Security issue in Pillow >= 10.3.0, < 12.1.1
change requestresolved
### Context
_No response_
### Bug description
Dependabot reported a security issue: "Pillow affected by out-of-bounds write when loading PSD images."
<img width="895" height="423" alt="Image" src="https://github.com/user-attachments/assets/9ea68c5a-3b70-4862-9129-042276efa831" />
It cannot use the patched version due to a restriction in `mkdocs-material[imaging]`:
```
× No solution found when resolving dependencies:
╰─▶ Because mkdocs-material[imaging]==9.7.1 depends on pillow>=10.2,<12.0
and pillow==12.1.1, we can conclude that mkdocs-material[imaging]==9.7.1
cannot be used.
And because your project depends on mkdocs-material[imaging]==9.7.1, we
can conclude that your project's requirements are unsatisfiable.
```
I'm not sure whether you consider this as critical, but I thought it was worth reporting. Feel free to close if not.
### Related links
- https://pillow.readthedocs.io/en/stable/releasenotes/12.1.1.html
- https://github.com/squidfunk/mkdocs-material/issues/8419
### Reproduction
NA
### Steps to reproduce
NA
### Browser
_No response_
### Before submitting
- [x] I have read and followed the [bug reporting guidelines](https://squidfunk.github.io/mkdocs-material/contributing/reporting-a-bug/).
- [x] I have attached links to [the documentation](https://squidfunk.github.io/mkdocs-material/), and possibly related [issues](https://github.com/squidfunk/mkdocs-material/issues) and [discussions](https://github.com/squidfunk/mkdocs-material/discussions).
- [x] I assure that I have [removed all customizations](https://squidfunk.github.io/mkdocs-material/contributing/reporting-a-bug/#remove-customizations) before submitting this bug report.
- [x] I have attached a __.zip file__ with a [minimal reproduction](https://squidfunk.github.io/mkdocs-material/guides/creating-a-reproduction/) using the [built-in info plugin](https://squidfunk.github.io/mkdocs-material/plugins/info/).
关闭于 2026-02-18 3 条评论