chore(deps): update dependency pillow to v12 [security] #13822
Conversation
trusted-contributions-gcf
bot
added
kokoro:force-run
product-auto-label
bot
added
samples
kokoro-team
removed
the
kokoro:force-run
Summary of ChangesHello @renovate-bot, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request systematically updates the Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the pillow dependency to version 12.1.1 to address a security vulnerability. However, this is a major version upgrade which drops support for Python 3.9. As many of the projects in this repository still support Python 3.9, this upgrade will cause build failures. I have left critical comments on all affected requirements.txt files detailing the issue and suggesting potential solutions. Please carefully review these comments and decide on the appropriate course of action for handling Python 3.9 compatibility.
| numpy==1.26.4; python_version == '3.9' | ||
| numpy==1.24.4; python_version == '3.8' | ||
| pillow==10.4.0 | ||
| pillow==12.1.1 |
There was a problem hiding this comment.
This update to Pillow v12 introduces a breaking change. Pillow v12.0.0 and later have dropped support for Python 3.9. This project appears to support Python 3.9 (as indicated by other dependencies in this file, e.g., numpy==1.26.4; python_version == '3.9'). Upgrading to pillow==12.1.1 will cause build failures for Python 3.9 environments.
To resolve this, you could:
- Drop support for Python 3.9 in this project.
- Use version pinning to install a different version of Pillow for Python 3.9. For example:
However, this would mean not applying the security fix for Python 3.9 environments, as the fix is in v12.1.1. Please evaluate the security risk and decide on the best course of action.
pillow<12; python_version == '3.9' pillow==12.1.1; python_version > '3.9'
| numpy==2.2.4; python_version == '3.8' | ||
| numpy==2.2.4; python_version == '3.7' | ||
| pillow==10.4.0 | ||
| pillow==12.1.1 |
There was a problem hiding this comment.
This update to Pillow v12 introduces a breaking change. Pillow v12.0.0 and later have dropped support for Python 3.9. This project appears to support Python 3.9 (as indicated by other dependencies in this file, e.g., numpy==2.2.4; python_version == '3.9'). Upgrading to pillow==12.1.1 will cause build failures for Python 3.9 environments.
To resolve this, you could:
- Drop support for Python 3.9 in this project.
- Use version pinning to install a different version of Pillow for Python 3.9. For example:
However, this would mean not applying the security fix for Python 3.9 environments, as the fix is in v12.1.1. Please evaluate the security risk and decide on the best course of action.
pillow<12; python_version == '3.9' pillow==12.1.1; python_version > '3.9'
| pillow==12.1.1; python_version < '3.8' | ||
| pillow==12.1.1; python_version >= '3.8' |
There was a problem hiding this comment.
This update to Pillow v12 introduces a breaking change. Pillow v12.0.0 and later have dropped support for Python 3.9. This project appears to support Python 3.9 (as indicated by the python_version >= '3.8' marker). Upgrading to pillow==12.1.1 will cause build failures for Python 3.9 environments.
To resolve this, you could:
- Drop support for Python 3.9 in this project.
- Use version pinning to install a different version of Pillow for Python 3.9. For example:
However, this would mean not applying the security fix for Python 3.9 environments, as the fix is in v12.1.1. Please evaluate the security risk and decide on the best course of action.
pillow<12; python_version == '3.9' pillow==12.1.1; python_version > '3.9'
Also, note that the two lines for pillow can be simplified into a single line if the same version is used for all Python versions.
| pillow==12.1.1; python_version < '3.8' | ||
| pillow==12.1.1; python_version >= '3.8' |
There was a problem hiding this comment.
This update to Pillow v12 introduces a breaking change. Pillow v12.0.0 and later have dropped support for Python 3.9. This project appears to support Python 3.9 (as indicated by the python_version >= '3.8' marker). Upgrading to pillow==12.1.1 will cause build failures for Python 3.9 environments.
To resolve this, you could:
- Drop support for Python 3.9 in this project.
- Use version pinning to install a different version of Pillow for Python 3.9. For example:
However, this would mean not applying the security fix for Python 3.9 environments, as the fix is in v12.1.1. Please evaluate the security risk and decide on the best course of action.
pillow<12; python_version == '3.9' pillow==12.1.1; python_version > '3.9'
Also, note that the two lines for pillow can be simplified into a single line if the same version is used for all Python versions.
| pillow==12.1.1; python_version < '3.8' | ||
| pillow==12.1.1; python_version >= '3.8' |
There was a problem hiding this comment.
This update to Pillow v12 introduces a breaking change. Pillow v12.0.0 and later have dropped support for Python 3.9. This project appears to support Python 3.9 (as indicated by the python_version >= '3.8' marker). Upgrading to pillow==12.1.1 will cause build failures for Python 3.9 environments.
To resolve this, you could:
- Drop support for Python 3.9 in this project.
- Use version pinning to install a different version of Pillow for Python 3.9. For example:
However, this would mean not applying the security fix for Python 3.9 environments, as the fix is in v12.1.1. Please evaluate the security risk and decide on the best course of action.
pillow<12; python_version == '3.9' pillow==12.1.1; python_version > '3.9'
Also, note that the two lines for pillow can be simplified into a single line if the same version is used for all Python versions.
| pillow==12.1.1; python_version < '3.8' | ||
| pillow==12.1.1; python_version >= '3.8' |
There was a problem hiding this comment.
This update to Pillow v12 introduces a breaking change. Pillow v12.0.0 and later have dropped support for Python 3.9. This project appears to support Python 3.9 (as indicated by the python_version >= '3.8' marker). Upgrading to pillow==12.1.1 will cause build failures for Python 3.9 environments.
To resolve this, you could:
- Drop support for Python 3.9 in this project.
- Use version pinning to install a different version of Pillow for Python 3.9. For example:
However, this would mean not applying the security fix for Python 3.9 environments, as the fix is in v12.1.1. Please evaluate the security risk and decide on the best course of action.
pillow<12; python_version == '3.9' pillow==12.1.1; python_version > '3.9'
Also, note that the two lines for pillow can be simplified into a single line if the same version is used for all Python versions.
| pillow==12.1.1; python_version < '3.8' | ||
| pillow==12.1.1; python_version >= '3.8' |
There was a problem hiding this comment.
This update to Pillow v12 introduces a breaking change. Pillow v12.0.0 and later have dropped support for Python 3.9. This project appears to support Python 3.9 (as indicated by the python_version >= '3.8' marker). Upgrading to pillow==12.1.1 will cause build failures for Python 3.9 environments.
To resolve this, you could:
- Drop support for Python 3.9 in this project.
- Use version pinning to install a different version of Pillow for Python 3.9. For example:
However, this would mean not applying the security fix for Python 3.9 environments, as the fix is in v12.1.1. Please evaluate the security risk and decide on the best course of action.
pillow<12; python_version == '3.9' pillow==12.1.1; python_version > '3.9'
Also, note that the two lines for pillow can be simplified into a single line if the same version is used for all Python versions.
| pillow==12.1.1; python_version < '3.8' | ||
| pillow==12.1.1; python_version >= '3.8' |
There was a problem hiding this comment.
This update to Pillow v12 introduces a breaking change. Pillow v12.0.0 and later have dropped support for Python 3.9. This project appears to support Python 3.9 (as indicated by the python_version >= '3.8' marker). Upgrading to pillow==12.1.1 will cause build failures for Python 3.9 environments.
To resolve this, you could:
- Drop support for Python 3.9 in this project.
- Use version pinning to install a different version of Pillow for Python 3.9. For example:
However, this would mean not applying the security fix for Python 3.9 environments, as the fix is in v12.1.1. Please evaluate the security risk and decide on the best course of action.
pillow<12; python_version == '3.9' pillow==12.1.1; python_version > '3.9'
Also, note that the two lines for pillow can be simplified into a single line if the same version is used for all Python versions.
| pillow==12.1.1; python_version < '3.8' | ||
| pillow==12.1.1; python_version >= '3.8' |
There was a problem hiding this comment.
This update to Pillow v12 introduces a breaking change. Pillow v12.0.0 and later have dropped support for Python 3.9. This project appears to support Python 3.9 (as indicated by the python_version >= '3.8' marker). Upgrading to pillow==12.1.1 will cause build failures for Python 3.9 environments.
To resolve this, you could:
- Drop support for Python 3.9 in this project.
- Use version pinning to install a different version of Pillow for Python 3.9. For example:
However, this would mean not applying the security fix for Python 3.9 environments, as the fix is in v12.1.1. Please evaluate the security risk and decide on the best course of action.
pillow<12; python_version == '3.9' pillow==12.1.1; python_version > '3.9'
Also, note that the two lines for pillow can be simplified into a single line if the same version is used for all Python versions.
| pillow==12.1.1; python_version < '3.8' | ||
| pillow==12.1.1; python_version >= '3.8' |
There was a problem hiding this comment.
This update to Pillow v12 introduces a breaking change. Pillow v12.0.0 and later have dropped support for Python 3.9. This project appears to support Python 3.9 (as indicated by the python_version >= '3.8' marker). Upgrading to pillow==12.1.1 will cause build failures for Python 3.9 environments.
To resolve this, you could:
- Drop support for Python 3.9 in this project.
- Use version pinning to install a different version of Pillow for Python 3.9. For example:
However, this would mean not applying the security fix for Python 3.9 environments, as the fix is in v12.1.1. Please evaluate the security risk and decide on the best course of action.
pillow<12; python_version == '3.9' pillow==12.1.1; python_version > '3.9'
Also, note that the two lines for pillow can be simplified into a single line if the same version is used for all Python versions.
2 participants
This PR contains the following updates:
==10.4.0→==12.1.1==9.5.0→==12.1.1GitHub Vulnerability Alerts
CVE-2026-25990
Impact
An out-of-bounds write may be triggered when loading a specially crafted PSD image. Pillow >= 10.3.0 users are affected.
Patches
Pillow 12.1.1 will be released shortly with a fix for this.
Workarounds
Image.open()has aformatsparameter that can be used to prevent PSD images from being opened.References
Pillow 12.1.1 will add release notes at https://pillow.readthedocs.io/en/stable/releasenotes/index.html
Release Notes
python-pillow/Pillow (pillow)
v12.1.1Compare Source
v12.1.0Compare Source
https://pillow.readthedocs.io/en/stable/releasenotes/12.1.0.html
Deprecations
Documentation
Dependencies
Testing
ResourceWarnings inselftest.py#9332 [@hugovk]Type hints
Other changes
v12.0.0Compare Source
https://pillow.readthedocs.io/en/stable/releasenotes/12.0.0.html
Removals
Deprecations
Documentation
Dependencies
Testing
Type hints
Other changes
v11.3.0Compare Source
https://pillow.readthedocs.io/en/stable/releasenotes/11.3.0.html
Deprecations
Documentation
Makefile#8933 [@hugovk]Dependencies
Testing
matchparameter topytest.warns()#9038 [@hugovk]Type hints
Other changes
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Never, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.