Post by Pillow - blankpad.net

blankpad.net

1y

Pillow 10.3.0 has been released!

Includes security fixes, some deprecations, API additions and changes, performance improvements and type hints.

* https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html
* https://github.com/python-pillow/Pillow/releases/tag/10.3.0

This was our first release with cibuildwheel + PyPI publish GitHub Action + Trusted Publishers and it went smoothly!

Thanks to the teams who created those, and as always, to all our contributors.

#PythonPillow #Python #Pillow #OpenSource #release

10.3.0

Security

ImageMath eval()

ImageMath.eval() uses Python’s eval() function to process the expression string, and carries the security risks of doing so. A direct replacement for this is the new unsafe_eval(), but that carries the same risks. It is not recommended to process expressions without considering this. lambda_eval() is a more secure alternative.

CVE-2024-28219: Fix buffer overflow in _imagingcms.c

In _imagingcms.c, two strcpy calls were able to copy too much data into fixed length strings. This has been fixed by using strncpy instead.

API Changes

Added alpha_quality argument when saving WebP images

When saving WebP images, an alpha_quality argument can be passed to the encoder. It is an integer value between 0 to 100, where values other than 100 will provide lossy compression.

Negative kmeans error

When calling quantize(), a negative kmeans will now raise a ValueError, unless a palette is supplied to make the value redundant.

Negative P1-P3 PPM value error

If a P1-P3 PPM image contains a negative value, a ValueError will now be raised.

API Additions

Added PerspectiveTransform

PerspectiveTransform has been added, meaning that all of the Transform values now have a corresponding subclass of Transform.

Other Changes

Portable FloatMap (PFM) images
Support has been added for reading and writing grayscale (Pf format) Portable FloatMap (PFM) files containing F data.

Release GIL when fetching WebP frames

Python’s Global Interpreter Lock is now released when fetching WebP frames from the libwebp decoder.

Type hints

Pillow now has type hints for a large part of its modules, and the package includes a py.typed file and the Typing :: Typed Trove classifier.

Deprecations

ImageCms constants and versions() function

A number of constants and a function in ImageCms have been deprecated. This includes a table of flags based on LittleCMS version 1 which has been replaced with a new class ImageCms.Flags based on LittleCMS 2 flags.

Check the full release notes for the table of replacements.

ImageMath.eval()

ImageMath.eval() has been deprecated. Use lambda_eval() or unsafe_eval() instead. See earlier security notes for more information.

0 0 0 View Post & Replies See Original