jenkins-bot has submitted this change. (
https://gerrit.wikimedia.org/r/c/pywikibot/core/+/1274851?usp=email )
Change subject: gui: use Pillow 12.2.0 or above
......................................................................
gui: use Pillow 12.2.0 or above
Due to security vulnerability Pillow 12.2.0 or above is required.
Neither Python 3.9 nor PyPy < 3.11 can be used together with PIL.
Bug: T423769
Change-Id: Iad3454180377f80ac200b1952628f78a42b83e4b
---
M pywikibot/userinterfaces/gui.py
M requirements.txt
M setup.py
3 files changed, 17 insertions(+), 26 deletions(-)
Approvals:
Xqt: Looks good to me, approved
jenkins-bot: Verified
diff --git a/pywikibot/userinterfaces/gui.py b/pywikibot/userinterfaces/gui.py
index 35de194..fddc59e 100644
--- a/pywikibot/userinterfaces/gui.py
+++ b/pywikibot/userinterfaces/gui.py
@@ -11,12 +11,9 @@
.. caution::
Pillow may not be installable on GraalPy.
- PyPy 3.9 needs Pillow 10.4.0, PyPy 3.10 needs Pillow 11.3.0.
- CPython and other Python versions needs Pillow >= 11.3.0 to use this
- module.
.. danger::
- Due to security vulnerability, use Pillow >= 12.1.1.
+ Due to security vulnerability, use Pillow >= 12.2.0.
Requires PyPy >= 3.11 or CPython >= 3.10.
.. seealso:: :mod:`editor`
@@ -522,9 +519,12 @@
.. version-changed:: 11.1
PSD files are not allowed for ``Pillow < 12.1.1``.
+ .. version-changed:: 11.2
+ ``Pillow >= 12.2.0`` is required due to security
+ vulnerability.
:raises ImportError: Pillow is not installed
- :raises ValueError: if a PSD file is passed and Pillow < 12.1.1
+ :raises RuntimeError: Pillow < 12.2.0
"""
try:
from PIL import Image, ImageTk, __version__
@@ -533,15 +533,15 @@
'Python Imaging Library (PIL).')
raise
- path = pathlib.Path(photo)
pil_version = Version(__version__)
- if pil_version < Version('12.1.1') and path.suffix.lower() == '.psd':
- raise ValueError(
- f'PSD files are not allowed with Pillow {pil_version} due to'
- ' Pillow security advisory. Please update your Pillow and'
- ' if necessary your Python.'
+ if pil_version < Version('12.2.0'):
+ raise RuntimeError(
+ f'Pillow {pil_version} is not allowed due to Pillow security'
+ ' advisory. Please update your Pillow and if necessary your'
+ ' Python.'
)
+ path = pathlib.Path(photo)
image = Image.open(path)
image.thumbnail((width, height))
return ImageTk.PhotoImage(image)
diff --git a/requirements.txt b/requirements.txt
index 83219c8..4bfe610 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -40,12 +40,9 @@
python-stdnum >= 2.2
# GUI
-# Pillow cannot be installed with GraalPy
-Pillow==10.4.0; platform_python_implementation == "PyPy" and python_version ==
"3.9"
-Pillow==11.3.0; platform_python_implementation == "PyPy" and python_version ==
"3.10"
-Pillow>=12.1.1; platform_python_implementation == "PyPy" and python_version >=
"3.11"
-Pillow==11.3.0; platform_python_implementation == "CPython" and python_version
== "3.9"
-Pillow>=12.1.1; platform_python_implementation == "CPython" and
python_version >= "3.10"
+# Pillow cannot be installed with GraalPy, Python 3.9 or PyPy < 3.11
+Pillow>=12.2.0; platform_python_implementation == "PyPy" and python_version >=
"3.11"
+Pillow>=12.2.0; platform_python_implementation == "CPython" and
python_version >= "3.10"
# core pagegenerators
googlesearch-python >= 1.3.0
diff --git a/setup.py b/setup.py
index 9d99b11c..419974c 100755
--- a/setup.py
+++ b/setup.py
@@ -45,17 +45,11 @@
'memento': ['memento_client==0.6.1'],
'wikitextparser': ['wikitextparser>=0.56.4'],
'mysql': ['PyMySQL >= 1.1.2'],
- # Pillow cannot be installed with GraalPy
+ # Pillow cannot be installed with GraalPy, Python 3.9 or PyPy < 3.11
'Tkinter': [
- 'Pillow==10.4.0; platform_python_implementation == "PyPy" '
- 'and python_version == "3.9"',
- 'Pillow==11.3.0; platform_python_implementation == "PyPy" '
- 'and python_version == "3.10"',
- 'Pillow>=12.1.1; platform_python_implementation == "PyPy" '
+ 'Pillow>=12.2.0; platform_python_implementation == "PyPy" '
'and python_version >= "3.11"',
- 'Pillow==11.3.0; platform_python_implementation == "CPython" '
- 'and python_version == "3.9"',
- 'Pillow>=12.1.1; platform_python_implementation == "CPython" '
+ 'Pillow>=12.2.0; platform_python_implementation == "CPython" '
'and python_version >= "3.10"',
],
'mwoauth': [
--
To view, visit
https://gerrit.wikimedia.org/r/c/pywikibot/core/+/1274851?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.wikimedia.org/r/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: pywikibot/core
Gerrit-Branch: master
Gerrit-Change-Id: Iad3454180377f80ac200b1952628f78a42b83e4b
Gerrit-Change-Number: 1274851
Gerrit-PatchSet: 1
Gerrit-Owner: Xqt <[email protected]>
Gerrit-Reviewer: Xqt <[email protected]>
Gerrit-Reviewer: jenkins-bot
_______________________________________________
Pywikibot-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
