docs: list all 8 C extensions in security threat model diagram

aclark4life · Copilot · aclark4life · commit 114e4d569530 · 2026-04-21T11:22:58.000-04:00
Co-authored-by: Copilot &lt;223556219+Copilot@users.noreply.github.com&gt;
diff --git a/docs/handbook/security.rst b/docs/handbook/security.rst
@@ -28,7 +28,10 @@ boundary between untrusted image input and the Pillow API.
                     │  ImageShow.show(image)  ─────────────────┼──► os.system / subprocess
                     │  EpsImagePlugin.open(eps)  ──────────────┼──► Ghostscript (gs)
                     └──────────────┬───────────────────────────┘
-                                   │ C extension (_imaging)
+                                   │ C extensions:
+                                   │  _imaging · _imagingft · _imagingcms
+                                   │  _webp · _avif · _imagingtk
+                                   │  _imagingmath · _imagingmorph
                                    ▼
                     ┌──────────────────────────────────────────┐
                     │  C libraries (bundled or system)         │
