chore(deps): bump pillow from 12.2.0 to 12.3.0 in /envs/wildfire_env - #997
chore(deps): bump pillow from 12.2.0 to 12.3.0 in /envs/wildfire_env#997dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [pillow](https://github.com/python-pillow/Pillow) from 12.2.0 to 12.3.0. - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@12.2.0...12.3.0) --- updated-dependencies: - dependency-name: pillow dependency-version: 12.3.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
python:uv
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
PR #997 — bump pillow 12.2.0 → 12.3.0 in /envs/wildfire_env (native Dependabot). Scope: a single file, envs/wildfire_env/uv.lock (lockfile only — no Python/API surface touched).
Automated Checks
- Lint: PASS for this PR.
ruff format --checkandruff checkare clean;usortflags only two pre-existing files (tests/envs/test_grid_world.py,tests/envs/test_julia_env.py) that this PR does not touch. No.py/TOML changed anduv.lockisn't linted → no lint impact. - Debug code: CLEAN for this PR.
check-debug.shhits are all pre-existing files undersrc/; none are touched here. - Lockfile integrity:
uv lock --check --project envs/wildfire_env→ PASS (156 packages resolved; lock consistent withpyproject.toml). - Hashes: verified against PyPI — sdist
3b8182…97cce(size 47025035) matches,requires-python >=3.10satisfied, not yanked.
What actually changed
Package-set diff base→head: 152 → 152 packages, 0 added, 0 removed, exactly one version change — pillow 12.2.0 → 12.3.0 (transitive, pulled in by gradio + matplotlib; not a direct dep, so lock-only with no pyproject.toml floor bump is correct). The 526-line diff is otherwise two mechanical re-lock side effects (see below), not extra dependency changes.
Security — strong positive: pillow 12.2.0 carries ~13 advisories, all fixed in 12.3.0, including CVE-2026-55798 (Windows WindowsViewer.get_command shell command injection) and several decompression-bomb fixes (CVE-2026-54059/54060/55379/55380, PDF/FontFile/GD). Merging is the right call on security grounds.
Open RFCs Context
Open RFCs: 000/001/002/003/005 (In Review), 010 (Draft). None govern packaging, dependency management, or PyPI index selection → no RFC surface is touched.
Tier 1: Fixes Required
None. The lockfile is internally consistent, hashes are genuine, and no lint/debug/syntax/type/security issues are introduced (the change is net security-positive).
Tier 2: Alignment Discussion
Principle Conflicts
ALIGNMENT FLAG: Index-source flip from the HF internal mirror to public PyPI (metadata-only)
- Principle at stake: "Container isolation for reproducibility" (PRINCIPLES.md) / declared provenance
- The concern: The re-lock rewrote every package
sourcefromhttps://pypi.registries.huggingface.tech/(HF internal mirror) tohttps://pypi.org/simple(171 entries flipped; 0 mirror refs remain). Artifact URLs remainfiles.pythonhosted.orgwith unchanged, pinned hashes, so this is almost certainly benign — but it silently changes the lock's declared provenance and widens an existing cross-env split (23 env locks still on the mirror vs. 13 now on public PyPI). No committed config pins the mirror (it appears only insideuv.lockfiles), and this env's deployDockerfileinstalls viapip install -e .(notuv sync), so nothing breaks — this is a "which index is the source of truth" policy decision, not a code fix. Not fixing it here (editing a Dependabot lockfile's registry is a team decision). - Suggested reviewer: @Darktex (reproducibility principle) / @burtenshaw (Dependabot owner)
RFC Conflicts
None identified.
Additional (process / outside this PR's diff)
- Dependabot env-scope bypass (cc @burtenshaw):
.github/dependabot.ymlwas set to "stop dependabot in envs" (#566) — theuvupdater usesdirectory: "/"+exclude-paths: ["envs/**"], yet this nativedependabot/uv/envs/wildfire_env/…PR still editsenvs/**.exclude-pathsis a valid Dependabot key, but theuvecosystem isn't honoring it here. Whether to close native env PRs like this (in favor of the aggregate roll-ups) vs. accept them is a maintainer call. - Lock revision 2→3 (
uv.lock:2): regenerated with a neweruv(format churn = most of the diff). Low-risk for this env — the Dockerfile installs withpip, notuv sync --frozen, so the base image'suvversion is irrelevant to deployment.
Summary
- 0 mechanical issues to fix (Tier 1)
- 1 alignment point for review (index-source flip) + 1 process note (Dependabot env-scope bypass) + 1 low-risk heads-up (lock revision bump)
- 0 RFC conflicts
- Net security-positive bump (clears ~13 pillow CVEs incl. CVE-2026-55798). Recommend merging the bump; treat the index-flip / scope items as a separate policy decision.
Sent by Cursor Automation: Pre-review
| @@ -1,5 +1,5 @@ | |||
| version = 1 | |||
| revision = 2 | |||
| revision = 3 | |||
There was a problem hiding this comment.
Lock format revision 2 → 3. Dependabot regenerated with a newer uv; this serialization change accounts for most of the 526-line diff. Low-risk for this env specifically — the deploy Dockerfile installs via pip install -e . (not uv sync --frozen), so the base image's uv version is irrelevant to the container build.
| @@ -17,7 +17,7 @@ resolution-markers = [ | |||
| [[package]] | |||
| name = "aiofile" | |||
| version = "3.9.0" | |||
| source = { registry = "https://pypi.registries.huggingface.tech/" } | |||
| source = { registry = "https://pypi.org/simple" } | |||
There was a problem hiding this comment.
Index-source flip (metadata only). All 171 package sources moved from the HF internal mirror (pypi.registries.huggingface.tech) to public PyPI (pypi.org/simple); 0 mirror refs remain. Artifact URLs stay on files.pythonhosted.org with unchanged pinned hashes, so it's benign, but it changes the lock's declared provenance and widens the cross-env split (23 locks still on the mirror vs. 13 now public). Registry choice is a team decision — flagging, not fixing. cc @Darktex / @burtenshaw
| { url = "https://files.pythonhosted.org/packages/c3/28/ec0fc38107fc32536908034e990c47914c57cd7c5a3ece4d8d8f7ffd7e27/pillow-12.2.0-pp311-pypy311_pp73-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4a6c9fa44005fa37a91ebfc95d081e8079757d2e904b27103f4f5fa6f0bf78c0", size = 5355404, upload-time = "2026-04-01T14:46:06.33Z" }, | ||
| { url = "https://files.pythonhosted.org/packages/5e/8b/51b0eddcfa2180d60e41f06bd6d0a62202b20b59c68f5a132e615b75aecf/pillow-12.2.0-pp311-pypy311_pp73-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:25373b66e0dd5905ed63fa3cae13c82fbddf3079f2c8bf15c6fb6a35586324c1", size = 6002215, upload-time = "2026-04-01T14:46:08.83Z" }, | ||
| { url = "https://files.pythonhosted.org/packages/bc/60/5382c03e1970de634027cee8e1b7d39776b778b81812aaf45b694dfe9e28/pillow-12.2.0-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:bfa9c230d2fe991bed5318a5f119bd6780cda2915cca595393649fc118ab895e", size = 7080946, upload-time = "2026-04-01T14:46:11.734Z" }, | ||
| version = "12.3.0" |
There was a problem hiding this comment.
The one substantive change: pillow 12.2.0 → 12.3.0 (transitive via gradio + matplotlib). Verified: sdist/wheel hashes match PyPI, requires-python >=3.10 satisfied, not yanked, and uv lock --check passes. Security-positive — 12.3.0 clears ~13 pillow advisories incl. CVE-2026-55798 (Windows command injection) and several decompression-bomb fixes.
|
Closed in favor of the env aggregate PR #921, which now includes this Dependabot update. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps pillow from 12.2.0 to 12.3.0.
Release notes
Sourced from pillow's releases.
... (truncated)
Commits
bb1d8e812.3.0 version bumpe63fc48Add release notes for SBOM and performance improvements (#9747)13b701bAdd release notes for #96795564ca7List methodsa0920fdSpeed up ImageChops operations (#9738)07e9a6cSpeed upImage.filter()(#9736)a94578cSpeed upImage.getchannel(),Image.merge(),Image.putalpha()and `Image...53e02c4Speed upImage.fill(),Image.linear_gradient()and `Image.radial_gradient...af03747Speed upImage.resample()(#9739)5c9ca56Speed upalpha_composite,matrix,negative,quantize(#9740)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Lockfile-only minor dependency bump with no repo code changes; main caveat is upstream removal of niche ImageCms modes.
Overview
Bumps the resolved Pillow version from 12.2.0 to 12.3.0 in
envs/wildfire_env(Dependabot / uv lock). No application source changes—only the environment dependency pin.Pillow remains a transitive dependency (e.g. via Gradio and Matplotlib). Upstream 12.3.0 adds image-processing performance work and drops non-image ImageCms modes, which could affect rare color-management call paths.
Reviewed by Cursor Bugbot for commit cafe880. Bugbot is set up for automated code reviews on this repo. Configure here.