers', 'client', 'renderers.js'),
+            { target: 'web', watch: watchAll }
+        ),
+        build(
+            path.join(extensionFolder, 'src', 'renderers', 'client', 'builtinRendererHooks.ts'),
+            path.join(extensionFolder, 'dist', 'renderers', 'client', 'builtinRendererHooks.js'),
+            { target: 'web', watch: watchAll }
+        ),
+        build(
+            path.join(extensionFolder, 'src', 'renderers', 'client', 'markdown.ts'),
+            path.join(extensionFolder, 'dist', 'renderers', 'client', 'markdown.js'),
+            { target: 'web', watch: watchAll }
+        ),
+        build(
+            path.join(extensionFolder, 'src', 'renderers', 'client', 'preload.ts'),
+            path.join(extensionFolder, 'dist', 'renderers', 'client', 'preload.js'),
+            { target: 'web', watch: watchAll }
         )
     );
 
+    // Copy ipywidgets from node_modules
+    builders.push(copyIPyWidgets7(), copyIPyWidgets8());
+
     if (isDevbuild) {
         builders.push(
             build(
@@ -528,6 +566,54 @@ async function copyNodeGypBuild() {
     await fs.copy(source, target, { recursive: true });
 }
 
+/**
+ * Helper to copy a bundle file if it exists, with clear error messaging
+ */
+async function copyBundleIfExists(source: string, target: string, description: string): Promise<void> {
+    const exists = await fs.pathExists(source);
+    if (!exists) {
+        console.warn(
+            colors.yellow(`Warning: ${description} not found at ${source}. `) +
+                colors.yellow('Skipping copy. Install the package if this feature is needed.')
+        );
+        return;
+    }
+    await fs.ensureDir(path.dirname(target));
+    await fs.copyFile(source, target);
+}
+
+/**
+ * Copy @vscode/jupyter-ipywidgets7 pre-built bundle for IPyWidget v7 support
+ */
+async function copyIPyWidgets7() {
+    const source = path.join(
+        extensionFolder,
+        'node_modules',
+        '@vscode',
+        'jupyter-ipywidgets7',
+        'dist',
+        'ipywidgets.js'
+    );
+    const target = path.join(extensionFolder, 'dist', 'renderers', 'ipywidgets7', 'ipywidgets.js');
+    await copyBundleIfExists(source, target, '@vscode/jupyter-ipywidgets7 bundle');
+}
+
+/**
+ * Copy @vscode/jupyter-ipywidgets8 pre-built bundle for IPyWidget v8 support
+ */
+async function copyIPyWidgets8() {
+    const source = path.join(
+        extensionFolder,
+        'node_modules',
+        '@vscode',
+        'jupyter-ipywidgets8',
+        'dist',
+        'ipywidgets.js'
+    );
+    const target = path.join(extensionFolder, 'dist', 'renderers', 'ipywidgets8', 'ipywidgets.js');
+    await copyBundleIfExists(source, target, '@vscode/jupyter-ipywidgets8 bundle');
+}
+
 async function buildSqlLanguageServer() {
     // Bundle the sql-language-server with all its dependencies into a single file
     const entryPoint = path.join(