Repository navigation
fix(deps): bump pillow to 12.2.0 for CVE-2026-25990 - #2187
Conversation
![devin-ai-integration[bot]](/web-api/iframe-proxy?url=https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](/web-api/iframe-proxy?url=https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bd5874b082
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "loguru>=0.6.0,<0.8", | ||
| "prompt-toolkit==3.0.52", | ||
| "pillow==12.1.0", | ||
| "pillow==12.2.0", |
There was a problem hiding this comment.
This dependency/security fix changes the released package contents, but the project remains at 1.41.0. The repo instruction in AGENTS.md says, “Minor version is bumped for any change: new features, improvements, bug fixes, etc.” and “Patch version is always 0,” so this change should also bump the root package version (and the lockfile package metadata) to the next minor before release.
Useful? React with 👍 / 👎.
|
Fix issue #2153 |
Pillow 12.1.0 has an out-of-bounds write when loading PSD images (CVE-2026-25990); 12.2.0 contains the fix. Closes MoonshotAI#2153.
bd5874b to
fe9da03
Compare
|
Codex Review: Didn't find any major issues. What shall we delve into next? ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
fe9da03 to
a9350df
Compare
2 participants
Summary
pillowfrom 12.1.0 → 12.2.0 to address CVE-2026-25990 (out-of-bounds write when loading PSD images), which blocks installs in security-tight environments.Closes #2153.
Test plan
uv lockregenerates cleanlyprek run(format + check) passes locally