Skip to content

[AI Generated] BugFix: bump Pillow and requests for security fixes#4481

Open
LiliDeng wants to merge 2 commits into
mainfrom
security/vulnerability-fixes_140526_120315
Open

[AI Generated] BugFix: bump Pillow and requests for security fixes#4481
LiliDeng wants to merge 2 commits into
mainfrom
security/vulnerability-fixes_140526_120315

Conversation

@LiliDeng
Copy link
Copy Markdown
Collaborator

@LiliDeng LiliDeng commented May 14, 2026

Summary

Bump dependency caps to pull in security-fixed releases:

  • Pillow: <= 12.0.0 → <= 12.1.1 (fixes GHSA-cfh3-3jmp-rvhc)
  • requests: ~= 2.32.4 → ~= 2.33.0 on Python >= 3.10; keep ~= 2.32.4 on Python 3.9 (since requests 2.33+ requires Python >= 3.10) (fixes GHSA-gc5v-m9x4-r6x2)

Validation

Built installers/Dockerfile.linux against this branch in a test workflow and verified package versions:

Package Required Installed
Pillow >= 12.1.1 OK
requests >= 2.33.0 OK
cryptography >= 46.0.7 OK (48.0.0, transitive)
PyJWT >= 2.12.0 OK (2.12.0, from Azure CLI apt package)
azcopy >= 10.32.4 FAIL (10.32.3, blocked on aka.ms redirect; out of scope)

Copilot AI review requested due to automatic review settings May 14, 2026 12:05
@LiliDeng LiliDeng requested a review from johnsongeorge-w as a code owner May 14, 2026 12:05
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates Python dependency constraints to pull security-fixed dependency versions during installation.

Changes:

  • Splits requests constraints by Python version to use 2.33.x on Python >= 3.10.
  • Raises the Azure optional dependency cap for Pillow to <= 12.1.1.

Comment thread pyproject.toml
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants