Summary

The e2b-desktop 2.3.0 artifacts published to PyPI declare a Pillow upper bound that contradicts the source repo:

• Published wheel / sdist metadata (PyPI): pillow<12.0.0,>=11.1.0
  • https://pypi.org/pypi/e2b-desktop/2.3.0/json -> requires_dist
• Source packages/python-sdk/pyproject.toml (this repo, main): pillow = "^12.0.0" (i.e. >=12.0.0,<13.0.0)
  • https://github.com/e2b-dev/desktop/blob/main/packages/python-sdk/pyproject.toml#L17

These ranges are mutually exclusive, so the published wheel was clearly not built from current main. Most likely 2.3.0 was tagged/published before the Pillow bump in the source was merged (or without re-running the publish workflow afterwards).

Why this matters: forces installs onto a Pillow with two open High-severity CVEs

Because e2b-desktop 2.3.0 caps pillow<12.0.0, any project that depends on it gets pulled back to Pillow 11.x, which is affected by:

• GHSA-cfh3-3jmp-rvhc / CVE-2026-25990 — Pillow out-of-bounds write when loading PSD images (High, CVSS v4 8.9). Vulnerable: >=10.3.0,<12.1.1. Fixed in 12.1.1. GHSA-cfh3-3jmp-rvhc
• GHSA-whj4-6x5x-4v2j / CVE-2026-40192 — FITS GZIP decompression bomb in Pillow (High, CVSS v3 7.5 / v4 8.7). Vulnerable: >=10.3.0,<12.2.0. Fixed in 12.2.0. GHSA-whj4-6x5x-4v2j

Dependabot/Renovate flags both alerts on any project that transitively depends on e2b-desktop 2.3.0, with no clean upgrade path because of the cap.

Today the only workaround is something like tool.uv.override-dependencies = ["pillow>=12.2.0"], which is uv-only and silently bypasses upstream constraints.

Suggested fix

Cut a patch release (e2b-desktop 2.3.1) from current main so the published wheel reflects the actual pillow = "^12.0.0" constraint and downstream users can pick up the patched Pillow >= 12.2.0.

Reproduction

pip download --no-deps e2b-desktop==2.3.0
unzip -p e2b_desktop-2.3.0-py3-none-any.whl '*.dist-info/METADATA' | grep -i pillow
# Requires-Dist: pillow (<12.0.0,>=11.1.0)

Thanks!