fix(deps): bump Pillow 12.1.1 → 12.3.0 (CVE-2026-59205)

platex-rehor-bot · claude · platex-rehor-bot · commit b8a69edbccc1 · 2026-07-21T10:44:18.000Z
LCORE-3161
Pillow &lt;12.3.0 has controlled native heap corruption in
ImageCms.ImageCmsTransform.apply when output image mode
mismatches the transform's declared output mode.

Co-Authored-By: Claude Opus 4.6 &lt;noreply@anthropic.com&gt;
diff --git a/.konflux/requirements.hashes.wheel.txt b/.konflux/requirements.hashes.wheel.txt
@@ -211,9 +211,9 @@ pandas==3.0.2 \
     --hash=sha256:adf5d48f0407c277ebf624b35ae45313b4f6def71cb27a786b84c6189dcb93b3
 peft==0.19.1 \
     --hash=sha256:d0b98d5a5a456c0445495fca64be52f985e0dfff57c4f72020d92c0dc3eb9f08
-pillow==12.2.0 \
-    --hash=sha256:1d14bc0f26c4f17eae2bddfe2700bcc922c5e19bebad32145a52445ad0b2909d \
-    --hash=sha256:394981fc7445b3721bc5dd88b5859050eedfa51e307a986fdf832d2145555f59
+pillow==12.3.0 \
+    --hash=sha256:292ad662c4a21daa5c557816bd36870c036fcb32f1863a474725c9a48db317f2 \
+    --hash=sha256:e803d1800d5fb6ed2fbbb8d1aa4a42f1f9080ed98b6f929646b920330031f6b1
 polyleven==0.11.0 \
     --hash=sha256:952335347f97afe6477d325af4ba62d01806ec728f69bc22dee6908466d4cea3 \
     --hash=sha256:fac5592f992760680817f73c7b18b1a82151d37410584454aa162d2010b587fb
diff --git a/pyproject.toml b/pyproject.toml
@@ -70,6 +70,7 @@ dependencies = [
     "pyasn1>=0.6.3", # LCORE-1490
     # Used for system prompt template variable rendering
     "jinja2>=3.1.0",
+    "Pillow>=12.3.0",  # CVE-2026-59205
     # To be able to fix multiple CVEs, also LCORE-1117
     "requests>=2.33.0",
 ]
diff --git a/uv.lock b/uv.lock

Original file line number	Diff line number	Diff line change
`@@ -70,6 +70,7 @@ dependencies = [`
`70`	`70`	`"pyasn1>=0.6.3", # LCORE-1490`
`71`	`71`	`# Used for system prompt template variable rendering`
`72`	`72`	`"jinja2>=3.1.0",`
	`73`	`+ "Pillow>=12.3.0", # CVE-2026-59205`
`73`	`74`	`# To be able to fix multiple CVEs, also LCORE-1117`
`74`	`75`	`"requests>=2.33.0",`
`75`	`76`	`]`