From 03bcbcc6a86ec78de9814fb65a7ba00fff840b0c Mon Sep 17 00:00:00 2001 From: Pcch Date: Wed, 15 Jul 2026 19:46:39 +0200 Subject: [PATCH] fix(deps): require Pillow 12.3.0 --- CHANGELOG.md | 2 +- requirements.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 15af39c..c85b3c9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,5 +17,5 @@ All notable changes to this project are documented in this file. - Target App path policy, output writes, fallbacks, failure reporting, and Sync Run orchestration now use shared modules. ### Security -- Raised the minimum Pillow version to `12.2.0` to exclude vulnerable releases. +- Raised the minimum Pillow version to `12.3.0` to exclude releases affected by [CVE-2026-54059](https://osv.dev/vulnerability/PYSEC-2026-2253), [CVE-2026-54060](https://osv.dev/vulnerability/PYSEC-2026-2254), [CVE-2026-55379](https://osv.dev/vulnerability/PYSEC-2026-2255), [CVE-2026-55380](https://osv.dev/vulnerability/PYSEC-2026-2256), and [CVE-2026-55798](https://osv.dev/vulnerability/PYSEC-2026-2257). - LaunchAgent plist rendering now XML-escapes substituted install paths. diff --git a/requirements.txt b/requirements.txt index c1a4c7e..adfa223 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,2 +1,2 @@ -Pillow>=12.2.0 +Pillow>=12.3.0 pyobjc-framework-Quartz>=10.0