deps: bump all dependencies to latest versions#20
Conversation
📝 WalkthroughWalkthroughUpdates minimum version constraints for development and production dependencies across two configuration files. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@config/requirements.txt`:
- Line 6: Update the Pillow dependency line in requirements.txt (the entry
"Pillow>=11.2.1") to require at least version 12.2.0 (e.g., change to
"Pillow>=12.2.0") so the project pulls a release that includes fixes for
CVE-2025-48379, CVE-2026-25990 and CVE-2026-40192; ensure the updated version
constraint is committed to the same requirements.txt entry.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 4fef99ae-172a-4f32-b3b4-12d9452c28b2
📒 Files selected for processing (2)
config/requirements-dev.txtconfig/requirements.txt
| urllib3>=2.0.0 | ||
| python-dotenv>=1.0.0 | ||
| rjsmin>=1.2.5 | ||
| Pillow>=11.2.1 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify advisory ranges for Pillow directly from OSV (read-only, no repo access needed)
set -euo pipefail
curl -s https://api.osv.dev/v1/query -H 'Content-Type: application/json' -d '{
"package": {"name":"Pillow","ecosystem":"PyPI"},
"version":"11.2.1"
}' | jq '.vulns[] | {id, summary, aliases, affected: [.affected[]?.ranges[]?.events[]?]}'Repository: GeiserX/Wayback-Archive
Length of output: 1338
🌐 Web query:
CVE-2025-48379 Pillow severity
💡 Result:
The severity of CVE-2025-48379 in Pillow is rated as HIGH by the CVE Numbering Authority (CNA, GitHub) with CVSS 3.1 base score 7.1 (Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), and MEDIUM by NIST NVD with CVSS 3.1 base score 5.5 (Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). This heap buffer overflow occurs when writing large (>64KB) compressed DDS images due to insufficient buffer space checks, affecting Pillow versions 11.2.0 to before 11.3.0. It was fixed in 11.3.0.
Citations:
- 1: https://nvd.nist.gov/vuln/detail/CVE-2025-48379
- 2: https://nvd.nist.gov/vuln/detail/cve-2025-48379
- 3: https://pillow.readthedocs.io/en/latest/%5Fsources/releasenotes/11.3.0.rst.txt
- 4: https://vulert.com/vuln-db/CVE-2025-48379
- 5: https://advisories.gitlab.com/pkg/pypi/pillow/CVE-2025-48379
🌐 Web query:
CVE-2026-25990 Pillow PSD severity
💡 Result:
CVE-2026-25990 is an out-of-bounds write vulnerability in the Pillow Python imaging library when loading specially crafted PSD images. It affects versions from 10.3.0 to before 12.1.1 and was fixed in 12.1.1. Severity ratings vary by CVSS version: - CVSS v3.1 (NVD): Base Score 7.5 (HIGH), Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS v4.0 (GitHub/CNA): Base Score 8.9 (HIGH), Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P - CVSS v4.0 (Tenable): Base Score 9.3 (CRITICAL), Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Citations:
- 1: https://nvd.nist.gov/vuln/detail/CVE-2026-25990
- 2: https://www.tenable.com/cve/CVE-2026-25990
- 3: https://nvd.nist.gov/vuln/detail/cve-2026-25990
- 4: https://explore.alas.aws.amazon.com/CVE-2026-25990.html
- 5: https://vulert.com/vuln-db/CVE-2026-25990
- 6: https://www.sentinelone.com/vulnerability-database/cve-2026-25990/
- 7: https://vulert.com/vuln-db/pillow-pillow-out-of-bounds-write-via-specially-crafted-psd-image
- 8: https://osv.dev/vulnerability/CVE-2026-25990
🌐 Web query:
CVE-2026-40192 Pillow FITS GZIP severity
💡 Result:
The severity of CVE-2026-40192, a vulnerability in the Pillow Python imaging library related to FITS GZIP decompression bombs, is rated as HIGH. The NVD lists a CVSS v3.1 base score of 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, and a CVSS v4.0 base score of 7.5 (HIGH) with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. The GitHub security advisory also rates it as High. It affects Pillow versions 10.3.0 through 12.1.1, allowing denial of service via unbounded memory consumption from specially crafted FITS files. Fixed in 12.2.0.
Citations:
Bump Pillow to 12.2.0 or later to address multiple HIGH vulnerabilities.
Pillow 11.2.1 is affected by at least three HIGH-severity vulnerabilities:
- CVE-2025-48379 (buffer overflow in DDS encoding; fixed in 11.3.0)
- CVE-2026-25990 (out-of-bounds write in PSD parsing; fixed in 12.1.1)
- CVE-2026-40192 (decompression bomb in FITS; fixed in 12.2.0)
Update to 12.2.0 or later to address all three.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@config/requirements.txt` at line 6, Update the Pillow dependency line in
requirements.txt (the entry "Pillow>=11.2.1") to require at least version 12.2.0
(e.g., change to "Pillow>=12.2.0") so the project pulls a release that includes
fixes for CVE-2025-48379, CVE-2026-25990 and CVE-2026-40192; ensure the updated
version constraint is committed to the same requirements.txt entry.
deps: bump all dependencies to latest versions (GeiserX#20)
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #20 +/- ##
=======================================
Coverage 90.59% 90.59%
=======================================
Files 5 5
Lines 1425 1425
=======================================
Hits 1291 1291
Misses 134 134
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
1 participant
Summary
Production deps (
config/requirements.txt)Dev deps (
config/requirements-dev.txt)Test plan
Summary by CodeRabbit