ITADN

Security issue in Pillow >= 10.3.0, < 12.1.1

#8563ClosedSerTetora 创建于 2026-02-18
change requestresolved
S
SerTetoracommented
### Context _No response_ ### Bug description Dependabot reported a security issue: "Pillow affected by out-of-bounds write when loading PSD images." <img width="895" height="423" alt="Image" src="https://github.com/user-attachments/assets/9ea68c5a-3b70-4862-9129-042276efa831" /> It cannot use the patched version due to a restriction in `mkdocs-material[imaging]`: ``` × No solution found when resolving dependencies: ╰─▶ Because mkdocs-material[imaging]==9.7.1 depends on pillow>=10.2,<12.0 and pillow==12.1.1, we can conclude that mkdocs-material[imaging]==9.7.1 cannot be used. And because your project depends on mkdocs-material[imaging]==9.7.1, we can conclude that your project's requirements are unsatisfiable. ``` I'm not sure whether you consider this as critical, but I thought it was worth reporting. Feel free to close if not. ### Related links - https://pillow.readthedocs.io/en/stable/releasenotes/12.1.1.html - https://github.com/squidfunk/mkdocs-material/issues/8419 ### Reproduction NA ### Steps to reproduce NA ### Browser _No response_ ### Before submitting - [x] I have read and followed the [bug reporting guidelines](https://squidfunk.github.io/mkdocs-material/contributing/reporting-a-bug/). - [x] I have attached links to [the documentation](https://squidfunk.github.io/mkdocs-material/), and possibly related [issues](https://github.com/squidfunk/mkdocs-material/issues) and [discussions](https://github.com/squidfunk/mkdocs-material/discussions). - [x] I assure that I have [removed all customizations](https://squidfunk.github.io/mkdocs-material/contributing/reporting-a-bug/#remove-customizations) before submitting this bug report. - [x] I have attached a __.zip file__ with a [minimal reproduction](https://squidfunk.github.io/mkdocs-material/guides/creating-a-reproduction/) using the [built-in info plugin](https://squidfunk.github.io/mkdocs-material/plugins/info/).
关闭于 2026-02-18 3 条评论