From 72acc6c8a54e7a5a00719c2949305135d056ac49 Mon Sep 17 00:00:00 2001 From: JeffreyChen Date: Thu, 23 Jul 2026 14:03:22 +0800 Subject: [PATCH] Require Pillow 12.3.0 or newer at install time The dependency was declared unbounded, so the version an installer resolved was whatever PyPI served at the time; the 12.3.0 floor was only enforced by uv.lock, which constrains the uv environment rather than installs of the published package. 12.3.0 is the first release clear of the known Pillow advisories, and it ships wheels for cp310-cp315, so the floor excludes no interpreter covered by requires-python = ">=3.10". dev.toml is left alone: je_web_runner_dev does not declare Pillow at all, since the imaging paths import PIL lazily. --- dev_requirements.txt | 2 +- pyproject.toml | 4 +++- requirements.txt | 2 +- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/dev_requirements.txt b/dev_requirements.txt index c0226e14..1d8545ee 100644 --- a/dev_requirements.txt +++ b/dev_requirements.txt @@ -5,7 +5,7 @@ je_web_runner_dev sphinx-rtd-theme Pyside6 defusedxml -Pillow +Pillow>=12.3.0 faker sqlalchemy pytest diff --git a/pyproject.toml b/pyproject.toml index fd79ce8c..c8e14081 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -24,7 +24,9 @@ dependencies = [ 'python-dotenv', "webdriver-manager", "defusedxml", - "Pillow", + # Floor set to the first release without the known Pillow advisories; + # wheels cover cp310-cp315, so it excludes no supported interpreter. + "Pillow>=12.3.0", ] classifiers = [ "Development Status :: 2 - Pre-Alpha", diff --git a/requirements.txt b/requirements.txt index a0795c57..9349904b 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,5 +1,5 @@ je_web_runner defusedxml -Pillow +Pillow>=12.3.0 faker sqlalchemy