summary refs log tree commit diff
path: root/pyproject.toml
diff options
context:
space:
mode:
authorMathieu Velten <mathieuv@matrix.org>2023-09-18 15:01:23 +0200
committerGitHub <noreply@github.com>2023-09-18 15:01:23 +0200
commit4663d555021ce53c57e418eb1ee4445eab276bc4 (patch)
tree86eb32ab8f6cc54121742148a8268879a8110a98 /pyproject.toml
parentBump pillow from 10.0.0 to 10.0.1 (#16344) (diff)
downloadsynapse-4663d555021ce53c57e418eb1ee4445eab276bc4.tar.xz
Mandate Pillow>=10.0.1 because of libwebp CVE (#16347)
Diffstat (limited to 'pyproject.toml')
-rw-r--r--pyproject.toml4
1 files changed, 3 insertions, 1 deletions
diff --git a/pyproject.toml b/pyproject.toml
index ea2d75fa8c..9c9a5dc2bc 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -180,7 +180,9 @@ PyYAML = ">=3.13"
 pyasn1 = ">=0.1.9"
 pyasn1-modules = ">=0.0.7"
 bcrypt = ">=3.1.7"
-Pillow = ">=5.4.0"
+# 10.0.1 minimum is mandatory here because of libwebp CVE-2023-4863.
+# Packagers that already took care of libwebp can lower that down to 5.4.0.
+Pillow = ">=10.0.1"
 # We use SortedDict.peekitem(), which was added in sortedcontainers 1.5.2.
 sortedcontainers = ">=1.5.2"
 pymacaroons = ">=0.13.0"