chore(deps): bump pillow from 12.2.0 to 12.3.0 - #6069
Conversation
Bumps [pillow](https://github.com/python-pillow/Pillow) from 12.2.0 to 12.3.0. - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@12.2.0...12.3.0) --- updated-dependencies: - dependency-name: pillow dependency-version: 12.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
🔵 Review postedLast updated: 2026-08-01 01:07 UTC |
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
PR #6069 — pillow 12.2.0 → 12.3.0, patch bump of a production dependency (exact-pinned in requirements.in, regenerated in requirements.txt). CI passing (Python unit tests, linting, browser smoke test).
Security fixes — this is the substance of the release: CVE-2026-55798 (ImageShow.WindowsViewer command injection), CVE-2026-54059/54060/55379 (decompression bombs in FontFile subclasses), CVE-2026-55380 (decompression bomb in GdImageFile), plus unassigned fixes for OOB writes in Image.crop()/paste()/alpha_composite() and RankFilter, OOB reads in McIdas and TGA-RLE save, an EPS infinite loop, and a JPEG2000 memory blowup.
Breaking changes — present upstream, none reachable here: non-image ImageCms modes removed, 1-mode TGA RLE save path removed, ImageCmsTransform now raises on mode mismatch. Neither ImageCms, PdfParser, ImageShow, ImageFont/FontFile, GdImageFile, nor ImageFilter is imported anywhere in this repo.
Behavioral changes to note: PdfStream.decode() now caps at ImageFile.SAFEBLOCK (no PdfParser usage here), and ImageGrab.grab() gained scale_down (not used). More relevant: resample was rewritten in C for up to 5.6x speedups — that backs Image.thumbnail() and Image.resize(), which Studio calls in contentcuration/contentcuration/utils/files.py and utils/assessment/base.py. Pure upside, but it's the one hot path where a silent change would show up; green unit tests are the evidence against it.
Peer/transitive changes: none — single-line lockfile diff.
No code changes required.
@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly
How was this generated?
Ran a dependency-update review pipeline over the version bump:
- Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
- Extracted the changelog and release notes across the version range
- Assessed compatibility with this project's usage and whether any code changes are required
- Treated CI as the primary safety net
- Scaled the review depth to the update's risk
- Chose the verdict from semver risk, changelog findings, and CI status
1 participant
Bumps pillow from 12.2.0 to 12.3.0.
Release notes
Sourced from pillow's releases.
... (truncated)
Commits
bb1d8e812.3.0 version bumpe63fc48Add release notes for SBOM and performance improvements (#9747)13b701bAdd release notes for #96795564ca7List methodsa0920fdSpeed up ImageChops operations (#9738)07e9a6cSpeed upImage.filter()(#9736)a94578cSpeed upImage.getchannel(),Image.merge(),Image.putalpha()and `Image...53e02c4Speed upImage.fill(),Image.linear_gradient()and `Image.radial_gradient...af03747Speed upImage.resample()(#9739)5c9ca56Speed upalpha_composite,matrix,negative,quantize(#9740)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)