CVS commit: pkgsrc/graphics/py-Pillow

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Wed Jul  1 12:58:28 UTC 2026

Modified Files:
        pkgsrc/graphics/py-Pillow: Makefile distinfo

Log Message:
py-Pillow: updated to 12.3.0

12.3.0

Security
Prevent decompression bomb when parsing PDF
CVE 2026-55798: WindowsViewer.get_command injection
EPS image infinite loop
JPEG2000 image memory usage
McIdas out-of-bounds (OOB) read
Out-of-bounds (OOB) read when saving 1 mode TGA images
Out-of-bounds (OOB) write from large RankFilter sizes
Out-of-bounds (OOB) write from Image.paste()
Out-of-bounds (OOB) write in ImageCmsTransform
CVE 2026-54059, CVE 2026-54060, CVE 2026-55379: Prevent FontFile decompression bomb
CVE 2026-55380: Prevent GD decompression bomb


To generate a diff of this commit:
cvs rdiff -u -r1.102 -r1.103 pkgsrc/graphics/py-Pillow/Makefile
cvs rdiff -u -r1.73 -r1.74 pkgsrc/graphics/py-Pillow/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/graphics/py-Pillow/Makefile
diff -u pkgsrc/graphics/py-Pillow/Makefile:1.102 pkgsrc/graphics/py-Pillow/Makefile:1.103
--- pkgsrc/graphics/py-Pillow/Makefile:1.102    Sun Jun 28 15:41:22 2026
+++ pkgsrc/graphics/py-Pillow/Makefile  Wed Jul  1 12:58:28 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.102 2026/06/28 15:41:22 wiz Exp $
+# $NetBSD: Makefile,v 1.103 2026/07/01 12:58:28 adam Exp $
 
-DISTNAME=      pillow-12.2.0
+DISTNAME=      pillow-12.3.0
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME:S/^p/P/}
 CATEGORIES=    graphics python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=p/pillow/}
@@ -29,7 +29,6 @@ DISTUTILS_BUILDDIR_IN_TEST_ENV=       yes
 
 PYTHON_VERSIONS_INCOMPATIBLE=  310 311
 
-.include "../../lang/python/wheel.mk"
 .include "../../devel/py-pybind11/buildlink3.mk"
 .include "../../devel/zlib/buildlink3.mk"
 .include "../../graphics/libavif/buildlink3.mk"
@@ -40,5 +39,6 @@ PYTHON_VERSIONS_INCOMPATIBLE= 310 311
 .include "../../graphics/openjpeg/buildlink3.mk"
 .include "../../graphics/raqm/buildlink3.mk"
 .include "../../graphics/tiff/buildlink3.mk"
+.include "../../lang/python/wheel.mk"
 .include "../../mk/jpeg.buildlink3.mk"
 .include "../../mk/bsd.pkg.mk"

Index: pkgsrc/graphics/py-Pillow/distinfo
diff -u pkgsrc/graphics/py-Pillow/distinfo:1.73 pkgsrc/graphics/py-Pillow/distinfo:1.74
--- pkgsrc/graphics/py-Pillow/distinfo:1.73     Thu Apr  2 08:50:43 2026
+++ pkgsrc/graphics/py-Pillow/distinfo  Wed Jul  1 12:58:28 2026
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.73 2026/04/02 08:50:43 adam Exp $
+$NetBSD: distinfo,v 1.74 2026/07/01 12:58:28 adam Exp $
 
-BLAKE2s (pillow-12.2.0.tar.gz) = bff52b425d9dd025a28fc5cdf5a361c4864704cdbfaab13a0a64dfa8ec2fe56e
-SHA512 (pillow-12.2.0.tar.gz) = 3ee49645468bee4f3013e8b0a099e0d30ddf03cd77456c308bfb1fefe923e963bfabb0ac72e927569724cbe390543115879c19ae110cc71dcb3180a587357895
-Size (pillow-12.2.0.tar.gz) = 46987819 bytes
+BLAKE2s (pillow-12.3.0.tar.gz) = 6ff262807ef43f7b54d7b963e7c18d653e29919c74f149b6cdda797669c0292a
+SHA512 (pillow-12.3.0.tar.gz) = b47a3e44932fe64a345b8a829140e155f22cad5a04e488fd2ba04dca0329b563ab7f07dc6ee34fbea3575aae82d6e071338bdfb64ae15ea340b9eea1063b28b3
+Size (pillow-12.3.0.tar.gz) = 47025035 bytes
 SHA1 (patch-setup.py) = 5f28aca4aa1d458c2e359814573ff17dae20c36b