Repository navigation
Conversation
…uce the vuln checker alerts. (apache#40996)
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
📋 Review Summary
This PR cleanly backports #40996 to the release-2.77.0-postrelease branch, upgrading pillow from 12.3.0 to 13.0.0 (along with a minor pip patch bump from 26.2.1 to 26.2.2 during conflict resolution) across all Python container base and GPU requirement files to address known vulnerabilities.
🔍 General Feedback
- All 9 Python container requirements files (
py311–py314base and ML/GPU images) are updated consistently and match the upstream changes in #40996. - No issues found; the backport looks good to merge.
💡 Tip: Comment /gemini review on this pull request to trigger a new Gemini code review.
|
Stopping reviewer notifications for this pull request: review requested by someone other than the bot, ceding control. If you'd like to restart, comment |
| pg8000==1.31.5 | ||
| pillow==12.3.0 | ||
| pip==26.2.1 | ||
| pillow==13.0.0 |
There was a problem hiding this comment.
it doesn't fit the requirements:
Line 430 in 1a6fce4
|
Found that postrelease branch PR doesn't automatically trigger PreCommits Running in https://github.com/apache/beam/actions/runs/42295720908 |
Update pillow version to remediate some known vulnerabitlites and reduce the vuln checker alerts. (#40996)
Merge conflict ended up changing both pillow and pypi (patch version).