CVS commit: pkgsrc/graphics/py-Pillow

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Thu Feb 12 06:24:22 UTC 2026

Modified Files:
        pkgsrc/graphics/py-Pillow: Makefile distinfo

Log Message:
py-Pillow: update to 12.1.1.

Security

CVE 2021-25289: Fix OOB write with invalid tile extents

Check that tile extents do not use negative x or y offsets when
decoding or encoding, and raise an error if they do, rather than
allowing an OOB write.

An out-of-bounds write may be triggered when opening a specially
crafted PSD image. This only affects Pillow >= 10.3.0. Reported by
Yarden Porat.

Other changes

Patch libavif for svt-av1 4.0 compatibility

A patch has been added to depends/install_libavif.sh, to allow
libavif 1.3.0 to be compatible with the recently released svt-av1
4.0.0.


To generate a diff of this commit:
cvs rdiff -u -r1.99 -r1.100 pkgsrc/graphics/py-Pillow/Makefile
cvs rdiff -u -r1.71 -r1.72 pkgsrc/graphics/py-Pillow/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/graphics/py-Pillow/Makefile
diff -u pkgsrc/graphics/py-Pillow/Makefile:1.99 pkgsrc/graphics/py-Pillow/Makefile:1.100
--- pkgsrc/graphics/py-Pillow/Makefile:1.99     Sat Jan 10 15:06:24 2026
+++ pkgsrc/graphics/py-Pillow/Makefile  Thu Feb 12 06:24:22 2026
@@ -1,8 +1,7 @@
-# $NetBSD: Makefile,v 1.99 2026/01/10 15:06:24 rillig Exp $
+# $NetBSD: Makefile,v 1.100 2026/02/12 06:24:22 wiz Exp $
 
-DISTNAME=      pillow-12.1.0
+DISTNAME=      pillow-12.1.1
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME:S/^p/P/}
-PKGREVISION=   1
 CATEGORIES=    graphics python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=p/pillow/}
 
@@ -25,8 +24,8 @@ CONFLICTS+=   py[0-9]*-imaging-[0-9]*
 
 DISTUTILS_BUILDDIR_IN_TEST_ENV=        yes
 
-# as of 11.3.0
-# 2 failed, 4934 passed, 88 skipped, 3 xfailed
+# as of 12.1.1
+# 2 failed, 4959 passed, 102 skipped, 3 xfailed
 
 .include "../../lang/python/wheel.mk"
 .include "../../devel/py-pybind11/buildlink3.mk"

Index: pkgsrc/graphics/py-Pillow/distinfo
diff -u pkgsrc/graphics/py-Pillow/distinfo:1.71 pkgsrc/graphics/py-Pillow/distinfo:1.72
--- pkgsrc/graphics/py-Pillow/distinfo:1.71     Fri Jan  2 13:52:26 2026
+++ pkgsrc/graphics/py-Pillow/distinfo  Thu Feb 12 06:24:22 2026
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.71 2026/01/02 13:52:26 adam Exp $
+$NetBSD: distinfo,v 1.72 2026/02/12 06:24:22 wiz Exp $
 
-BLAKE2s (pillow-12.1.0.tar.gz) = 199b6381a94fffe93cef14297a57068fc96b6b15a0d2e814a1867a50c7d89e09
-SHA512 (pillow-12.1.0.tar.gz) = 95eef4883d495fb29609076848eab8b9ec014e3e29646e4ff8e0741d801aa9b1df5a3f32003c203e14a3dd0f35bd971d0e05e063d921f70031340839dfc611a2
-Size (pillow-12.1.0.tar.gz) = 46977283 bytes
+BLAKE2s (pillow-12.1.1.tar.gz) = 6604ea3a6a8202bf5ac1a944fc9f576af9b5be8cce0756e2d9f22d51511d8fe4
+SHA512 (pillow-12.1.1.tar.gz) = 89a3ddfaeff89b229b0e579aaae2ca5cd6f9ec568e78cb965b18961787493cb75bb7cdd5809a0650c97f6f252a062b1cc56ea7271ac22c195691bad9a676773b
+Size (pillow-12.1.1.tar.gz) = 46980264 bytes
 SHA1 (patch-setup.py) = 5f28aca4aa1d458c2e359814573ff17dae20c36b