Skip to content

build(deps): bump pillow-heif from 1.2.1 to 1.3.0#1491

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/pip/pillow-heif-1.3.0
Open

build(deps): bump pillow-heif from 1.2.1 to 1.3.0#1491
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/pip/pillow-heif-1.3.0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Mar 2, 2026

Bumps pillow-heif from 1.2.1 to 1.3.0.

Release notes

Sourced from pillow-heif's releases.

v1.3.0

Added

  • Pixel aspect ratio (pasp) read/write support. #408
  • No-GIL (free-threaded Python) support. #405

Fixed

  • Integer overflow in encode path buffer validation leading to heap out-of-bounds read. (CVE-2026-28231, GHSA-5gjj-6r7v-ph3x) Thanks to @​kaizawa97 for finding this!
Changelog

Sourced from pillow-heif's changelog.

[1.3.0 - 2026-02-27]

Added

  • Pixel aspect ratio (pasp) read/write support. #408
  • No-GIL (free-threaded Python) support. #405

Fixed

  • Integer overflow in encode path buffer validation leading to heap out-of-bounds read. (CVE-2026-28231, GHSA-5gjj-6r7v-ph3x) Thanks to @​kaizawa97 for finding this!
Commits
  • 6bffca6 v1.3.0 [publish]
  • 8305a15 fix: raise proper ValueError instead of SIGSEGV (#411)
  • d9f773a feat: add pixel aspect ratio (pasp) read/write support (#408)
  • 83ac5ca chore(deps): update github artifact actions (#394)
  • 49c9254 use pytest.approx in the tests suite to satisfy RUF069 rule (#406)
  • d306a8b chore(deps): update actions/checkout action to v6 (#393)
  • 44643c8 feat: add no-GIL support (#405)
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [pillow-heif](https://github.com/bigcat88/pillow_heif) from 1.2.1 to 1.3.0.
- [Release notes](https://github.com/bigcat88/pillow_heif/releases)
- [Changelog](https://github.com/bigcat88/pillow_heif/blob/master/CHANGELOG.md)
- [Commits](bigcat88/pillow_heif@v1.2.1...v1.3.0)

---
updated-dependencies:
- dependency-name: pillow-heif
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Mar 2, 2026
@FrozenChen FrozenChen force-pushed the main branch 2 times, most recently from 03245c3 to 76bc483 Compare April 4, 2026 00:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants