chore(deps): update dependency pillow to v10.3.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
pillow (changelog)	==10.1.0 → ==10.3.0

GitHub Vulnerability Alerts

CVE-2023-50447

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

CVE-2024-28219

In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.

---

Release Notes

python-pillow/Pillow (pillow)

v10.3.0

Compare Source

• CVE-2024-28219: Use strncpy to avoid buffer overflow #​7928
  [radarhere, hugovk]

• Deprecate eval(), replacing it with lambda_eval() and unsafe_eval() #​7927
  [radarhere, hugovk]

• Raise ValueError if seeking to greater than offset-sized integer in TIFF #​7883
  [radarhere]

• Add --report argument to __main__.py to omit supported formats #​7818
  [nulano, radarhere, hugovk]

• Added RGB to I;16, I;16L, I;16B and I;16N conversion #​7918, #​7920
  [radarhere]

• Fix editable installation with custom build backend and configuration options #​7658
  [nulano, radarhere]

• Fix putdata() for I;16N on big-endian #​7209
  [Yay295, hugovk, radarhere]

• Determine MPO size from markers, not EXIF data #​7884
  [radarhere]

• Improved conversion from RGB to RGBa, LA and La #​7888
  [radarhere]

• Support FITS images with GZIP_1 compression #​7894
  [radarhere]

• Use I;16 mode for 9-bit JPEG 2000 images #​7900
  [scaramallion, radarhere]

• Raise ValueError if kmeans is negative #​7891
  [radarhere]

• Remove TIFF tag OSUBFILETYPE when saving using libtiff #​7893
  [radarhere]

• Raise ValueError for negative values when loading P1-P3 PPM images #​7882
  [radarhere]

• Added reading of JPEG2000 palettes #​7870
  [radarhere]

• Added alpha_quality argument when saving WebP images #​7872
  [radarhere]

• Fixed joined corners for ImageDraw rounded_rectangle() non-integer dimensions #​7881
  [radarhere]

• Stop reading EPS image at EOF marker #​7753
  [radarhere]

• PSD layer co-ordinates may be negative #​7706
  [radarhere]

• Use subprocess with CREATE_NO_WINDOW flag in ImageShow WindowsViewer #​7791
  [radarhere]

• When saving GIF frame that restores to background color, do not fill identical pixels #​7788
  [radarhere]

• Fixed reading PNG iCCP compression method #​7823
  [radarhere]

• Allow writing IFDRational to UNDEFINED tag #​7840
  [radarhere]

• Fix logged tag name when loading Exif data #​7842
  [radarhere]

• Use maximum frame size in IHDR chunk when saving APNG images #​7821
  [radarhere]

• Prevent opening P TGA images without a palette #​7797
  [radarhere]

• Use palette when loading ICO images #​7798
  [radarhere]

• Use consistent arguments for load_read and load_seek #​7713
  [radarhere]

• Turn off nullability warnings for macOS SDK #​7827
  [radarhere]

• Fix shift-sign issue in Convert.c #​7838
  [r-barnes, radarhere]

• Open 16-bit grayscale PNGs as I;16 #​7849
  [radarhere]

• Handle truncated chunks at the end of PNG images #​7709
  [lajiyuan, radarhere]

• Match mask size to pasted image size in GifImagePlugin #​7779
  [radarhere]

• Release GIL while calling WebPAnimDecoderGetNext #​7782
  [evanmiller, radarhere]

• Fixed reading FLI/FLC images with a prefix chunk #​7804
  [twolife]

• Update wl-paste handling and return None for some errors in grabclipboard() on Linux #​7745
  [nik012003, radarhere]

• Remove execute bit from setup.py #​7760
  [hugovk]

• Do not support using test-image-results to upload images after test failures #​7739
  [radarhere]

• Changed ImageMath.ops to be static #​7721
  [radarhere]

• Fix APNG info after seeking backwards more than twice #​7701
  [esoma, radarhere]

• Deprecate ImageCms constants and versions() function #​7702
  [nulano, radarhere]

• Added PerspectiveTransform #​7699
  [radarhere]

• Add support for reading and writing grayscale PFM images #​7696
  [nulano, hugovk]

• Add LCMS2 flags to ImageCms #​7676
  [nulano, radarhere, hugovk]

• Rename x64 to AMD64 in winbuild #​7693
  [nulano]

v10.2.0

Compare Source

• Add keep_rgb option when saving JPEG to prevent conversion of RGB colorspace #​7553
  [bgilbert, radarhere]

• Trim glyph size in ImageFont.getmask() #​7669, #​7672
  [radarhere, nulano]

• Deprecate IptcImagePlugin helpers #​7664
  [nulano, hugovk, radarhere]

• Allow uncompressed TIFF images to be saved in chunks #​7650
  [radarhere]

• Concatenate multiple JPEG EXIF markers #​7496
  [radarhere]

• Changed IPTC tile tuple to match other plugins #​7661
  [radarhere]

• Do not assign new fp attribute when exiting context manager #​7566
  [radarhere]

• Support arbitrary masks for uncompressed RGB DDS images #​7589
  [radarhere, akx]

• Support setting ROWSPERSTRIP tag #​7654
  [radarhere]

• Apply ImageFont.MAX_STRING_LENGTH to ImageFont.getmask() #​7662
  [radarhere]

• Optimise ImageColor using functools.lru_cache #​7657
  [hugovk]

• Restricted environment keys for ImageMath.eval() #​7655
  [wiredfool, radarhere]

• Optimise ImageMode.getmode using functools.lru_cache #​7641
  [hugovk, radarhere]

• Fix incorrect color blending for overlapping glyphs #​7497
  [ZachNagengast, nulano, radarhere]

• Attempt memory mapping when tile args is a string #​7565
  [radarhere]

• Fill identical pixels with transparency in subsequent frames when saving GIF #​7568
  [radarhere]

• Corrected duration when combining multiple GIF frames into single frame #​7521
  [radarhere]

• Handle disposing GIF background from outside palette #​7515
  [radarhere]

• Seek past the data when skipping a PSD layer #​7483
  [radarhere]

• Import plugins relative to the module #​7576
  [deliangyang, jaxx0n]

• Translate encoder error codes to strings; deprecate ImageFile.raise_oserror() #​7609
  [bgilbert, radarhere]

• Support reading BC4U and DX10 BC1 images #​6486
  [REDxEYE, radarhere, hugovk]

• Optimize ImageStat.Stat.extrema #​7593
  [florath, radarhere]

• Handle pathlib.Path in FreeTypeFont #​7578
  [radarhere, hugovk, nulano]

• Added support for reading DX10 BC4 DDS images #​7603
  [sambvfx, radarhere]

• Optimized ImageStat.Stat.count #​7599
  [florath]

• Correct PDF palette size when saving #​7555
  [radarhere]

• Fixed closing file pointer with olefile 0.47 #​7594
  [radarhere]

• Raise ValueError when TrueType font size is not greater than zero #​7584, #​7587
  [akx, radarhere]

• If absent, do not try to close fp when closing image #​7557
  [RaphaelVRossi, radarhere]

• Allow configuring JPEG restart marker interval on save #​7488
  [bgilbert, radarhere]

• Decrement reference count for PyObject #​7549
  [radarhere]

• Implement streamtype=1 option for tables-only JPEG encoding #​7491
  [bgilbert, radarhere]

• If save_all PNG only has one frame, do not create animated image #​7522
  [radarhere]

• Fixed frombytes() for images with a zero dimension #​7493
  [radarhere]

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.