https://github.com/wikimedia/pywikibot/security/dependabot/10
Impact
An out-of-bounds write may be triggered when loading a specially crafted PSD image. Pillow >= 10.3.0 users are affected. Pillow 12.1.1 is a fix for this.
Workaround
Image.open() has a formats parameter that can be used to prevent PSD images from being opened.
| Subject | Author | Repo | Branch | Lines +/- | |
|---|---|---|---|---|---|
| requirements: Prefer Pillow 12.1.1 or above | Xqt | pywikibot/core | master | +36 -11 |
Change #1241139 had a related patch set uploaded (by Xqt; author: Xqt):
[pywikibot/core@master] requirements: Prefer Pillow 12.1.1 or above
Change #1241139 merged by jenkins-bot:
[pywikibot/core@master] requirements: Prefer Pillow 12.1.1 or above