Skip to content

v0.4.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Oct 14:46
· 3 commits to main since this release
v0.4.2
d030050

Security

  • Pillow — Locked pillow to 13.0.0, fixing 41 open Dependabot alerts (#77–#119, excluding #86 and #117), including critical heap overflows in FPX/JPEG decoding, TIFF encoder use-after-free, and Ghostscript argument injection (RCE), plus multiple decompression-bomb bypasses and DoS issues.
  • filelock — Locked filelock to 4.2.4, fixing Dependabot #120–#122 (SQLite lock-database symlink/journal handling, Windows SoftFileLock oplock timeout, ReadWriteLock side-file issues).
  • setuptools — Locked setuptools to 84.2.1, fixing Dependabot #117 (Windows path escape via namespace_packages.txt).
  • certifi — Locked certifi to 2026.10.23, fixing Dependabot #86 (compromised emSign intermediate CA keys).
  • Dependency overrides — [tool.uv] override-dependencies pins pillow>=13.0.0 and filelock>=4.2.1, because the latest fastembed (0.9.0) caps pillow<13.0 and the latest litellm (1.106.3) caps filelock<4.0. Remove the overrides once upstream releases relax these caps. Published package metadata is unchanged.
  • Known limitation for PyPI users — The overrides apply only to this repository's uv.lock. Installs of ct-toolkit[ml] (via fastembed) or ct-toolkit[vision] resolve Pillow from PyPI metadata, so they can still receive Pillow 12.x (affected by the Pillow Dependabot alerts) until fastembed relaxes its pillow<13.0 cap. Users who need the fix now can pin pillow>=13.0.0 in their own environment after confirming their fastembed setup works with it. Filelock 4.x is similarly constrained by litellm for PyPI installs.

Validation

  • Automated Tests: 426 passed, 3 skipped (uv run --locked --all-extras pytest tests).
  • Smoke Tests: FastEmbed embedding (BAAI/bge-small-en-v1.5), LiteLLM import, FileLock acquire/release, and Pillow PNG roundtrip.

Full Changelog: v0.4.1...v0.4.2

Assets 5
Loading