Skip to content

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Jul 1, 2025

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
pillow (changelog) 11.2.112.1.1 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2025-48379

There is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space.

This only affects users who save untrusted data as a compressed DDS image.

  • Unclear how large the potential write could be. It is likely limited by process segfault, so it's not necessarily deterministic. It may be practically unbounded.
  • Unclear if there's a restriction on the bytes that could be emitted. It's likely that the only restriction is that the bytes would be emitted in chunks of 8 or 16.

This was introduced in Pillow 11.2.0 when the feature was added.

CVE-2026-25990

Impact

An out-of-bounds write may be triggered when loading a specially crafted PSD image. Pillow >= 10.3.0 users are affected.

Patches

Pillow 12.1.1 will be released shortly with a fix for this.

Workarounds

Image.open() has a formats parameter that can be used to prevent PSD images from being opened.

References

Pillow 12.1.1 will add release notes at https://pillow.readthedocs.io/en/stable/releasenotes/index.html


Release Notes

python-pillow/Pillow (pillow)

v12.1.1

Compare Source

v12.1.0

Compare Source

https://pillow.readthedocs.io/en/stable/releasenotes/12.1.0.html

Deprecations
Documentation
Dependencies
Testing
Type hints
Other changes

v12.0.0

Compare Source

https://pillow.readthedocs.io/en/stable/releasenotes/12.0.0.html

Removals

Deprecations

Documentation

Dependencies

Testing

Type hints

Other changes

v11.3.0

Compare Source

https://pillow.readthedocs.io/en/stable/releasenotes/11.3.0.html

Deprecations

Documentation

Dependencies

Testing

Type hints

Other changes


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the dependencies Pull requests that update a dependency file label Jul 1, 2025
@renovate renovate bot requested a review from eigenein as a code owner July 1, 2025 22:13
@renovate renovate bot added the dependencies Pull requests that update a dependency file label Jul 1, 2025
@codecov
Copy link

codecov bot commented Jul 1, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.70%. Comparing base (085c4a6) to head (7cf62f1).

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #172   +/-   ##
=======================================
  Coverage   92.70%   92.70%           
=======================================
  Files          33       33           
  Lines         891      891           
  Branches       49       49           
=======================================
  Hits          826      826           
  Misses         47       47           
  Partials       18       18           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@renovate renovate bot force-pushed the renovate/pypi-pillow-vulnerability branch from 37425c4 to 7faad6a Compare August 10, 2025 12:38
@renovate renovate bot force-pushed the renovate/pypi-pillow-vulnerability branch from 7faad6a to c0fd940 Compare February 2, 2026 14:56
@renovate renovate bot force-pushed the renovate/pypi-pillow-vulnerability branch from c0fd940 to 7cf62f1 Compare February 11, 2026 17:41
@renovate renovate bot changed the title OPT: Update dependency pillow to v11.3.0 [SECURITY] OPT: Update dependency pillow to v12 [SECURITY] Feb 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants