FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

BLD: update pillow dependency by tacaswell · Pull Request #15534 · matplotlib/matplotlib · GitHub

  1. matplotlib
  2. matplotlib

Repository navigation

BLD: update pillow dependency - #15534

Merged
dstansby merged 1 commit into
matplotlib:masterfrom
tacaswell:mnt_bump_pillow
Oct 27, 2019
ConversationCommits (1)ChecksFiles changed
Merged

BLD: update pillow dependency#15534
dstansby merged 1 commit into
matplotlib:masterfrom
tacaswell:mnt_bump_pillow

Conversation

tacaswell commented Oct 26, 2019

Copy link
Copy Markdown
Member

Pillow has a security issue for <6.2.0 (CVE-2019-16865).

This is in violation of our normal support window for dependencies,
however we are making an exception due to the CVE.

This may be too aggressive of a pinning from our down-stream
packagers, but they can patch this out if required.

PR Summary

PR Checklist

  • Has Pytest style unit tests
  • Code is Flake 8 compliant
  • New features are documented, with examples if plot related
  • Documentation is sphinx and numpydoc compliant
  • Added an entry to doc/users/next_whats_new/ if major new feature (follow instructions in README.rst there)
  • Documented in doc/api/api_changes.rst if API changed in a backward-incompatible way

BLD: update pillow dependency
4a84674 
Pillow has a security issue for <6.2.0 (CVE-2019-16865).

This is in violation of our normal support window for dependencies,
however we are making an exception due to the CVE.
tacaswell added this to the v3.3.0 milestone Oct 26, 2019

tacaswell commented Oct 26, 2019

Copy link
Copy Markdown
Member Author

We only have a hard dependency on pillow on master branch.

dstansby merged commit c684a79 into matplotlib:master Oct 27, 2019
tacaswell deleted the mnt_bump_pillow branch October 27, 2019 20:08

timhoffm commented Oct 28, 2019

Copy link
Copy Markdown
Member

Should we set up https://dependabot.com/ for the project? It would have warned and created this PR automatically.

tacaswell commented Oct 28, 2019

Copy link
Copy Markdown
Member Author

github them selves warned us (or at least me?) about this one.

timhoffm commented Oct 28, 2019

Copy link
Copy Markdown
Member

Ok, then at least you get the info already 😄.

QuLogic commented Oct 28, 2019

Copy link
Copy Markdown
Member

TBH, I'm not really sure we need to do this regularly (having not looked at the CVE.) Patches could have been backported depending on where you get Pillow, so our requirement really should be about functionality.

timhoffm mentioned this pull request Oct 29, 2019
Merged
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

timhoffm timhoffm approved these changes
dstansby dstansby approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

v3.3.0

Development

Successfully merging this pull request may close these issues.

4 participants

Back | FazBrowse Home | New Git URL