security(deps): bump pillow floor to 12.3.0 and update vulnerable flatpak pins - #136
Merged
Merged
Conversation
…tpak pins Shipped artefacts (Windows/MSIX/Snap) are clean because requirements.txt resolves the >= floors to patched versions, but two gaps remained: - requirements.txt had pillow>=12.1.1, whose lower bound still permitted the vulnerable 12.1.1 (26 CVEs in image decoders). Raise it to >=12.3.0 and bump pymupdf>=1.27.2.3 -> >=1.28.0 for hygiene. - The dormant flatpak/ pinned vulnerable versions: python-modules.yml (the file flatpak-builder actually consumes) pinned pypdf 6.10.0 (17 CVEs, several in the untrusted-input PDF parser) and pillow 12.1.1, and diverged from requirements-pinned.txt (pyside6/shiboken6 6.10.2 vs 6.11.1). Regenerated with req2flatpak against the updated pinned file (target 312-x86_64); all wheel URLs/sha256 are real and verified against PyPI. Regenerate flatpak/requirements-pinned.txt: pillow 12.2.0 -> 12.3.0, pymupdf 1.27.2.3 -> 1.28.0 (pypdf already 6.14.2), keeping it coherent with the regenerated python-modules.yml. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
Python dependencies security checkpip-audit:
|
| Package | Pin | Latest on PyPI | Status |
|---|---|---|---|
| PySide6 | PySide6>=6.11.1 |
6.11.1 |
up-to-date |
| pypdf | pypdf>=6.14.2 |
6.14.2 |
up-to-date |
| cryptography | cryptography>=49.0.0 |
49.0.0 |
up-to-date |
| qtawesome | qtawesome>=1.4.2 |
1.4.2 |
up-to-date |
| pillow | pillow>=12.3.0 |
12.3.0 |
up-to-date |
| pymupdf | pymupdf>=1.28.0 |
1.28.0 |
up-to-date |
| pytesseract | pytesseract>=0.3.13 |
0.3.13 |
up-to-date |
| python-docx | python-docx>=1.2.0 |
1.2.0 |
up-to-date |
| python-pptx | python-pptx>=1.0.2 |
1.0.2 |
up-to-date |
| openpyxl | openpyxl>=3.1.5 |
3.1.5 |
up-to-date |
| beautifulsoup4 | beautifulsoup4>=4.15.0 |
4.15.0 |
up-to-date |
| ebooklib | ebooklib>=0.20 |
0.20 |
up-to-date |
| lxml | lxml>=6.1.1 |
6.1.1 |
up-to-date |
| urllib3 | urllib3>=2.7.0 |
2.7.0 |
up-to-date |
| idna | idna>=3.18 |
3.18 |
up-to-date |
| pyinstaller | pyinstaller>=6.21.0 |
6.21.0 |
up-to-date |
Auto-generated by security-deps workflow. Merge is blocked only when pip-audit --strict reports vulnerabilities.
Bump the qtawesome lower bound in requirements.txt from >=1.4.1 to >=1.4.2 to match the pinned flatpak manifests (requirements-pinned.txt and python-modules.yml already use 1.4.2, the current PyPI latest). Resolves the security-deps floor-drift report. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Deploying pdfapps with
|
| Latest commit: |
8e76f83
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://7ae8b864.pdfapps.pages.dev |
| Branch Preview URL: | https://fix-supply-chain-flatpak-pil.pdfapps.pages.dev |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Supply-chain fix from a dependency audit. The shipped artefacts (Windows/MSIX/Snap) are clean —
requirements.txtuses>=floors that resolve to patched versions at build time. This PR closes two remaining gaps that would only bite in specific conditions:requirements.txtpillow floor did not encode the security fix. The line waspillow>=12.1.1, whose lower bound still permits resolving to the vulnerable 12.1.1 (26 CVEs across image decoders). Raised topillow>=12.3.0. Also bumpedpymupdf>=1.27.2.3->pymupdf>=1.28.0for hygiene (1.28.0 verified real and latest on PyPI). All other lines already encode their security floor and were left untouched.The dormant
flatpak/pinned vulnerable versions.python-modules.yml— the fileflatpak-builderactually consumes — pinned pypdf 6.10.0 (17 CVEs, several in the untrusted-input PDF parser) and pillow 12.1.1 (26 CVEs in image decoders): ~43 CVEs in PDF/image parsing paths. It had also diverged fromrequirements-pinned.txt(pyside6/shiboken6 6.10.2 in the YAML vs 6.11.1 in the pinned file). Not published today, but grave if submitted to Flathub as-is.What changed
requirements.txtpillow>=12.1.1,pymupdf>=1.27.2.3pillow>=12.3.0,pymupdf>=1.28.0flatpak/requirements-pinned.txtpillow==12.2.0,pymupdf==1.27.2.3pillow==12.3.0,pymupdf==1.28.0flatpak/python-modules.ymlpython-modules.ymlwas regenerated withreq2flatpak(--target-platforms 312-x86_64) against the updatedrequirements-pinned.txt, so the wheel URLs andsha256are real, not hand-edited. Each of the six changed hashes was additionally cross-verified against the PyPI JSON API. The two files are now coherent on every version.Regeneration still required before any Flathub submission
This PR removes the vulnerable pins and resolves the version divergence for the existing 8-package set, but the pre-existing gap documented in
flatpak/README.mdis not addressed here and remains a blocker for submission:requirements-pinned.txt/python-modules.ymlare still missing cryptography, python-pptx, openpyxl, beautifulsoup4, ebooklib (added torequirements.txtin later releases). Before opening a Flathub PR, run the fullreq2flatpakregeneration on Linux per the README (adds the missing packages) and do a localflatpak-builderbuild test. Nosha256was invented anywhere in this change.Validation
pytest -q: 475 passed, 2 skippedpip_audit -r requirements.txt: No known vulnerabilities foundpip_audit -r flatpak/requirements-pinned.txt: No known vulnerabilities foundpython -c "import yaml; yaml.safe_load(open('flatpak/python-modules.yml'))": valid, 8 sources🤖 Generated with Claude Code