Skip to content

Bump pillow from 9.0.1 to 10.3.0 in /scripts#183

Open
dependabot[bot] wants to merge 155 commits into
mainfrom
dependabot/pip/scripts/pillow-10.3.0
Open

Bump pillow from 9.0.1 to 10.3.0 in /scripts#183
dependabot[bot] wants to merge 155 commits into
mainfrom
dependabot/pip/scripts/pillow-10.3.0

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github Feb 3, 2026

Bumps pillow from 9.0.1 to 10.3.0.

Release notes

Sourced from pillow's releases.

10.3.0

https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html

Deprecations

  • Deprecate eval(), replacing it with lambda_eval() and unsafe_eval() #7927 [@​hugovk]
  • Deprecate ImageCms constants and versions() function #7702 [@​nulano]

Changes

... (truncated)

Changelog

Sourced from pillow's changelog.

10.3.0 (2024-04-01)

  • CVE-2024-28219: Use strncpy to avoid buffer overflow #7928 [radarhere, hugovk]

  • Deprecate eval(), replacing it with lambda_eval() and unsafe_eval() #7927 [radarhere, hugovk]

  • Raise ValueError if seeking to greater than offset-sized integer in TIFF #7883 [radarhere]

  • Add --report argument to __main__.py to omit supported formats #7818 [nulano, radarhere, hugovk]

  • Added RGB to I;16, I;16L, I;16B and I;16N conversion #7918, #7920 [radarhere]

  • Fix editable installation with custom build backend and configuration options #7658 [nulano, radarhere]

  • Fix putdata() for I;16N on big-endian #7209 [Yay295, hugovk, radarhere]

  • Determine MPO size from markers, not EXIF data #7884 [radarhere]

  • Improved conversion from RGB to RGBa, LA and La #7888 [radarhere]

  • Support FITS images with GZIP_1 compression #7894 [radarhere]

  • Use I;16 mode for 9-bit JPEG 2000 images #7900 [scaramallion, radarhere]

  • Raise ValueError if kmeans is negative #7891 [radarhere]

  • Remove TIFF tag OSUBFILETYPE when saving using libtiff #7893 [radarhere]

  • Raise ValueError for negative values when loading P1-P3 PPM images #7882 [radarhere]

  • Added reading of JPEG2000 palettes #7870 [radarhere]

  • Added alpha_quality argument when saving WebP images #7872 [radarhere]

... (truncated)

Commits
  • 5c89d88 10.3.0 version bump
  • 63cbfcf Update CHANGES.rst [ci skip]
  • 2776126 Merge pull request #7928 from python-pillow/lcms
  • aeb51cb Merge branch 'main' into lcms
  • 5beb0b6 Update CHANGES.rst [ci skip]
  • cac6ffa Merge pull request #7927 from python-pillow/imagemath
  • f5eeeac Name as 'options' in lambda_eval and unsafe_eval, but '_dict' in deprecated eval
  • facf3af Added release notes
  • 2a93aba Use strncpy to avoid buffer overflow
  • a670597 Update CHANGES.rst [ci skip]
  • Additional commits viewable in compare view

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

sr1dh48r and others added 30 commits July 27, 2023 22:13
Modifications for building supplicant on Zephyr RTOS.

Signed-off-by: Sridhar Nuvusetty <sridhar.nuvusetty@nordicsemi.no>
Signed-off-by: Sachin Kulkarni <sachin.kulkarni@nordicsemi.no>
Signed-off-by: Ravi Dondaputi <ravi.dondaputi@nordicsemi.no>
Signed-off-by: Krishna T <krishna.t@nordicsemi.no>

Co-authored-by: krishna T <krishna.t@nordicsemi.no>
nRF CI treats warnings as errors.
Scan results are allocated by driver using k_malloc Zephyr allocator but
are freed by wpa_supplicant using libc free, due to changes in metadata
differences between them, we free the pointer which is 8 bytes below the
actual one and cause a bus and mem fault.

Copy the scan results from driver before passing to the wpa_supplicant
and then let driver free them using the same k_free allocator API.

We can now enable the scan results free code.

Signed-off-by: Krishna T <krishna.t@nordicsemi.no>
Using first interface handle everywhere is not ideal, esp. when we add
support for multi-VIF, so, query wpa_supplicant with the interface name
to get the handle.

The interface name itself is hard coded to "wlan0" everywhere for now.
If a second configuration is defined but failed to read, then the first
configuration is leaked.

Signed-off-by: Krishna T <krishna.t@nordicsemi.no>
Depending on OS and Compiler, time can be 32bit/64bit, so, use 64bit to
store to accommodate both. This fixes below coverity warnings

* COV-176118
* COV-176071
* COV-175162

Signed-off-by: Krishna T <krishna.t@nordicsemi.no>
Use the proper specifier.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
Zephyr has deprecated including "zephyr" directory in includes, so, all
references should mandatory use "zephyr" prefix.

Also, reordered the include groups.

Signed-off-by: Krishna T <krishna.t@nordicsemi.no>
Mask the MSB of supported and extended supported rates since MSB
identifies if its a basic rate or not, and is not required to check if
the rate is one of the 11b rates.

Signed-off-by: Ravi Dondaputi <ravi.dondaputi@nordicsemi.no>
Add following checks to identify legacy (a, b and g) mode connections:

1) Is a legacy connection if all of HE, HE and VHT capabilities are not
present.
2) If operating in a 5GHz band, identify as "a".
3) If operating in 2.4GHz band and supported/extended supported rates
match 11b rates, identify as "b", else identify as "g".

Signed-off-by: Ravi Dondaputi <ravi.dondaputi@nordicsemi.no>
In case of failure the reply length is still positive, so, check for the
length and reply message for success/failure.

Signed-off-by: Krishna T <krishna.t@nordicsemi.no>
We only support a few wpa_cli commands in Zephyr, and the lengthiest
command is "status" which doesn't need 4K buffer, so, reduce to 1K to
avoid memory allocation failures.

Signed-off-by: Krishna T <krishna.t@nordicsemi.no>
These are needed for LED support for STA sample to track WPA
supplicant connection state changes and blink LEDs.

Signed-off-by: Krishna T <krishna.t@nordicsemi.no>
While checking for stale BSSes, the current time is used as a basis and
then based on age the stale check time is calculated, but if this is
done too early in the boot and if either BOOTTIME/MONOTONIC (the one
Zephyr uses by default) are used then the stale check time underflows
and goes to future causing active BSS entries in the scan to be treated
as stale and flushed.

Fix this by adding a check before calculating stale time and ignore this
check till the system reaches the BSS expiration time (this would never
happen with REALTIME clock).

Signed-off-by: Krishna T <krishna.t@nordicsemi.no>
Signed-off-by: Sridhar Nuvusetty <sridhar.nuvusetty@nordicsemi.no>
(cherry picked from commit 12de811)
In Linux WPA CLI is a standalone application that uses sockets to
communicate with ctrl_iface (uses Eloop), in Zephyr we have replaced
sockets with direct function calls, but this introduces concurrency as
we don't go through Eloop which causes instability and crashes esp. in
the deinitialization path.

Implement Zephyr's version of WPA CLI and control interface using
socketpair UNIX style sockets, here WPA CLI can be invoked as a standard
function rather than an executable. To avoid code duplication move all
commands processing to a separate file that can be used by wpa_cli
application and also wpa_cli_zephyr library (all other changes to
wpa_cli are restored).

Signed-off-by: Krishna T <krishna.t@nordicsemi.no>
For basic Wi-Fi operation in Zephyr we only need few commands, so, to
save flash space disable other commands by default. This also involves
reordering them to group.

CONFIG_WPA_CLI is used for developer access that enables all commands
at the cost of Flash.

Signed-off-by: Krishna T <krishna.t@nordicsemi.no>
If we send too early and if data starts immediately then it might be
dropped as the port might still be unauthorized.

Signed-off-by: Krishna T <krishna.t@nordicsemi.no>
This is needed to manage interfaces using control interface for the
upcoming hotplugging support.

Signed-off-by: Krishna T <krishna.t@nordicsemi.no>
errno is not applicable for malloc, so, remove and add missing logs for
other error scenarios.

Signed-off-by: Krishna T <krishna.t@nordicsemi.no>
With the limited messages we expose 1024 should be enough, this reduces
the overall stack size.

Signed-off-by: Krishna T <krishna.t@nordicsemi.no>
squash! [nrf noup] zephyr: Add support for WPA CLI zephyr

Use proper API to print it out.

Signed-off-by: Krishna T <krishna.t@nordicsemi.no>
… driver

Eloop framework in wpa_supplicant uses select with minimal timeout of
all registered users, but by default it is 10secs (periodic cleanup
task), so, in case of no other events all registered users will be
delayed by 10secs.

In Linux, select exits without waiting for full 10secs as for there
is a handler registered for NL80211 sockets and whenever there is a
event from Kernel select exits and processes expired events immediately.

In Zephyr, we don't have such mechanism as we use direction function
calls between kernel and wpa_supplicant, so, add an event socket and
register it with Eloop and use this to post the event, the socket
handler pass the event to wpa_supplicant.

For user interface we just post a dummy message only to unblock select.

This solves both problems:

* Unblocking select for all interesting events immediately
* Terminate driver context for events as we use sockets, so, remove mbox
  + thread.

This significantly improves the association time from 30s to 5s.

Signed-off-by: Krishna T <krishna.t@nordicsemi.no>
Add support to handle signal polling requests from application.

Signed-off-by: Ravi Dondaputi <ravi.dondaputi@nordicsemi.no>
Support for handling MLME frames.
Enable RRM support in capabilities.
Support for wnm_bss_query wpa_cli cmd.

Signed-off-by: Sridhar Nuvusetty <sridhar.nuvusetty@nordicsemi.no>
Support for handling un-protected deauth/disassoc frame.

Signed-off-by: Ajay Parida <ajay.parida@nordicsemi.no>
SHEL-888: Supported Operating classes IE missing in the Assoc Request.
SHEL-877: DUT not responding to AP beacon request frame using case 3
SHEL-859 : No BTM response for the BTM request frame from the AP.

Signed-off-by: Sridhar Nuvusetty <sridhar.nuvusetty@nordicsemi.no>
SHEL-1269: Multiple BSSID bit is not set in Association request
Implement get_ext_capab op to get MBSSID support cap. info

Signed-off-by: Sridhar Nuvusetty <sridhar.nuvusetty@nordicsemi.no>
These capabilities need to be advertised to the WPA supplicant to enable
encryption, else, some encryptions e.g., WEP will not be supported.

Also, move the capabilities setting to the driver by introducing a new
op, though we do yet have the provision to query these from the RPU.

Signed-off-by: Krishna T <krishna.t@nordicsemi.no>
gcc 12.1 complains about using pointer after realloc as it could
potentially be moved/freed, causing any uses after UB.

Fix this by doing checks before alloc and use those statuses and update
with new BSS.

Upstream-Pr: https://patchwork.ozlabs.org/project/hostap/patch/20230420192821.376828-1-krishna.t@nordicsemi.no/

Signed-off-by: Krishna T <krishna.t@nordicsemi.no>
Disable key installation when crypto is not enabled.

Signed-off-by: Krishna T <krishna.t@nordicsemi.no>
krish2718 and others added 20 commits February 27, 2024 19:43
fixup! [nrf noup] zephyr: Redesign the events passing to wpa_supplicant from driver

The dynamic data for these events are not deep copied.

Fixes SHEL-2515.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
fixup![nrf noup] ci: Fix the paths

The compliance should be run from hostap repo and not sdk-zephyr. And
also disable few tests that won't work reliably.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
fixup! [nrf noup] zephyr: Fix association response event processing

Fix compliance.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
fixup! nrf noup] zephyr: Fix deep copy of remaining events

Fix compliance.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
fixup! [nrf noup] zephyr: Implement connect and disconnect events to Zephyr

In case a use issues a disconnect for some reason, it will still send
IEEE 802.11 reason code 3, which will show up as a Failure (non-zero
status) in Zephyr, this should only be applicable if AP sends
de-authentication with reason code as "3".

Fix locally generated case to return success (the enum should also be
renamed from "unspecified" to "local", but that will be handled in
another PR).

Fixes SHEL-2561.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
When there is a wrong password for AP, the send_wifi_mgmt_conn_event
is missing for WRONG_KEY.

Signed-off-by: Kapil Bhatt <kapil.bhatt@nordicsemi.no>
Supplicant will now use POSIX signal implementation from Zephyr, the
same wasy as it's done for the upstream (Zephyr) supplicant, as
using libc signal conflicts on sigset_t type definition.

Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
When selecting a network the default behaviour of WPA supplicant is to
prefer higher throughput, it does this by capping the SNR.

But in certain environments, reliability is important over throughput
and choosing a lower SNR (thought it is greater than "Great SNR") might
be sub-optimal.

Introduce a configuration option to choose the two options (throughput
or reliability).

Upstream PR: http://lists.infradead.org/pipermail/hostap/2024-March/042483.html

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
fixup! [nrf noup] zephyr: Redesign the events passing to wpa_supplicant from driver

Useful in debugging.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
fixup! [nrf noup] zephyr: Implement basic AP ops

In SAP mode, need to fetch the inactivity timer value for a STA from the
UMAC.

Fixes SHEL-2681.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
unicast is now a struct net_if_addr_ipv4, not net_if_addr. See
1b0f9e865e35a6b3e1ca8aad7a67f7cfbfc2e666.

Signed-off-by: Gerard Marull-Paretas <gerard@teslabs.com>
So there's no need to provide an implementation. See
4edb9017c229c34d111ec77d3c9105f8e77448f5.

Signed-off-by: Gerard Marull-Paretas <gerard@teslabs.com>
fixup! [nrf noup] zephyr: Add support for WPA CLI zephyr

For commands without any response, the failures are ignored.

Fixes SHEL-2740.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
fixup! [nrf noup] zephyr: Fix failure processing of no-response commands

Add a NULL check before accessing response and response can be NULL for
most commands.

Fixes SHEL-2755.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
We use subtraction operation over time, so, it has to be signed.

Fixes "[nrf toup] Use 64bit data type to store time".

Fixes SHEL-2731.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
nrf-squash! [nrf noup] zephyr: wifi: MBO Pre-certification bugfixes

Free the MLME buffer once it's sent.

Fixes SHEL-2738.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
DHCP client is needed only when the device is running in
station mode. Check if the SSID is configured in SME structure
which indicates that the given interface is operating
in STA mode.

Signed-off-by: Ravi Dondaputi <ravi.dondaputi@nordicsemi.no>
nrf-squash![nrf noup] mbedtls: Fix MbedTLS EC parameter A

The MPI bignum's were not freed after use.

Fixes SHEL-2851.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
CSRNG availability relies on having an entropy driver, so, protect the
API and fallback to non-CSRNG in case of unavailability of such
driver.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
Bumps [pillow](https://github.com/python-pillow/Pillow) from 9.0.1 to 10.3.0.
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@9.0.1...10.3.0)

---
updated-dependencies:
- dependency-name: pillow
  dependency-version: 10.3.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Feb 3, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Feb 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.