diff options
| author | Mathieu Velten <mathieuv@matrix.org> | 2023-09-18 15:01:23 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-09-18 15:01:23 +0200 |
| commit | 4663d555021ce53c57e418eb1ee4445eab276bc4 (patch) | |
| tree | 86eb32ab8f6cc54121742148a8268879a8110a98 | |
| parent | Bump pillow from 10.0.0 to 10.0.1 (#16344) (diff) | |
| download | synapse-4663d555021ce53c57e418eb1ee4445eab276bc4.tar.xz | |
Mandate Pillow>=10.0.1 because of libwebp CVE (#16347)
| -rw-r--r-- | changelog.d/16347.misc | 1 | ||||
| -rw-r--r-- | pyproject.toml | 4 |
2 files changed, 4 insertions, 1 deletions
diff --git a/changelog.d/16347.misc b/changelog.d/16347.misc new file mode 100644 index 0000000000..f4f5bfb2de --- /dev/null +++ b/changelog.d/16347.misc @@ -0,0 +1 @@ +Pillow 10.0.1 is now mandatory because of libwebp CVE-2023-4863, since Pillow provides libwebp in the wheels. diff --git a/pyproject.toml b/pyproject.toml index ea2d75fa8c..9c9a5dc2bc 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -180,7 +180,9 @@ PyYAML = ">=3.13" pyasn1 = ">=0.1.9" pyasn1-modules = ">=0.0.7" bcrypt = ">=3.1.7" -Pillow = ">=5.4.0" +# 10.0.1 minimum is mandatory here because of libwebp CVE-2023-4863. +# Packagers that already took care of libwebp can lower that down to 5.4.0. +Pillow = ">=10.0.1" # We use SortedDict.peekitem(), which was added in sortedcontainers 1.5.2. sortedcontainers = ">=1.5.2" pymacaroons = ">=0.13.0" |