chore(deps): update dependency pillow to v12 [security]#14278
chore(deps): update dependency pillow to v12 [security]#14278renovate-bot wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
Code Review
This pull request updates the Pillow dependency to version 12.1.1 across multiple requirements.txt files. The reviewer recommends simplifying redundant dependency lines that use environment markers for unsupported Python versions (older than 3.10) into a single unconstrained line in several of the modified files.
| pillow==12.1.1; python_version < '3.8' | ||
| pillow==12.1.1; python_version >= '3.8' |
There was a problem hiding this comment.
Following the repository guidelines, environment markers or fallback dependency versions for Python versions older than 3.10 should not be specified since Python versions below 3.10 are no longer supported. Since both lines now specify pillow==12.1.1, they can be simplified to a single unconstrained dependency line.
pillow==12.1.1
References
- Do not specify fallback dependency versions or environment markers for Python versions older than 3.10, as Python versions below 3.10 are no longer supported.
| pillow==12.1.1; python_version < '3.8' | ||
| pillow==12.1.1; python_version >= '3.8' |
There was a problem hiding this comment.
Following the repository guidelines, environment markers or fallback dependency versions for Python versions older than 3.10 should not be specified since Python versions below 3.10 are no longer supported. Since both lines now specify pillow==12.1.1, they can be simplified to a single unconstrained dependency line.
pillow==12.1.1
References
- Do not specify fallback dependency versions or environment markers for Python versions older than 3.10, as Python versions below 3.10 are no longer supported.
| pillow==12.1.1; python_version < '3.8' | ||
| pillow==12.1.1; python_version >= '3.8' |
There was a problem hiding this comment.
Following the repository guidelines, environment markers or fallback dependency versions for Python versions older than 3.10 should not be specified since Python versions below 3.10 are no longer supported. Since both lines now specify pillow==12.1.1, they can be simplified to a single unconstrained dependency line.
pillow==12.1.1
References
- Do not specify fallback dependency versions or environment markers for Python versions older than 3.10, as Python versions below 3.10 are no longer supported.
| pillow==12.1.1; python_version < '3.8' | ||
| pillow==12.1.1; python_version >= '3.8' |
There was a problem hiding this comment.
Following the repository guidelines, environment markers or fallback dependency versions for Python versions older than 3.10 should not be specified since Python versions below 3.10 are no longer supported. Since both lines now specify pillow==12.1.1, they can be simplified to a single unconstrained dependency line.
pillow==12.1.1
References
- Do not specify fallback dependency versions or environment markers for Python versions older than 3.10, as Python versions below 3.10 are no longer supported.
| pillow==12.1.1; python_version < '3.8' | ||
| pillow==12.1.1; python_version >= '3.8' |
There was a problem hiding this comment.
Following the repository guidelines, environment markers or fallback dependency versions for Python versions older than 3.10 should not be specified since Python versions below 3.10 are no longer supported. Since both lines now specify pillow==12.1.1, they can be simplified to a single unconstrained dependency line.
pillow==12.1.1
References
- Do not specify fallback dependency versions or environment markers for Python versions older than 3.10, as Python versions below 3.10 are no longer supported.
| pillow==12.1.1; python_version < '3.8' | ||
| pillow==12.1.1; python_version >= '3.8' |
There was a problem hiding this comment.
Following the repository guidelines, environment markers or fallback dependency versions for Python versions older than 3.10 should not be specified since Python versions below 3.10 are no longer supported. Since both lines now specify pillow==12.1.1, they can be simplified to a single unconstrained dependency line.
pillow==12.1.1
References
- Do not specify fallback dependency versions or environment markers for Python versions older than 3.10, as Python versions below 3.10 are no longer supported.
| pillow==12.1.1; python_version < '3.8' | ||
| pillow==12.1.1; python_version >= '3.8' |
There was a problem hiding this comment.
Following the repository guidelines, environment markers or fallback dependency versions for Python versions older than 3.10 should not be specified since Python versions below 3.10 are no longer supported. Since both lines now specify pillow==12.1.1, they can be simplified to a single unconstrained dependency line.
pillow==12.1.1
References
- Do not specify fallback dependency versions or environment markers for Python versions older than 3.10, as Python versions below 3.10 are no longer supported.
| pillow==12.1.1; python_version < '3.8' | ||
| pillow==12.1.1; python_version >= '3.8' |
There was a problem hiding this comment.
Following the repository guidelines, environment markers or fallback dependency versions for Python versions older than 3.10 should not be specified since Python versions below 3.10 are no longer supported. Since both lines now specify pillow==12.1.1, they can be simplified to a single unconstrained dependency line.
pillow==12.1.1
References
- Do not specify fallback dependency versions or environment markers for Python versions older than 3.10, as Python versions below 3.10 are no longer supported.
| pillow==12.1.1; python_version < '3.8' | ||
| pillow==12.1.1; python_version >= '3.8' |
There was a problem hiding this comment.
Following the repository guidelines, environment markers or fallback dependency versions for Python versions older than 3.10 should not be specified since Python versions below 3.10 are no longer supported. Since both lines now specify pillow==12.1.1, they can be simplified to a single unconstrained dependency line.
pillow==12.1.1
References
- Do not specify fallback dependency versions or environment markers for Python versions older than 3.10, as Python versions below 3.10 are no longer supported.
| pillow==12.1.1; python_version < '3.8' | ||
| pillow==12.1.1; python_version >= '3.8' |
There was a problem hiding this comment.
Following the repository guidelines, environment markers or fallback dependency versions for Python versions older than 3.10 should not be specified since Python versions below 3.10 are no longer supported. Since both lines now specify pillow==12.1.1, they can be simplified to a single unconstrained dependency line.
pillow==12.1.1
References
- Do not specify fallback dependency versions or environment markers for Python versions older than 3.10, as Python versions below 3.10 are no longer supported.
This PR contains the following updates:
==10.4.0→==12.1.1==10.4.0→==12.1.1==10.3.0→==12.1.1==11.1.0→==12.1.1Pillow affected by out-of-bounds write when loading PSD images
CVE-2026-25990 / GHSA-cfh3-3jmp-rvhc
More information
Details
Impact
An out-of-bounds write may be triggered when loading a specially crafted PSD image. Pillow >= 10.3.0 users are affected.
Patches
Pillow 12.1.1 will be released shortly with a fix for this.
Workarounds
Image.open()has aformatsparameter that can be used to prevent PSD images from being opened.References
Pillow 12.1.1 will add release notes at https://pillow.readthedocs.io/en/stable/releasenotes/index.html
Severity
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
python-pillow/Pillow (Pillow)
v12.1.1Compare Source
v12.1.0Compare Source
https://pillow.readthedocs.io/en/stable/releasenotes/12.1.0.html
Deprecations
Documentation
Dependencies
Testing
ResourceWarnings inselftest.py#9332 [@hugovk]Type hints
Other changes
v12.0.0Compare Source
https://pillow.readthedocs.io/en/stable/releasenotes/12.0.0.html
Removals
Deprecations
Documentation
Dependencies
Testing
Type hints
Other changes
v11.3.0Compare Source
https://pillow.readthedocs.io/en/stable/releasenotes/11.3.0.html
Deprecations
Documentation
Makefile#8933 [@hugovk]Dependencies
Testing
matchparameter topytest.warns()#9038 [@hugovk]Type hints
Other changes
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Never, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.