Merge branch 'main' into progress

.appveyor.yml

@@ -1,3 +1,10 @@
+skip_commits:
+  files:
+    - ".github/**"
+    - ".gitmodules"
+    - "docs/**"
+    - "wheels/**"
+
 version: '{build}'
 clone_folder: c:\pillow
 init:
@@ -27,7 +34,7 @@ install:
 - xcopy /S /Y c:\test-images-main\* c:\pillow\tests\images
 - curl -fsSL -o nasm-win64.zip https://raw.githubusercontent.com/python-pillow/pillow-depends/main/nasm-2.16.01-win64.zip
 - 7z x nasm-win64.zip -oc:\
-- choco install ghostscript --version=10.0.0.20230317
+- choco install ghostscript --version=10.3.0
 - path c:\nasm-2.16.01;C:\Program Files\gs\gs10.00.0\bin;%PATH%
 - cd c:\pillow\winbuild\
 - ps: |

.ci/requirements-cibw.txt

@@ -1 +1 @@
-cibuildwheel==2.16.5
+cibuildwheel==2.17.0

.github/ISSUE_TEMPLATE/ISSUE_REPORT.md

@@ -48,6 +48,21 @@ Thank you.
 * Python: 
 * Pillow: 
 
+```text
+Please paste here the output of running:
+
+python3 -m PIL.report
+or
+python3 -m PIL --report
+
+Or the output of the following Python code:
+
+from PIL import report
+# or
+from PIL import features
+features.pilinfo(supported_formats=False)
+```
+
 <!--
 Please include **code** that reproduces the issue and whenever possible, an **image** that demonstrates the issue. Please upload images to GitHub, not to third-party file hosting sites. If necessary, add the image to a zip or tar archive.
 

.github/workflows/test-cygwin.yml

@@ -50,7 +50,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Install Cygwin
-        uses: egor-tensin/setup-cygwin@v4
+        uses: cygwin/cygwin-install-action@v4
         with:
           packages: >
             gcc-g++
@@ -71,7 +71,6 @@ jobs:
             make
             netpbm
             perl
-            python39=3.9.16-1
             python3${{ matrix.python-minor-version }}-cffi
             python3${{ matrix.python-minor-version }}-cython
             python3${{ matrix.python-minor-version }}-devel
@@ -89,21 +88,15 @@ jobs:
 
       - name: Select Python version
         run: |
-          ln -sf c:/tools/cygwin/bin/python3.${{ matrix.python-minor-version }} c:/tools/cygwin/bin/python3
-
-      - name: Get latest NumPy version
-        id: latest-numpy
-        shell: bash.exe -eo pipefail -o igncr "{0}"
-        run: |
-          python3 -m pip list --outdated | grep numpy | sed -r 's/ +/ /g' | cut -d ' ' -f 3 | sed 's/^/version=/' >> $GITHUB_OUTPUT
+          ln -sf c:/cygwin/bin/python3.${{ matrix.python-minor-version }} c:/cygwin/bin/python3
 
       - name: pip cache
         uses: actions/cache@v4
         with:
           path: 'C:\cygwin\home\runneradmin\.cache\pip'
-          key: ${{ runner.os }}-cygwin-pip3.${{ matrix.python-minor-version }}-numpy${{ steps.latest-numpy.outputs.version }}-${{ hashFiles('.ci/install.sh') }}
+          key: ${{ runner.os }}-cygwin-pip3.${{ matrix.python-minor-version }}-${{ hashFiles('.ci/install.sh') }}
           restore-keys: |
-            ${{ runner.os }}-cygwin-pip3.${{ matrix.python-minor-version }}-numpy${{ steps.latest-numpy.outputs.version }}-
+            ${{ runner.os }}-cygwin-pip3.${{ matrix.python-minor-version }}-
 
       - name: Build system information
         run: |
@@ -113,11 +106,6 @@ jobs:
         run: |
           bash.exe .ci/install.sh
 
-      - name: Upgrade NumPy
-        shell: dash.exe -l "{0}"
-        run: |
-          python3 -m pip install -U "numpy<1.26"
-
       - name: Build
         shell: bash.exe -eo pipefail -o igncr "{0}"
         run: |

.github/workflows/test-windows.yml

@@ -35,7 +35,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["pypy3.10", "pypy3.9", "3.8", "3.9", "3.10", "3.11", "3.12", "3.13.0-alpha.3"]
+        python-version: ["pypy3.10", "pypy3.9", "3.8", "3.9", "3.10", "3.11", "3.12", "3.13"]
 
     timeout-minutes: 30
 
@@ -86,7 +86,7 @@ jobs:
         choco install nasm --no-progress
         echo "C:\Program Files\NASM" >> $env:GITHUB_PATH
 
-        choco install ghostscript --version=10.0.0.20230317 --no-progress
+        choco install ghostscript --version=10.3.0 --no-progress
         echo "C:\Program Files\gs\gs10.00.0\bin" >> $env:GITHUB_PATH
 
         # Install extra test images

.github/workflows/wheels-dependencies.sh

@@ -16,7 +16,7 @@ ARCHIVE_SDIR=pillow-depends-main
 
 # Package versions for fresh source builds
 FREETYPE_VERSION=2.13.2
-HARFBUZZ_VERSION=8.3.0
+HARFBUZZ_VERSION=8.4.0
 LIBPNG_VERSION=1.6.43
 JPEGTURBO_VERSION=3.0.2
 OPENJPEG_VERSION=2.5.2
@@ -72,7 +72,7 @@ function build {
 
     build_simple xcb-proto 1.16.0 https://xorg.freedesktop.org/archive/individual/proto
     if [ -n "$IS_MACOS" ]; then
-        build_simple xorgproto 2023.2 https://www.x.org/pub/individual/proto
+        build_simple xorgproto 2024.1 https://www.x.org/pub/individual/proto
         build_simple libXau 1.0.11 https://www.x.org/pub/individual/lib
         build_simple libpthread-stubs 0.5 https://xcb.freedesktop.org/dist
         if [[ "$CIBW_ARCHS" == "arm64" ]]; then

.github/workflows/wheels.yml

@@ -5,6 +5,7 @@ on:
     paths:
       - ".ci/requirements-cibw.txt"
       - ".github/workflows/wheel*"
+      - "setup.py"
       - "wheels/*"
       - "winbuild/build_prepare.py"
       - "winbuild/fribidi.cmake"
@@ -14,6 +15,7 @@ on:
     paths:
       - ".ci/requirements-cibw.txt"
       - ".github/workflows/wheel*"
+      - "setup.py"
       - "wheels/*"
       - "winbuild/build_prepare.py"
       - "winbuild/fribidi.cmake"

.pre-commit-config.yaml

@@ -1,24 +1,24 @@
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.2.0
+    rev: v0.3.4
     hooks:
       - id: ruff
-        args: [--fix, --exit-non-zero-on-fix]
+        args: [--exit-non-zero-on-fix]
 
   - repo: https://github.com/psf/black-pre-commit-mirror
-    rev: 24.1.1
+    rev: 24.3.0
     hooks:
       - id: black
 
   - repo: https://github.com/PyCQA/bandit
-    rev: 1.7.7
+    rev: 1.7.8
     hooks:
     - id: bandit
       args: [--severity-level=high]
       files: ^src/
 
   - repo: https://github.com/Lucas-C/pre-commit-hooks
-    rev: v1.5.4
+    rev: v1.5.5
     hooks:
       - id: remove-tabs
         exclude: (Makefile$|\.bat$|\.cmake$|\.eps$|\.fits$|\.gd$|\.opt$)
@@ -42,6 +42,13 @@ repos:
       - id: trailing-whitespace
         exclude: ^.github/.*TEMPLATE|^Tests/(fonts|images)/
 
+  - repo: https://github.com/python-jsonschema/check-jsonschema
+    rev: 0.28.1
+    hooks:
+      - id: check-github-workflows
+      - id: check-readthedocs
+      - id: check-renovate
+
   - repo: https://github.com/sphinx-contrib/sphinx-lint
     rev: v0.9.1
     hooks:
@@ -62,5 +69,10 @@ repos:
     hooks:
       - id: tox-ini-fmt
 
+  - repo: meta
+    hooks:
+      - id: check-hooks-apply
+      - id: check-useless-excludes
+
 ci:
   autoupdate_schedule: monthly

CHANGES.rst

@@ -2,9 +2,93 @@
 Changelog (Pillow)
 ==================
 
-10.3.0 (unreleased)
+10.3.0 (2024-04-01)
 -------------------
 
+- CVE-2024-28219: Use ``strncpy`` to avoid buffer overflow #7928
+  [radarhere, hugovk]
+
+- Deprecate ``eval()``, replacing it with ``lambda_eval()`` and ``unsafe_eval()`` #7927
+  [radarhere, hugovk]
+
+- Raise ``ValueError`` if seeking to greater than offset-sized integer in TIFF #7883
+  [radarhere]
+
+- Add ``--report`` argument to ``__main__.py`` to omit supported formats #7818
+  [nulano, radarhere, hugovk]
+
+- Added RGB to I;16, I;16L, I;16B and I;16N conversion #7918, #7920
+  [radarhere]
+
+- Fix editable installation with custom build backend and configuration options #7658
+  [nulano, radarhere]
+
+- Fix putdata() for I;16N on big-endian #7209
+  [Yay295, hugovk, radarhere]
+
+- Determine MPO size from markers, not EXIF data #7884
+  [radarhere]
+
+- Improved conversion from RGB to RGBa, LA and La #7888
+  [radarhere]
+
+- Support FITS images with GZIP_1 compression #7894
+  [radarhere]
+
+- Use I;16 mode for 9-bit JPEG 2000 images #7900
+  [scaramallion, radarhere]
+
+- Raise ValueError if kmeans is negative #7891
+  [radarhere]
+
+- Remove TIFF tag OSUBFILETYPE when saving using libtiff #7893
+  [radarhere]
+
+- Raise ValueError for negative values when loading P1-P3 PPM images #7882
+  [radarhere]
+
+- Added reading of JPEG2000 palettes #7870
+  [radarhere]
+
+- Added alpha_quality argument when saving WebP images #7872
+  [radarhere]
+
+- Fixed joined corners for ImageDraw rounded_rectangle() non-integer dimensions #7881
+  [radarhere]
+
+- Stop reading EPS image at EOF marker #7753
+  [radarhere]
+
+- PSD layer co-ordinates may be negative #7706
+  [radarhere]
+
+- Use subprocess with CREATE_NO_WINDOW flag in ImageShow WindowsViewer #7791
+  [radarhere]
+
+- When saving GIF frame that restores to background color, do not fill identical pixels #7788
+  [radarhere]
+
+- Fixed reading PNG iCCP compression method #7823
+  [radarhere]
+
+- Allow writing IFDRational to UNDEFINED tag #7840
+  [radarhere]
+
+- Fix logged tag name when loading Exif data #7842
+  [radarhere]
+
+- Use maximum frame size in IHDR chunk when saving APNG images #7821
+  [radarhere]
+
+- Prevent opening P TGA images without a palette #7797
+  [radarhere]
+
+- Use palette when loading ICO images #7798
+  [radarhere]
+
+- Use consistent arguments for load_read and load_seek #7713
+  [radarhere]
+
 - Turn off nullability warnings for macOS SDK #7827
   [radarhere]
 
@@ -4262,7 +4346,7 @@ Changelog (Pillow)
 - Documentation changes, URL update, transpose, release checklist
   [radarhere]
 
-- Fixed saving to nonexistant files specified by pathlib.Path objects #1748 (fixes #1747)
+- Fixed saving to nonexistent files specified by pathlib.Path objects #1748 (fixes #1747)
   [radarhere]
 
 - Round Image.crop arguments to the nearest integer #1745 (fixes #1744)
@@ -7473,7 +7557,7 @@ The test suite includes 400 individual tests.
 - A handbook is available (distributed separately).
 
 - The coordinate system is changed so that (0,0) is now located
-  in the upper left corner.  This is in compliancy with ISO 12087
+  in the upper left corner.  This is in compliance with ISO 12087
   and 90% of all other image processing and graphics libraries.
 
 - Modes "1" (bilevel) and "P" (palette) have been introduced.  Note

LICENSE

@@ -1,11 +1,11 @@
 The Python Imaging Library (PIL) is
 
     Copyright © 1997-2011 by Secret Labs AB
-    Copyright © 1995-2011 by Fredrik Lundh
+    Copyright © 1995-2011 by Fredrik Lundh and contributors
 
 Pillow is the friendly PIL fork. It is
 
-    Copyright © 2010-2024 by Jeffrey A. Clark (Alex) and contributors.
+    Copyright © 2010-2024 by Jeffrey A. Clark and contributors
 
 Like PIL, Pillow is licensed under the open source HPND License:
 

README.md

@@ -6,9 +6,9 @@
 
 ## Python Imaging Library (Fork)
 
-Pillow is the friendly PIL fork by [Jeffrey A. Clark (Alex) and
+Pillow is the friendly PIL fork by [Jeffrey A. Clark and
 contributors](https://github.com/python-pillow/Pillow/graphs/contributors).
-PIL is the Python Imaging Library by Fredrik Lundh and Contributors.
+PIL is the Python Imaging Library by Fredrik Lundh and contributors.
 As of 2019, Pillow development is
 [supported by Tidelift](https://tidelift.com/subscription/pkg/pypi-pillow?utm_source=pypi-pillow&utm_medium=readme&utm_campaign=enterprise).
 

Tests/bench_cffi_access.py

@@ -32,9 +32,8 @@ def timer(func, label, *args) -> None:
             break
     endtime = time.time()
     print(
-        "{}: completed {} iterations in {:.4f}s, {:.6f}s per iteration".format(
-            label, x + 1, endtime - starttime, (endtime - starttime) / (x + 1.0)
-        )
+        f"{label}: completed {x + 1} iterations in {endtime - starttime:.4f}s, "
+        f"{(endtime - starttime) / (x + 1.0):.6f}s per iteration"
     )