Skip to content

ci(deps): update pillow requirement from >=12.2.0 to >=12.3.0 in /constraints #1483

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
neuron7xLab merged 2 commits into from
Jul 8, 2026
Merged

ci(deps): update pillow requirement from >=12.2.0 to >=12.3.0 in /constraints #1483

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c6d717f
ci(deps): update pillow requirement in /constraints
dependabot[bot] Jul 4, 2026
c9314df
fix(deps): relock after pillow constraint bump
neuron7xLab Jul 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion constraints/security.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,7 +123,7 @@ Brotli>=1.2.0
# Vulnerable: >= 10.3.0, < 12.2.0. Pillow enters the install tree via
# scientific/ML extras (e.g. torchvision-adjacent paths). Pin the floor
# here so transitive resolution cannot regress below the fix line.
pillow>=12.2.0
pillow>=12.3.0

# Security floors — CVE remediation (pip-audit 2026-06-19).
# tornado: GHSA-3x9g-8vmp-wqvf, GHSA-cx3h-4qpv-8hc9, GHSA-mgf9-4vpg-hj56, GHSA-pw6j-qg29-8w7f
Expand Down
65 changes: 61 additions & 4 deletions requirements-dev.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,8 @@ anyio==4.11.0
# via
# httpx
# starlette
arrow==1.4.0
# via isoduration
async-timeout==5.0.1
# via aiokafka
attrs==25.4.0
Expand All @@ -55,6 +57,8 @@ black==26.3.1
# via geosync (pyproject.toml)
blinker==1.9.0
# via streamlit
boolean-py==5.0
# via license-expression
bracex==2.6
# via cibuildwheel
build==1.3.0
Expand All @@ -80,6 +84,8 @@ cffi==2.0.0
# via
# cryptography
# pycares
chardet==5.2.0
# via cyclonedx-bom
charset-normalizer==3.4.4
# via
# -c constraints/security.txt
Expand Down Expand Up @@ -118,8 +124,14 @@ cuda-pathfinder==1.5.2
# via cuda-bindings
cuda-toolkit[cublas,cudart,cufft,cufile,cupti,curand,cusolver,cusparse,nvjitlink,nvrtc,nvtx]==13.0.2
# via torch
cyclonedx-bom==7.3.0
# via geosync (pyproject.toml)
cyclonedx-python-lib[validation]==11.11.0
# via cyclonedx-bom
deap==1.4.3
# via geosync (pyproject.toml)
defusedxml==0.7.1
# via py-serializable
dependency-groups==1.3.1
# via cibuildwheel
docutils==0.22.2
Expand All @@ -141,6 +153,8 @@ filelock==3.20.3
# torch
flake8==7.1.1
# via geosync (pyproject.toml)
fqdn==1.5.1
# via jsonschema
frozenlist==1.8.0
# via
# aiohttp
Expand Down Expand Up @@ -190,6 +204,7 @@ idna==3.18
# -c constraints/security.txt
# anyio
# httpx
# jsonschema
# requests
# yarl
import-linter==2.11
Expand All @@ -198,6 +213,8 @@ importlib-metadata==8.7.0
# via opentelemetry-api
iniconfig==2.1.0
# via pytest
isoduration==20.11.0
# via jsonschema
isort==5.13.2
# via geosync (pyproject.toml)
jaraco-classes==3.4.0
Expand Down Expand Up @@ -230,22 +247,33 @@ joblib==1.5.2
# via
# geosync (pyproject.toml)
# scikit-learn
jsonschema==4.25.1
# via altair
jsonpointer==3.1.1
# via jsonschema
jsonschema[format-nongpl]==4.25.1
# via
# altair
# cyclonedx-python-lib
# geosync (pyproject.toml)
jsonschema-specifications==2025.9.1
# via jsonschema
keyring==25.6.0
# via twine
korean-lunar-calendar==0.3.1
# via exchange-calendars
lark==1.3.1
# via rfc3987-syntax
libcst==1.7.0
# via mutmut
librt==0.9.0
# via mypy
license-expression==30.4.4
# via cyclonedx-python-lib
linkify-it-py==2.0.3
# via markdown-it-py
llvmlite==0.46.0
# via numba
lxml==6.1.1
# via cyclonedx-python-lib
mako==1.3.12
# via
# -c constraints/security.txt
Expand Down Expand Up @@ -392,17 +420,23 @@ opt-einsum==3.4.0
# via jax
optuna==3.6.2
# via geosync (pyproject.toml)
packageurl-python==0.17.6
# via
# cyclonedx-bom
# cyclonedx-python-lib
packaging==25.0
# via
# aiokafka
# altair
# black
# build
# cibuildwheel
# cyclonedx-bom
# dependency-groups
# hydra-core
# optuna
# pandera
# pip-requirements-parser
# pytest
# pytest-rerunfailures
# strawberry-graphql
Expand All @@ -424,11 +458,13 @@ pathspec==1.0.0
# via
# black
# mypy
pillow==12.2.0
pillow==12.3.0
# via
# -c constraints/security.txt
# captcha
# streamlit
pip-requirements-parser==32.0.1
# via cyclonedx-bom
pip-tools==7.5.1
# via geosync (pyproject.toml)
platformdirs==4.5.0
Expand Down Expand Up @@ -466,6 +502,8 @@ psycopg-binary==3.2.11
# via psycopg
py-cpuinfo==9.0.0
# via pytest-benchmark
py-serializable==2.1.0
# via cyclonedx-python-lib
py-spy==0.4.1
# via geosync (pyproject.toml)
pyarrow==24.0.0
Expand Down Expand Up @@ -514,6 +552,8 @@ pyjwt[crypto]==2.13.0
# streamlit-authenticator
pyluach==2.3.0
# via exchange-calendars
pyparsing==3.3.2
# via pip-requirements-parser
pyproject-hooks==1.2.0
# via
# build
Expand Down Expand Up @@ -553,6 +593,7 @@ pytest-xdist==3.8.0
# via geosync (pyproject.toml)
python-dateutil==2.9.0.post0
# via
# arrow
# pandas
# strawberry-graphql
python-dotenv==1.2.2
Expand Down Expand Up @@ -580,6 +621,7 @@ redis==7.0.0
# via geosync (pyproject.toml)
referencing==0.37.0
# via
# cyclonedx-python-lib
# jsonschema
# jsonschema-specifications
requests==2.34.2
Expand All @@ -594,8 +636,14 @@ requests==2.34.2
# twine
requests-toolbelt==1.0.0
# via twine
rfc3339-validator==0.1.4
# via jsonschema
rfc3986==2.0.0
# via twine
rfc3986-validator==0.1.1
# via jsonschema
rfc3987-syntax==1.1.0
# via jsonschema
rich==14.2.0
# via
# bandit
Expand Down Expand Up @@ -630,12 +678,15 @@ six==1.17.0
# via
# pytest-profiling
# python-dateutil
# rfc3339-validator
smmap==5.0.2
# via gitdb
sniffio==1.3.1
# via anyio
sortedcontainers==2.4.0
# via hypothesis
# via
# cyclonedx-python-lib
# hypothesis
sqlalchemy==2.0.51
# via
# -c constraints/security.txt
Expand Down Expand Up @@ -703,6 +754,7 @@ typing-extensions==4.15.0
# anyio
# ccxt
# cross-web
# cyclonedx-python-lib
# fastapi
# grimp
# grpcio
Expand Down Expand Up @@ -737,10 +789,13 @@ typing-inspection==0.4.2
# pydantic-settings
tzdata==2025.2
# via
# arrow
# exchange-calendars
# pandas
uc-micro-py==1.0.3
# via linkify-it-py
uri-template==1.3.0
# via jsonschema
urllib3==2.7.0
# via
# -c constraints/security.txt
Expand All @@ -750,6 +805,8 @@ uvicorn==0.49.0
# via geosync (pyproject.toml)
watchdog==6.0.0
# via streamlit
webcolors==25.10.0
# via jsonschema
websockets==15.0.1
# via geosync (pyproject.toml)
wheel==0.47.0
Expand Down
2 changes: 1 addition & 1 deletion requirements-scan.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@ optuna==3.6.2
packaging==25.0
pandas==2.3.3
pandera==0.32.0
pillow==12.2.0
pillow==12.3.0
prometheus-client==0.25.0
propcache==0.4.1
protobuf==6.33.5
Expand Down
2 changes: 1 addition & 1 deletion requirements.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -310,7 +310,7 @@ pandera==0.32.0
# via
# -c constraints/security.txt
# geosync (pyproject.toml)
pillow==12.2.0
pillow==12.3.0
# via
# -c constraints/security.txt
# captcha
Expand Down
Loading