Skip to content

v2.33.3

Choose a tag to compare

View all tags
@mrbro-bot mrbro-bot released this 14 Jul 05:22
· 449 commits to main since this release
v2.33.3
2df2de9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's new

A security fix for Pillow, plus a steady stream of tooling and dependency maintenance.

Bug Fixes

Pillow's minimum version floor moves to 12.3.0, closing off resolution of versions vulnerable to five decompression-bomb / command-injection advisories (GHSA-8v84-f9pq-wr9x and related PIL PcfFontFile, FontFile, BdfFontFile, GdImageFile, and WindowsViewer issues; PYSEC-2026-2253 through 2257) that remained reachable under the previous >=12.2.0 constraint. 12.3.0 is the first Pillow release that patches all five advisories, and the bump directly addresses the OSSF Scorecard Vulnerabilities check flagged by code-scanning alert #28.

Also in this release

  • dev: update OpenCode from v1.17.14 through v1.17.18 (#599, #601, #606, #607, #608)
  • dev: update semantic-release to v25.0.6 (#619)
  • deps: update fro-bot/agent from v0.84.0 through v0.88.0 (#595, #598, #600, #602, #604, #605, #610, #613, #616)
  • deps: update bfra-me/.github to v4.16.35 and v4.16.36 (#597, #609)
  • deps: update github/codeql-action action to v4.37.0 (#596)
  • dev: update all non-major dependencies (#603)

Compare

v2.33.2...v2.33.3

Assets 2
Loading