Bump pillow to 12.3.0 to resolve Dependabot alerts - #42
Conversation
Fixes all 13 open Dependabot alerts (uv.lock), which are all Pillow < 12.3.0 advisories: heap OOB writes (Image.paste/crop, RankFilter, ImageCmsTransform.apply), OOB read on the mmap path, decompression-bomb check bypasses in font/Gd/Pdf loaders, JPEG2000 scratch-buffer DoS, EPS infinite loop, TGA RLE heap-data leak, and WindowsViewer command injection. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 12def9ccac
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| [[package]] | ||
| name = "pillow" | ||
| version = "12.2.0" | ||
| version = "12.3.0" |
There was a problem hiding this comment.
This PR changes only uv.lock, so the changelog job in .github/workflows/changelog.yml lines 15–21 will unconditionally exit 1 because CHANGELOG.md is absent from the diff. This also violates the repository's AGENTS.md requirement that every PR add one line under [Unreleased]; add an entry for the Pillow upgrade so the required check can pass.
Useful? React with 👍 / 👎.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
1 participant
Summary
Upgrades the transitive
pillowdependency from 12.2.0 to 12.3.0 inuv.lock(uv lock --upgrade-package pillow). This resolves all 13 open Dependabot alerts, which are all Pillow < 12.3.0 advisories:Image.paste()/Image.crop()coordinate overflow (Clean up README for launch #14),ImageFilter.RankFilterviaImagingExpand(Export issues #12),ImageCmsTransform.apply()output mode mismatch (Add slide capture command for per-slide PNG export #17)BdfFontFile(Improve live preview and slide authoring ergonomics #9),FontFile.compile()(Add diagram support #8),PcfFontFile._load_bitmaps()(Pre-launch #7),GdImageFile._open()(Improve mobile presentation experience #10),PdfParser.PdfStream.decode()(Enable typographic dashes and smart quotes #15)%%BeginBinaryinfinite loop (Major overhaul: experimental PPTX export, title layouts, footer nav, and rendering fixes #5)WindowsViewer.get_command()command injection (Improve mobile navigation, figure captions, and box callouts #11)Testing
uv sync --all-extrassucceedsuv run pytest: 236 passedPIL.__version__confirms 12.3.0🤖 Generated with Claude Code