search

vital-ws / vulnerable

0 stars 2 forks source link

Update dependency Pillow to v9 (test-branch) #164

Closed mend-for-github-com[bot] closed 1 year ago

mend-for-github-com[bot] commented 2 years ago

This PR contains the following updates:

Package Update Change
Pillow (source, changelog) major ==8.3.2 -> ==9.0.1

By merging this PR, the issue #149 will be automatically resolved and closed:

Severity CVSS Score CVE
High High 9.8 CVE-2022-22817
High High 9.1 CVE-2022-24303
High High 7.5 WS-2022-0097
Medium Medium 6.5 CVE-2022-22815
Medium Medium 6.5 CVE-2022-22816

Release Notes

python-pillow/Pillow ### [`v9.0.1`](https://togithub.com/python-pillow/Pillow/blob/HEAD/CHANGES.rst#​901-2022-02-03) [Compare Source](https://togithub.com/python-pillow/Pillow/compare/9.0.0...9.0.1) - In show_file, use os.remove to remove temporary images. CVE-2022-24303 [#​6010](https://togithub.com/python-pillow/Pillow/issues/6010) \[radarhere, hugovk] - Restrict builtins within lambdas for ImageMath.eval. CVE-2022-22817 [#​6009](https://togithub.com/python-pillow/Pillow/issues/6009) \[radarhere] ### [`v9.0.0`](https://togithub.com/python-pillow/Pillow/blob/HEAD/CHANGES.rst#​900-2022-01-02) [Compare Source](https://togithub.com/python-pillow/Pillow/compare/8.4.0...9.0.0) - Restrict builtins for ImageMath.eval(). CVE-2022-22817 [#​5923](https://togithub.com/python-pillow/Pillow/issues/5923) \[radarhere] - Ensure JpegImagePlugin stops at the end of a truncated file [#​5921](https://togithub.com/python-pillow/Pillow/issues/5921) \[radarhere] - Fixed ImagePath.Path array handling. CVE-2022-22815, CVE-2022-22816 [#​5920](https://togithub.com/python-pillow/Pillow/issues/5920) \[radarhere] - Remove consecutive duplicate tiles that only differ by their offset [#​5919](https://togithub.com/python-pillow/Pillow/issues/5919) \[radarhere] - Improved I;16 operations on big endian [#​5901](https://togithub.com/python-pillow/Pillow/issues/5901) \[radarhere] - Limit quantized palette to number of colors [#​5879](https://togithub.com/python-pillow/Pillow/issues/5879) \[radarhere] - Fixed palette index for zeroed color in FASTOCTREE quantize [#​5869](https://togithub.com/python-pillow/Pillow/issues/5869) \[radarhere] - When saving RGBA to GIF, make use of first transparent palette entry [#​5859](https://togithub.com/python-pillow/Pillow/issues/5859) \[radarhere] - Pass SAMPLEFORMAT to libtiff [#​5848](https://togithub.com/python-pillow/Pillow/issues/5848) \[radarhere] - Added rounding when converting P and PA [#​5824](https://togithub.com/python-pillow/Pillow/issues/5824) \[radarhere] - Improved putdata() documentation and data handling [#​5910](https://togithub.com/python-pillow/Pillow/issues/5910) \[radarhere] - Exclude carriage return in PDF regex to help prevent ReDoS [#​5912](https://togithub.com/python-pillow/Pillow/issues/5912) \[hugovk] - Fixed freeing pointer in ImageDraw.Outline.transform [#​5909](https://togithub.com/python-pillow/Pillow/issues/5909) \[radarhere] - Added ImageShow support for xdg-open [#​5897](https://togithub.com/python-pillow/Pillow/issues/5897) \[m-shinder, radarhere] - Support 16-bit grayscale ImageQt conversion [#​5856](https://togithub.com/python-pillow/Pillow/issues/5856) \[cmbruns, radarhere] - Convert subsequent GIF frames to RGB or RGBA [#​5857](https://togithub.com/python-pillow/Pillow/issues/5857) \[radarhere] - Do not prematurely return in ImageFile when saving to stdout [#​5665](https://togithub.com/python-pillow/Pillow/issues/5665) \[infmagic2047, radarhere] - Added support for top right and bottom right TGA orientations [#​5829](https://togithub.com/python-pillow/Pillow/issues/5829) \[radarhere] - Corrected ICNS file length in header [#​5845](https://togithub.com/python-pillow/Pillow/issues/5845) \[radarhere] - Block tile TIFF tags when saving [#​5839](https://togithub.com/python-pillow/Pillow/issues/5839) \[radarhere] - Added line width argument to polygon [#​5694](https://togithub.com/python-pillow/Pillow/issues/5694) \[radarhere] - Do not redeclare class each time when converting to NumPy [#​5844](https://togithub.com/python-pillow/Pillow/issues/5844) \[radarhere] - Only prevent repeated polygon pixels when drawing with transparency [#​5835](https://togithub.com/python-pillow/Pillow/issues/5835) \[radarhere] - Add support for pickling TrueType fonts [#​5826](https://togithub.com/python-pillow/Pillow/issues/5826) \[hugovk, radarhere] - Only prefer command line tools SDK on macOS over default MacOSX SDK [#​5828](https://togithub.com/python-pillow/Pillow/issues/5828) \[radarhere] - Drop support for soon-EOL Python 3.6 [#​5768](https://togithub.com/python-pillow/Pillow/issues/5768) \[hugovk, nulano, radarhere] - Fix compilation on 64-bit Termux [#​5793](https://togithub.com/python-pillow/Pillow/issues/5793) \[landfillbaby] - Use title for display in ImageShow [#​5788](https://togithub.com/python-pillow/Pillow/issues/5788) \[radarhere] - Remove support for FreeType 2.7 and older [#​5777](https://togithub.com/python-pillow/Pillow/issues/5777) \[hugovk, radarhere] - Fix for PyQt6 [#​5775](https://togithub.com/python-pillow/Pillow/issues/5775) \[hugovk, radarhere] - Removed deprecated PILLOW_VERSION, Image.show command parameter, Image.\_showxv and ImageFile.raise_ioerror [#​5776](https://togithub.com/python-pillow/Pillow/issues/5776) \[radarhere] ### [`v8.4.0`](https://togithub.com/python-pillow/Pillow/blob/HEAD/CHANGES.rst#​840-2021-10-15) [Compare Source](https://togithub.com/python-pillow/Pillow/compare/8.3.2...8.4.0) - Prefer global transparency in GIF when replacing with background color [#​5756](https://togithub.com/python-pillow/Pillow/issues/5756) \[radarhere] - Added "exif" keyword argument to TIFF saving [#​5575](https://togithub.com/python-pillow/Pillow/issues/5575) \[radarhere] - Copy Python palette to new image in quantize() [#​5696](https://togithub.com/python-pillow/Pillow/issues/5696) \[radarhere] - Read ICO AND mask from end [#​5667](https://togithub.com/python-pillow/Pillow/issues/5667) \[radarhere] - Actually check the framesize in FliDecode.c [#​5659](https://togithub.com/python-pillow/Pillow/issues/5659) \[wiredfool] - Determine JPEG2000 mode purely from ihdr header box [#​5654](https://togithub.com/python-pillow/Pillow/issues/5654) \[radarhere] - Fixed using info dictionary when writing multiple APNG frames [#​5611](https://togithub.com/python-pillow/Pillow/issues/5611) \[radarhere] - Allow saving 1 and L mode TIFF with PhotometricInterpretation 0 [#​5655](https://togithub.com/python-pillow/Pillow/issues/5655) \[radarhere] - For GIF save_all with palette, do not include palette with each frame [#​5603](https://togithub.com/python-pillow/Pillow/issues/5603) \[radarhere] - Keep transparency when converting from P to LA or PA [#​5606](https://togithub.com/python-pillow/Pillow/issues/5606) \[radarhere] - Copy palette to new image in transform() [#​5647](https://togithub.com/python-pillow/Pillow/issues/5647) \[radarhere] - Added "transparency" argument to EpsImagePlugin load() [#​5620](https://togithub.com/python-pillow/Pillow/issues/5620) \[radarhere] - Corrected pathlib.Path detection when saving [#​5633](https://togithub.com/python-pillow/Pillow/issues/5633) \[radarhere] - Added WalImageFile class [#​5618](https://togithub.com/python-pillow/Pillow/issues/5618) \[radarhere] - Consider I;16 pixel size when drawing text [#​5598](https://togithub.com/python-pillow/Pillow/issues/5598) \[radarhere] - If default conversion from P is RGB with transparency, convert to RGBA [#​5594](https://togithub.com/python-pillow/Pillow/issues/5594) \[radarhere] - Speed up rotating square images by 90 or 270 degrees [#​5646](https://togithub.com/python-pillow/Pillow/issues/5646) \[radarhere] - Add support for reading DPI information from JPEG2000 images \[rogermb, radarhere] - Catch TypeError from corrupted DPI value in EXIF [#​5639](https://togithub.com/python-pillow/Pillow/issues/5639) \[homm, radarhere] - Do not close file pointer when saving SGI images [#​5645](https://togithub.com/python-pillow/Pillow/issues/5645) \[farizrahman4u, radarhere] - Deprecate ImagePalette size parameter [#​5641](https://togithub.com/python-pillow/Pillow/issues/5641) \[radarhere, hugovk] - Prefer command line tools SDK on macOS [#​5624](https://togithub.com/python-pillow/Pillow/issues/5624) \[radarhere] - Added tags when saving YCbCr TIFF [#​5597](https://togithub.com/python-pillow/Pillow/issues/5597) \[radarhere] - PSD layer count may be negative [#​5613](https://togithub.com/python-pillow/Pillow/issues/5613) \[radarhere] - Fixed ImageOps expand with tuple border on P image [#​5615](https://togithub.com/python-pillow/Pillow/issues/5615) \[radarhere] - Fixed error saving APNG with duplicate frames and different duration times [#​5609](https://togithub.com/python-pillow/Pillow/issues/5609) \[thak1411, radarhere]