chore(deps): update dependency pillow to v12 [security] by renovate[bot] · Pull Request #4 · bradwindy/nzimageapi-lambda

renovate · 2026-07-08T22:49:57Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
Pillow (changelog)	`==11.` → `==12.`

Pillow affected by out-of-bounds write when loading PSD images

BIT-pillow-2026-25990 / CVE-2026-25990 / GHSA-cfh3-3jmp-rvhc

More information

Details

Impact

An out-of-bounds write may be triggered when loading a specially crafted PSD image. Pillow >= 10.3.0 users are affected.

Patches

Pillow 12.1.1 will be released shortly with a fix for this.

Workarounds

Image.open() has a formats parameter that can be used to prevent PSD images from being opened.

References

Pillow 12.1.1 will add release notes at https://pillow.readthedocs.io/en/stable/releasenotes/index.html

Severity

CVSS Score: 8.6 / 10 (High)
Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Pillow has a heap buffer overflow with nested list coordinates

BIT-pillow-2026-42309 / CVE-2026-42309 / GHSA-5xmw-vc9v-4wf2

More information

Details

Passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This was introduced in Pillow 11.2.1.

Severity

CVSS Score: 5.1 / 10 (Medium)
Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)

BIT-pillow-2026-42311 / CVE-2026-42311 / GHSA-pwv6-vv43-88gr

More information

Details

Impact

Processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution.

Patches

Patched version: 12.2.0

Pillow 12.1.1 addressed CVE-2026-25990 by adding checks for tile extents in PSD image decoding/encoding to prevent an out-of-bounds write. However, the bounds checks computed tile extent sums using types susceptible to integer overflow, meaning a PSD image with carefully chosen tile dimensions could produce values that wrap around and bypass the checks, still triggering an out-of-bounds write in src/decode.c and src/encode.c. The fix avoids adding extents together before comparison.

Workarounds

Use any version but affected versions: >= 10.3.0, < 12.2.0

Resources

Fix: https://github.com/python-pillow/Pillow/pull/9520
Original issue: CVE-2026-25990 (Pillow 12.1.1)

Severity

CVSS Score: 8.6 / 10 (High)
Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Pillow has a PDF Parsing Trailer Infinite Loop (DoS)

BIT-pillow-2026-42310 / CVE-2026-42310 / GHSA-r73j-pqj5-w3x7

More information

Details

Impact

An attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive.

Patches

Patched version: 12.2.0.

PdfParser (introduced in Pillow 4.2.0) follows Prev pointers in PDF trailers to read cross-reference sections. If a
trailer's Prev pointer references an offset that has already been processed — either pointing to itself or forming a
longer cycle — the parser enters an infinite loop. Pillow now tracks previously processed trailer offsets and raises an
error if a cycle is detected.

Workarounds

Use any version but the affected versions: >= 4.2.0, < 12.2.0

Resources

Fix: https://github.com/python-pillow/Pillow/pull/9519

Severity

CVSS Score: 5.1 / 10 (Medium)
Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

FITS GZIP decompression bomb in Pillow

BIT-pillow-2026-40192 / CVE-2026-40192 / GHSA-whj4-6x5x-4v2j

More information

Details

Impact

Pillow did not limit the amount of GZIP-compressed data read when decoding a FITS image, making it vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation).

Patches

The amount of data read is now limited to the necessary amount.
Fixed in Pillow 12.2.0 (PR #9521).

Workarounds

Avoid Pillow >= 10.3.0, < 12.2.0
Only open specific image formats, excluding FITS.

Severity

CVSS Score: 8.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Pillow has an integer overflow when processing fonts

BIT-pillow-2026-42308 / CVE-2026-42308 / GHSA-wjx4-4jcj-g98j / PYSEC-2026-165

More information

Details

If a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This has been fixed.

Severity

CVSS Score: 5.1 / 10 (Medium)
Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

BIT-pillow-2026-42308 / CVE-2026-42308 / GHSA-wjx4-4jcj-g98j / PYSEC-2026-165

More information

Details

Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.

Severity

CVSS Score: 5.5 / 10 (Medium)
Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

Release Notes

python-pillow/Pillow (Pillow)

`v12.3.0`

Compare Source

https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html

Removals

Remove non-image ImageCms modes #9697 [@radarhere]

Documentation

Add release notes for SBOM and performance improvements #9747 [@radarhere]
Add security release notes #9741 [@radarhere]
Add release notes for Python 3.15 beta wheels #9696 [@radarhere]
ImageFont can also be used with ImageText #9597 [@radarhere]
Additional guidelines for security reports #9659 [@wiredfool]
Fixed typo #9636 [@radarhere]
Added CVEs to 12.2.0 release notes #9591 [@radarhere]
Revise development support information in README #9583 [@aclark4life]
Add INCIDENT_RESPONSE.md #9555 [@aclark4life]
Add STRIDE threat model to security docs #9562 [@aclark4life]
Add CVEs to 12.2.0 release notes #9556 [@radarhere]
Update README with revised security policy #9553 [@radarhere]
Update security policy #9552 [@aclark4life]
Update macOS tested Python versions #9534 [@radarhere]

Dependencies

Update dependency harfbuzz to v14.2.1 #9720 [@renovate[bot]]
Update dependency mypy to v2 #9653 [@renovate[bot]]
Update dependency cibuildwheel to v4 #9665 [@renovate[bot]]
Update github-actions #9655 [@renovate[bot]]
Update dependency libavif to v1.4.2 #9652 [@renovate[bot]]
Update dependency lcms2 to v2.19.1 #9651 [@renovate[bot]]
Update dependency check-jsonschema to v0.37.2 #9650 [@renovate[bot]]
Update google/oss-fuzz digest to d872252 #9614 [@renovate[bot]]
Update dependency lcms2 to v2.19 #9609 [@renovate[bot]]
Update dependency libpng to v1.6.58 - autoclosed #9608 [@renovate[bot]]
Update dependency harfbuzz to v14 #9610 [@renovate[bot]]
Update dependency mypy to v1.20.2 #9599 [@renovate[bot]]
Update github-actions #9611 [@renovate[bot]]
Update dependency cibuildwheel to v3.4.1 #9607 [@renovate[bot]]
Move dependency versions to single JSON and enable Renovate #9559 [@hugovk]
Updated raqm to 0.10.5 #9557 [@radarhere]
Update dependency cibuildwheel to v3.4.0 #9532 [@renovate[bot]]

Testing

Remove matrix.os from benchmark #9735 [@radarhere]
Remove references to libavif patch #9734 [@radarhere]
Add benchmark tests #9654 [@akx]
Use reshape() instead of setting NumPy array shape directly #9728 [@radarhere]
Add dependencies.json to Windows cache key #9721 [@radarhere]
Increase AVIF test epsilon for loong64 #9714 [@wszqkzqk]
Add colour to Linux and Windows wheel build logs #9677 [@hugovk]
Do not test NumPy against Python 3.15 Windows AMD64 wheels #9674 [@radarhere]
Run pyroma in tox -e lint instead of pytest #9670 [@hugovk]
Update Ghostscript to 10.7.1 #9634 [@radarhere]
Update free-threading CI #9625 [@hugovk]
Increase AVIF test epsilon for riscv64 #9606 [@radarhere]
Add Fedora 44 #9594 [@radarhere]
Test Ubuntu 26.04 LTS (Resolute Raccoon) #9587 [@hugovk]
Skip EPS test_1 for Ghostscript 10.06.0 #9588 [@radarhere]
Catch subprocess.CalledProcessError in test_grab_x11 #9578 [@radarhere]
Correct feature name #9542 [@radarhere]
Skip test if FreeType is not available #9540 [@radarhere]
Remove type hint ignore #9538 [@radarhere]
Update macOS tested Python versions #9534 [@radarhere]
Remove Debian 12 and Fedora 42 from CI #9530 [@hugovk]
Remove manylinux2014 and Amazon Linux 2 #9528 [@radarhere]

Type hints

Use NumPy 2.4.6 for mypy #9705 [@radarhere]
Update dependency mypy to v2 #9653 [@renovate[bot]]
Update putpixel type hint to allow lists in xy #9585 [@radarhere]
Remove type hint ignore #9538 [@radarhere]

Other changes

Speed up ImageChops operations #9738 [@akx]
Speed up Image.filter() #9736 [@akx]
Speed up Image.getchannel(), Image.merge(), Image.putalpha() and Image.split() #9675 [@akx]
Speed up Image.fill(), Image.linear_gradient() and Image.radial_gradient(). #9737 [@akx]
Speed up Image.resample() #9739 [@akx]
Speed up alpha_composite, matrix, negative, quantize #9740 [@akx]
Remove PyErr_Clear() of "weird" exceptions #9730 [@radarhere]
Check realloc return value #9722 [@radarhere]
Add max_length to PdfStream decode() #9718 [@radarhere]
Return early when there is no fill region #9732 [@radarhere]
Allow error to be raised if PyDict_SetItemString fails #9731 [@radarhere]
Speed up Image.blend() #9649 [@akx]
Raise OverflowError if number of vertices is too large for Path #9729 [@radarhere]
Remove unused HSV and LAB matrix conversion from C #9724 [@radarhere]
Prevent reusing ImagingDecoderObject.setimage #9656 [@Serotav]
Raise ValueError if FPX tile size is not 64px by 64px #9660 [@radarhere]
Only clear error if it is BufferError #9727 [@radarhere]
Apply XOR mask to 1 and L mode CUR images #9641 [@radarhere]
Do not raise error from unknown channel ID when parsing PSD layers #9644 [@radarhere]
Raise ValueError if P;2L or P;4L data is truncated in frombytes() #9725 [@radarhere]
Embed SBOM into wheels #9679 [@hugovk]
Do not set eval() globals in ImageMath.unsafe_eval() #9576 [@radarhere]
Add Tcl/Tk license to wheels #9663 [@radarhere]
Ensure map stride is at least one full row of pixels #9719 [@radarhere]
Raise OverflowError if text width exceeds INT_MAX #9717 [@radarhere]
Raise error if image modes do not match ImageCms transform modes #9715 [@radarhere]
Use int64_t for text height #9716 [@radarhere]
Return if error occurs in Py_mod_exec slot #9712 [@radarhere]
Add decompression bomb checks to FontFile classes #9711 [@radarhere]
If C error is raised, return NULL #9706 [@radarhere]
Prevent saving 1 mode images as TGA with run-length encoding #9709 [@radarhere]
Raise ValueError if EPS BeginBinary bytecount is negative #9708 [@radarhere]
Do not DECREF tuple until tuple items are no longer used #9707 [@radarhere]
Do not update NumPy automatically #9713 [@radarhere]
Simplified code #9642 [@radarhere]
If realloc fails, do not reduce block size #9702 [@radarhere]
DECREF PyDict_GetItemRef result #9701 [@radarhere]
Use int64_t to calculate paste box dimensions #9703 [@radarhere]
Calculate JPEG2000 total_component_width for each tile in isolation #9704 [@radarhere]
Raise ValueError if value is not bytes for TIFF_BYTE or TIFF_ASCII tag #9699 [@radarhere]
Release Py_Buffer on error #9698 [@radarhere]
Use os.startfile() in WindowsViewer show_file() #9692 [@radarhere]
Validate large filter sizes when initializing RankFilter #9695 [@radarhere]
Add decompression bomb check to GdImageFile #9693 [@radarhere]
Free image bands when an error occurs while splitting an image #9694 [@radarhere]
Check PyList_Append return value #9690 [@radarhere]
Check WebPMuxNew return value #9689 [@radarhere]
Check PyCapsule_New return value #9691 [@radarhere]
Do not return negative width for text length #9623 [@radarhere]
Add args argument to METH_NOARGS methods #9687 [@radarhere]
Check ImagingNewDirty return value #9688 [@radarhere]
Use int64_t for text width #9686 [@radarhere]
Move PyDateTime_IMPORT inside Py_mod_exec slot #9580 [@radarhere]
Validate size and rank when initializing RankFilter #9661 [@radarhere]
Raise ValueError if insufficient data is read from DDS RGB file #9405 [@radarhere]
Correct IFDRational.__float__() return value #9676 [@nyxst4ck]
Correct length when accessing ImagePath.Path subscript #9685 [@radarhere]
Release reference on non-flattened sequence error #9684 [@radarhere]
Do not release Py_buffer until buf is no longer in use #9683 [@radarhere]
Do not resize macOS retina screenshots by default #9266 [@radarhere]
Add abstract BaseImageFont class #9595 [@radarhere]
Cast before multiplying #9678 [@radarhere]
Limit radius to half width or height of rounded rectangle #9561 [@radarhere]
linesize is always xsize multiplied by pixelsize #9647 [@radarhere]
Check annotate_hash_table return value #9572 [@radarhere]
Catch KeyError when checking mode from PNG IHDR chunk #9604 [@radarhere]
Only pass one argument to C expand #9664 [@radarhere]
Raise error if declared JPEG2000 marker length is too small #9666 [@radarhere]
In _dump(), use Python PPM save, instead of C #9566 [@radarhere]
Raise error consistently from inside ImagingNewArrow #9571 [@radarhere]
Simplify RankFilter.c check #9662 [@radarhere]
Support opening and saving L mode AVIF images with libavif >= 1.3.0 #9471 [@radarhere]
[pre-commit.ci] pre-commit autoupdate #9648 [@pre-commit-ci[bot]]
Apply libtiff patch to fix CVE-2026-4775 #9646 [@radarhere]
Remove duplicate code #9640 [@radarhere]
Switch iOS back to macos-26-intel #9631 [@radarhere]
Don't use list as default in PdfParser read_prev_trailer #9629 [@danigm]
Add support for Python 3.15 #9624 [@radarhere]
Do not draw line or arc if width is zero #9589 [@radarhere]
Use _accept check in WebP _open #9605 [@radarhere]
Compare dist sizes vs latest PyPI release #9621 [@hugovk]
Do not generate SBOM in scheduled run on fork #9620 [@radarhere]
Use plugin method directly when saving PDFs #9547 [@radarhere]
[pre-commit.ci] pre-commit autoupdate #9617 [@pre-commit-ci[bot]]
Set Renovate prCreation to not-pending #9616 [@radarhere]
Raise error if PNG transparency has incorrect type or length when saving #9536 [@radarhere]
If PdfParser buffer is memoryview, release it when closing #9596 [@radarhere]
Correct integer overflow in 16-bit resampling #9480 [@hayatoikoma]
SBOM: Use real versions from dependencies.json #9593 [@hugovk]
Restrict SBOM upload to only Pillow JSON #9598 [@radarhere]
Generate CycloneDX SBOM at release time via CI #9550 [@aclark4life]
Raise ValueError if ImageOps border has unsupported format #9426 [@veeceey]
Unsafe pointer dereference from unchecked Python integer in Tk initialization #9548 [@barttran2k]
Reorder renovate.json #9565 [@radarhere]
Add python-pillow GitHub Sponsors to FUNDING.yml #9563 [@aclark4life]
Correct environment URL #9558 [@radarhere]
Remove or protect secrets in Actions #9544 [@pre-commit-ci[bot]]
Move Homebrew dependencies into Brewfile #9546 [@hugovk]
Do not precompute horizontal coefficients if not horizontal resizing #9543 [@radarhere]
Fix comparison warnings #9541 [@radarhere]
Close PdfParser if error occurs during init #9539 [@radarhere]
Drop experimental Python 3.13 free-threaded wheels #9535 [@radarhere]
Update github-actions #9533 [@renovate[bot]]

`v12.2.0`

Compare Source

https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html

Documentation

Update 12.2.0 release notes #9522 [@hugovk]
Add loader plugins: AMOS abk, Atari Degas, 40+ more obscure formats via Netpbm #9482 [@bitplane]
Update Python versions #9515 [@radarhere]
Jeffrey A. Clark -> Jeffrey 'Alex' Clark #9513 [@aclark4life]
Add release notes for #9394, #9419 and #9456 #9467 [@radarhere]
Add Amiga Workbench .info loader to 3rd party plugins list #9459 [@bitplane]
Merge PFM documentation into PPM #9434 [@radarhere]
Update macOS tested Pillow versions #9431 [@radarhere]
Fix CVE number #9430 [@hugovk]

Dependencies

Update xz to 5.8.3 #9523 [@radarhere]
Update libjpeg-turbo to 3.1.4.1 #9507 [@radarhere]
Update libpng to 1.6.56 #9499 [@radarhere]
Update freetype to 2.14.3 #9485 [@radarhere]
Updated libavif to 1.4.1 #9479 [@radarhere]
Updated harfbuzz to 13.2.1 #9461 [@radarhere]
Update Ghostscript to 10.7.0 #9469 [@radarhere]
Update harfbuzz to 13.0.1 #9453 [@radarhere]
Update libavif to 1.4.0 #9460 [@radarhere]
Update freetype to 2.14.2 #9449 [@radarhere]
Update actions/download-artifact action to v8 #9451 [@renovate[bot]]
Updated libpng to 1.6.55 #9425 [@radarhere]

Testing

Cleanup .spider extension in the same test where it is added #9517 [@radarhere]
Run tests in parallel via tox for 3.5x speedup #9516 [@hugovk]
Enable colour in CI logs #9486 [@hugovk]
Update Ghostscript to 10.7.0 #9469 [@radarhere]
Simplify TGA test code #9477 [@radarhere]
Update tests to check for ValueError when encoding an empty image #9464 [@radarhere]
Upgrade CI from macos-15-intel to macos-26-intel #9454 [@hugovk]
Add check-case-conflict hook #9446 [@radarhere]
Specify platform when pulling docker image #9440 [@radarhere]
GHA: Cache libavif and webp builds for Ubuntu #9437 [@hugovk]
Update macOS tested Pillow versions #9431 [@radarhere]

Other changes

Check calloc return value #9527 [@radarhere]
Check all allocs in the Arrow tree #9488 [@wiredfool]
Reject non-numeric elements inside list coords #9526 [@hugovk]
Move variable declaration inside define #9525 [@radarhere]
Resize tall images vertically first #9524 [@radarhere]
Avoid overflow by not adding extents together #9520 [@hugovk]
Use long for glyph position #9518 [@hugovk]
Raise an error if the trailer chain loops back on itself #9519 [@hugovk]
Only read as much data from gzip-decompressed data as necessary #9521 [@hugovk]
Allow None extents in C setimage() #9504 [@radarhere]
Use critical sections to protect FontObject #9498 [@colesbury]
Add ImageText.Text.wrap() to wrap text #9286 [@radarhere]
Always call StubHandler open() when opening StubImageFile #9412 [@radarhere]
Improved BCn overflow check #9043 [@radarhere]
Image will never be None #9512 [@radarhere]
Raise EOFError when seeking too far in PSD #9388 [@radarhere]
Raise error if ImageGrab subprocess gives non-zero returncode #9321 [@radarhere]
Allow for different palette entry sizes when correcting BMP pixel data offset #9472 [@radarhere]
Ignore unspecified extra samples for TIFF separate planar configuration #9514 [@radarhere]
Add PERF to lint and fix findings #9510 [@hugovk]
Switch iOS back to macos-15-intel #9509 [@radarhere]
Catch struct.error #9505 [@radarhere]
Check PyCapsule_GetPointer and PyBytes_FromStringAndSize return values #9508 [@radarhere]
Fix missing null dereference checks #9489 [@wiredfool]
CI: Retry failed downloads #9506 [@hugovk]
Use PyModule_AddObjectRef #9503 [@radarhere]
Release reference to encoder on error #9500 [@radarhere]
Fixed AVIF and WEBP dealloc #9501 [@radarhere]
Check PyType_Ready return values #9502 [@radarhere]
Check if PyObject_CallMethod result is NULL #9494 [@radarhere]
Do not use palette from grayscale or bilevel colorspace when reading JPEG2000 images #9468 [@radarhere]
If TGA v2 extension area specifies no alpha, fill alpha channel #9478 [@radarhere]
Set image pixels individually on 32-bit Windows #9492 [@radarhere]
Add error messages before returning NULL when encoding #9493 [@radarhere]
Fix _getxy refcount leaks #9487 [[@hugovk](https://redirect.github.com/h

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Pacific/Auckland)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

…nstant-time auth, input validation (#31) * fix: address code-review findings (races, SSRF, constant-time auth, input validation) Web app (collection-reviewer-web): - Route progress writes through the existing write mutex so /api/sync and /api/progress no longer race and clobber the progress index (#1). - Give atomicWrite a unique per-write temp name + failure cleanup, so concurrent writers can't collide on a shared *.tmp and leave a partial write / ENOENT crash (#4). - Validate and clamp the /api/images count param (parseImageCount): a non-numeric value no longer silently yields 0 images, and a huge value can't spawn unbounded concurrent lambda fetches (#2). - Clamp a stale/out-of-range progress index in mergeCollections (remapProgress) instead of silently resetting the reviewer to 0 (#5). - Guard await request.json() in the decision + progress routes so a malformed body returns 400 instead of a raw 500 (#7). Swift API Lambda: - constantTimeEquals now reduces each operand to a fixed 32-byte SHA-256 digest before the XOR compare, removing the secret-length timing leak from the previous early length-mismatch return (#6). Converter Lambda: - Enforce an http/https scheme allowlist, re-validate every redirect target against internal IP ranges (IMDS / loopback / RFC1918) while still permitting the legitimate public S3 redirect, and return generic error bodies instead of echoing raw exceptions (#3). Tests: add Vitest plus web unit tests (atomicWrite, remapProgress, parseImageCount, progress mutex, JSON-body guards); extend AuthorizedConsumerTests with unequal-length cases; extend the converter pytest suite with scheme/redirect SSRF and error-opacity coverage. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019YqwmybDadEYqqfDMrHvxs * fix: reject null/primitive JSON bodies in decision + progress routes CodeRabbit review: request.json() returns null (or a bare primitive) without throwing for a body like "null" or "42"; the subsequent destructuring then threw a TypeError outside the try/catch, yielding a 500 instead of the intended 400. Add an explicit non-null-object guard before destructuring in both write routes, and cover it with valid-JSON "null" body tests. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019YqwmybDadEYqqfDMrHvxs --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

renovate Bot added the dependencies Pull requests that update a dependency file label Jul 8, 2026

renovate Bot force-pushed the renovate/pypi-pillow-vulnerability branch from e24a7e4 to 3a4215b Compare July 9, 2026 00:54

chore(deps): update dependency pillow to v12 [security]

8444b73

renovate Bot force-pushed the renovate/pypi-pillow-vulnerability branch from 3a4215b to 8444b73 Compare July 9, 2026 01:30

bradwindy merged commit 98d2f79 into main Jul 9, 2026
3 checks passed

renovate Bot deleted the renovate/pypi-pillow-vulnerability branch July 9, 2026 02:55

Navigation Menu

Repository navigation

chore(deps): update dependency pillow to v12 [security] - #4

chore(deps): update dependency pillow to v12 [security]#4
bradwindy merged 1 commit into
mainfrom
renovate/pypi-pillow-vulnerability

renovate Bot commented Jul 8, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pillow affected by out-of-bounds write when loading PSD images

Details

Impact

Patches

Workarounds

References

Severity

References

Pillow has a heap buffer overflow with nested list coordinates

Details

Severity

References

Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)

Details

Impact

Patches

Workarounds

Resources

Severity

References

Pillow has a PDF Parsing Trailer Infinite Loop (DoS)

Details

Impact

Patches

Workarounds

Resources

Severity

References

FITS GZIP decompression bomb in Pillow

Details

Impact

Patches

Workarounds

Severity

References

Pillow has an integer overflow when processing fonts

Details

Severity

References

BIT-pillow-2026-42308 / CVE-2026-42308 / GHSA-wjx4-4jcj-g98j / PYSEC-2026-165

Details

Severity

References

Release Notes

v12.3.0

Removals

Documentation

Dependencies

Testing

Type hints

Other changes

v12.2.0

Documentation

Dependencies

Testing

Other changes

Configuration

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Jul 8, 2026 •

edited

Loading

`v12.3.0`

`v12.2.0`