LCORE-3161: bump Pillow 12.1.1 → 12.3.0 (CVE-2026-59205) by platex-rehor-bot · Pull Request #2195 · lightspeed-core/lightspeed-stack

platex-rehor-bot · 2026-07-21T10:44:44Z

Description

Bumps Pillow from 12.1.1 to 12.3.0 to fix CVE-2026-59205 — controlled native heap corruption in ImageCms.ImageCmsTransform.apply when the output image mode does not match the transform's declared output mode.

Changes:

Added explicit Pillow>=12.3.0 constraint in pyproject.toml (transitive dep from llama-stack/sentence-transformers)
Updated uv.lock with Pillow 12.3.0 PyPI wheel hashes (cp312 + cp313)
Updated .konflux/requirements.hashes.wheel.txt with Pillow 12.3.0 RHOAI 3.5 wheel hashes (x86_64 + aarch64)

Type of change

CVE fix
Bump-up dependent library

Tools used to create PR

Generated by: Claude Code (Claude Opus 4.6)

Related Tickets & Documents

Closes LCORE-3161
Related: LCORE-3160 (same CVE fix in rag-content)

Checklist before requesting a review

I have performed a self-review of my code.
PR has passed all pre-merge test jobs.
If it is a core feature, I have added thorough tests.

Testing

Dependency-only change (no code changes). Verified that:
- pyproject.toml constraint is syntactically correct
- uv.lock hashes match PyPI JSON API for Pillow 12.3.0
- .konflux/requirements.hashes.wheel.txt hashes match RHOAI 3.5 index for Pillow 12.3.0
- CI will validate the full dependency resolution

coderabbitai · 2026-07-21T10:44:52Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 2e95058b-3ca1-42b5-beac-51e7abf20264

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

✨ Simplify code

Create PR with simplified code

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

tisnik · 2026-07-21T11:11:27Z

/ok-to-test

LCORE-3161 Pillow <12.3.0 has controlled native heap corruption in ImageCms.ImageCmsTransform.apply when output image mode mismatches the transform's declared output mode. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

platex-rehor-bot · 2026-07-29T09:13:34Z

Rebased on top of the latest release/0.5 (picked up Konflux references update and cherry picker config changes). All GitHub Actions CI is re-running. Konflux build needs /ok-to-test to re-trigger.

platex-rehor-bot · 2026-07-29T10:25:41Z

/ok-to-test

platex-rehor-bot · 2026-07-29T13:15:10Z

CI Note: Ruff failure is pre-existing on the base branch

The ruff CI check is failing with 562 errors (418× UP045, plus BLE001, SIM117, etc.). These are not introduced by this PR — this PR only modifies pyproject.toml, uv.lock, and .konflux/requirements.hashes.wheel.txt (no Python source files changed).

Root cause: The CI workflow runs uv tool run ruff check . without pinning the ruff version. Ruff 0.16.0 expanded its default rule set to include rules like UP045 (Optional[X] → X | None), SIM102/SIM117, BLE001, etc. that were not previously in the defaults. The same 562 errors reproduce on upstream/release/0.5 directly.

This affects all PRs targeting release/0.5 until the base branch either pins the ruff version or updates the config/code to satisfy the new rules.

platex-rehor-bot · 2026-07-29T13:23:03Z

The build-pr check failed due to a transient network error — litellm==1.82.6 download timed out during the container image build. This is unrelated to the PR changes. Could a maintainer please re-run the failed job? The Konflux check also appears to be stuck in QUEUED state since this morning.

tisnik · 2026-07-29T13:24:55Z

/ok-to-test

Hyperkid123 · 2026-07-30T08:19:59Z

@platex-rehor-bot new information about CVE fixes is available; can you follow up, please?

are-ces · 2026-07-30T08:32:46Z

@platex-rehor-bot Hey new info available, try again

LCORE-3161 Previous hashes were from RHOAI 3.5 index. Updated to match the RHOAI 3.4 cpu-ubi9 index which the release/0.5 branch uses per profiles.toml. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

platex-rehor-bot · 2026-07-30T08:52:12Z

Thanks for the heads up @Hyperkid123 @are-ces! Pillow 12.3.0 is now available in the RHOAI 3.4 index — updated the .konflux/requirements.hashes.wheel.txt with the correct hashes from the 3.4 cpu-ubi9 index (the previous hashes were from the 3.5 index, which caused the Konflux build to fail on hash verification).

Pushed commit 200532e. CI should re-run automatically.

/ok-to-test

Hyperkid123 · 2026-07-30T11:37:17Z

/ok-to-test

openshift-ci Bot added the ok-to-test label Jul 21, 2026

fix(deps): bump Pillow 12.1.1 → 12.3.0 (CVE-2026-59205)

ef1f0eb

LCORE-3161 Pillow <12.3.0 has controlled native heap corruption in ImageCms.ImageCmsTransform.apply when output image mode mismatches the transform's declared output mode. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

platex-rehor-bot force-pushed the bot/LCORE-3161 branch from b8a69ed to ef1f0eb Compare July 29, 2026 09:12

fix(deps): use RHOAI 3.4 index hashes for Pillow 12.3.0

200532e

LCORE-3161 Previous hashes were from RHOAI 3.5 index. Updated to match the RHOAI 3.4 cpu-ubi9 index which the release/0.5 branch uses per profiles.toml. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

LCORE-3161: bump Pillow 12.1.1 → 12.3.0 (CVE-2026-59205) - #2195

LCORE-3161: bump Pillow 12.1.1 → 12.3.0 (CVE-2026-59205)#2195
platex-rehor-bot wants to merge 2 commits into
lightspeed-core:release/0.5from
platex-rehor-bot:bot/LCORE-3161

platex-rehor-bot commented Jul 21, 2026

Uh oh!

coderabbitai Bot commented Jul 21, 2026 •

edited

Loading

Review skipped

Uh oh!

tisnik commented Jul 21, 2026

Uh oh!

platex-rehor-bot commented Jul 29, 2026

Uh oh!

platex-rehor-bot commented Jul 29, 2026

Uh oh!

platex-rehor-bot commented Jul 29, 2026

Uh oh!

platex-rehor-bot commented Jul 29, 2026

Uh oh!

tisnik commented Jul 29, 2026

Uh oh!

Hyperkid123 commented Jul 30, 2026

Uh oh!

are-ces commented Jul 30, 2026

Uh oh!

platex-rehor-bot commented Jul 30, 2026

Uh oh!

Hyperkid123 commented Jul 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

platex-rehor-bot commented Jul 21, 2026

Description

Type of change

Tools used to create PR

Related Tickets & Documents

Checklist before requesting a review

Testing

Uh oh!

coderabbitai Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

tisnik commented Jul 21, 2026

Uh oh!

platex-rehor-bot commented Jul 29, 2026

Uh oh!

platex-rehor-bot commented Jul 29, 2026

Uh oh!

platex-rehor-bot commented Jul 29, 2026

CI Note: Ruff failure is pre-existing on the base branch

Uh oh!

platex-rehor-bot commented Jul 29, 2026

Uh oh!

tisnik commented Jul 29, 2026

Uh oh!

Hyperkid123 commented Jul 30, 2026

Uh oh!

are-ces commented Jul 30, 2026

Uh oh!

platex-rehor-bot commented Jul 30, 2026

Uh oh!

Hyperkid123 commented Jul 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

coderabbitai Bot commented Jul 21, 2026 •

edited

Loading