Skip to content

deps: bump all dependencies to latest versions #20

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
GeiserX merged 1 commit into from
Apr 27, 2026
Merged

deps: bump all dependencies to latest versions #20

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions config/requirements-dev.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
-r requirements.txt
pytest>=7.4.0
pytest>=8.3.5
pytest-cov>=4.1.0
pytest-mock>=3.11.1
black>=23.7.0
pytest-mock>=3.15.1
black>=25.1.0
flake8>=6.1.0
mypy>=1.5.0
mypy>=1.15.0


16 changes: 8 additions & 8 deletions config/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
requests>=2.31.0
beautifulsoup4>=4.12.0
minify-html>=0.18.0
requests>=2.32.5
beautifulsoup4>=4.14.3
minify-html>=0.18.1
cssmin>=0.2.0
rjsmin>=1.2.2
Pillow>=10.0.0
lxml>=4.9.0
urllib3>=2.0.0
python-dotenv>=1.0.0
rjsmin>=1.2.5
Pillow>=11.2.1
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify advisory ranges for Pillow directly from OSV (read-only, no repo access needed)
set -euo pipefail

curl -s https://api.osv.dev/v1/query -H 'Content-Type: application/json' -d '{
  "package": {"name":"Pillow","ecosystem":"PyPI"},
  "version":"11.2.1"
}' | jq '.vulns[] | {id, summary, aliases, affected: [.affected[]?.ranges[]?.events[]?]}'

Repository: GeiserX/Wayback-Archive

Length of output: 1338

🌐 Web query:

CVE-2025-48379 Pillow severity

💡 Result:

The severity of CVE-2025-48379 in Pillow is rated as HIGH by the CVE Numbering Authority (CNA, GitHub) with CVSS 3.1 base score 7.1 (Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), and MEDIUM by NIST NVD with CVSS 3.1 base score 5.5 (Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). This heap buffer overflow occurs when writing large (>64KB) compressed DDS images due to insufficient buffer space checks, affecting Pillow versions 11.2.0 to before 11.3.0. It was fixed in 11.3.0.

Citations:

🌐 Web query:

CVE-2026-25990 Pillow PSD severity

💡 Result:

CVE-2026-25990 is an out-of-bounds write vulnerability in the Pillow Python imaging library when loading specially crafted PSD images. It affects versions from 10.3.0 to before 12.1.1 and was fixed in 12.1.1. Severity ratings vary by CVSS version: - CVSS v3.1 (NVD): Base Score 7.5 (HIGH), Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS v4.0 (GitHub/CNA): Base Score 8.9 (HIGH), Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P - CVSS v4.0 (Tenable): Base Score 9.3 (CRITICAL), Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Citations:

🌐 Web query:

CVE-2026-40192 Pillow FITS GZIP severity

💡 Result:

The severity of CVE-2026-40192, a vulnerability in the Pillow Python imaging library related to FITS GZIP decompression bombs, is rated as HIGH. The NVD lists a CVSS v3.1 base score of 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, and a CVSS v4.0 base score of 7.5 (HIGH) with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. The GitHub security advisory also rates it as High. It affects Pillow versions 10.3.0 through 12.1.1, allowing denial of service via unbounded memory consumption from specially crafted FITS files. Fixed in 12.2.0.

Citations:

Bump Pillow to 12.2.0 or later to address multiple HIGH vulnerabilities.

Pillow 11.2.1 is affected by at least three HIGH-severity vulnerabilities:

Update to 12.2.0 or later to address all three.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@config/requirements.txt` at line 6, Update the Pillow dependency line in
requirements.txt (the entry "Pillow>=11.2.1") to require at least version 12.2.0
(e.g., change to "Pillow>=12.2.0") so the project pulls a release that includes
fixes for CVE-2025-48379, CVE-2026-25990 and CVE-2026-40192; ensure the updated
version constraint is committed to the same requirements.txt entry.

lxml>=5.4.0
urllib3>=2.6.3
python-dotenv>=1.2.1


Loading