fix: bump pillow to 12.3.0 to resolve known vulnerabilities - #14
Open
pauliano22 wants to merge 1 commit into
Open
fix: bump pillow to 12.3.0 to resolve known vulnerabilities#14pauliano22 wants to merge 1 commit into
pauliano22 wants to merge 1 commit into
Conversation
pillow 12.2.0 has multiple published advisories (decompression-bomb bypasses in font/image parsers, an EPS parser infinite loop, native heap out-of-bounds writes, and a shell command injection in WindowsViewer), all fixed in 12.3.0. Verified the new version installs cleanly and matplotlib (which depends on it for PNG output) still renders and saves plots correctly. torch 2.11.0 also has a known advisory (PYSEC-2025-194, fixed in 2.13.0), but bumping it isn't included here: it's a two-minor-version jump that could affect torch/triton==3.6.0 compatibility, and this environment has no GPU to verify the CUDA kernels/benchmarks still run correctly afterward. Flagging it for a manual bump + GPU test. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AENMp3aP1tD6sfEwmwH5bz
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
pillow12.2.0 has several published advisories fixed in 12.3.0: decompression-bomb-check bypasses in the font/GD/PCF/BDF parsers, an EPS parser infinite-loop DoS, native heap out-of-bounds writes (coordinate handling, rank filter, TGA RLE encoder), a JPEG2000 tile-size integer issue, and a shell command injection inWindowsViewer.get_command().results/*.png), so this is a low-risk patch bump.Not included:
torch2.11.0 also has a known advisory (PYSEC-2025-194, fixed in 2.13.0). I didn't bump it because it's a two-minor-version jump that could affect compatibility with the pinnedtriton==3.6.0, and this environment has no GPU available to verify the CUDA kernels and benchmarks still run correctly afterward. Worth a manual bump + test on the H100 box when convenient.Test plan
pip install pillow==12.3.0installs cleanly🤖 Generated with Claude Code
https://claude.ai/code/session_01AENMp3aP1tD6sfEwmwH5bz
Generated by Claude Code