Bump pillow from 10.2.0 to 10.3.0

[dependabot]

Bumps pillow from 10.2.0 to 10.3.0.

Release notes

Sourced from [pillow's releases](https://github.com/python-pillow/Pillow/releases).

10.3.0

[https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html](https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html)

Changes

• CVE-2024-28219: Use strncpy to avoid buffer overflow [[Due 12/6] Setting DNS Records for 2022 MozFest Plaza  #7928](https://redirect.github.com/CVE-2024-28219: Use strncpy to avoid buffer overflow python-pillow/Pillow#7928) [@​hugovk]
• Use functools.lru_cache for hopper() [Bump boto3 from 1.18.36 to 1.20.10 #7912](https://redirect.github.com/Use functools.lru_cache for hopper() python-pillow/Pillow#7912) [@​hugovk]
• Raise ValueError if seeking to greater than offset-sized integer in TIFF [mozfest nav button should always be editable in the CMS #7883](https://redirect.github.com/Raise ValueError if seeking to greater than offset-sized integer in TIFF python-pillow/Pillow#7883) [@​radarhere]
• Improve speed of loading QOI images [7923 - Can’t browse some localized sub-categories #7925](https://redirect.github.com/Improve speed of loading QOI images python-pillow/Pillow#7925) [@​radarhere]
• Added RGB to I;16N conversion [Make GIF for RegretsReporter Email #7920](https://redirect.github.com/Added RGB to I;16N conversion python-pillow/Pillow#7920) [@​radarhere]
• Add --report argument to main.py to omit supported formats [ensure product/category pairs never have NULL categories #7818](https://redirect.github.com/Add --report argument to __main__.py to omit supported formats python-pillow/Pillow#7818) [@​nulano]
• Added RGB to I;16, I;16L and I;16B conversion [Manually build youtube regrets extension page #7918](https://redirect.github.com/Added RGB to I;16, I;16L and I;16B conversion python-pillow/Pillow#7918) [@​radarhere]
• Fix editable installation with custom build backend and configuration options [Localize footer sign up snippet #7658](https://redirect.github.com/Fix editable installation with custom build backend and configuration options python-pillow/Pillow#7658) [@​nulano]
• Fix putdata() for I;16N on big-endian [Wagtail demo pages #7209](https://redirect.github.com/Fix putdata() for I;16N on big-endian python-pillow/Pillow#7209) [@​Yay295]
• Determine MPO size from markers, not EXIF data [restore all content_panels, after which we can decide which to filter out #7884](https://redirect.github.com/Determine MPO size from markers, not EXIF data python-pillow/Pillow#7884) [@​radarhere]
• Improved conversion from RGB to RGBa, LA and La [Add nocache header for CSRF route #7888](https://redirect.github.com/Improved conversion from RGB to RGBa, LA and La python-pillow/Pillow#7888) [@​radarhere]
• Support FITS images with GZIP_1 compression [Set up google analytics events for RegretsReporter Landing Page #7894](https://redirect.github.com/Support FITS images with GZIP_1 compression python-pillow/Pillow#7894) [@​radarhere]
• Use I;16 mode for 9-bit JPEG 2000 images [7787 - drag to scroll on desktop #7900](https://redirect.github.com/Use I;16 mode for 9-bit JPEG 2000 images python-pillow/Pillow#7900) [@​scaramallion]
• Raise ValueError if kmeans is negative [remove wagtail-modeltranslation inheritance #7891](https://redirect.github.com/Raise ValueError if kmeans is negative python-pillow/Pillow#7891) [@​radarhere]
• Remove TIFF tag OSUBFILETYPE when saving using libtiff [RegretsReporter Screen shots #7893](https://redirect.github.com/Remove TIFF tag OSUBFILETYPE when saving using libtiff python-pillow/Pillow#7893) [@​radarhere]
• Raise ValueError for negative values when loading P1-P3 PPM images [SEO improvements #7882](https://redirect.github.com/Raise ValueError for negative values when loading P1-P3 PPM images python-pillow/Pillow#7882) [@​radarhere]
• Added reading of JPEG2000 palettes [Fix link in PNI How to use page #7870](https://redirect.github.com/Added reading of JPEG2000 palettes python-pillow/Pillow#7870) [@​radarhere]
• Added alpha_quality argument when saving WebP images [[PNI] PNI specific error pages #7872](https://redirect.github.com/Added alpha_quality argument when saving WebP images python-pillow/Pillow#7872) [@​radarhere]
• Fixed joined corners for ImageDraw rounded_rectangle() non-integer dimensions [7834 - Fix AI column Problems #7881](https://redirect.github.com/Fixed joined corners for ImageDraw rounded_rectangle() non-integer dimensions python-pillow/Pillow#7881) [@​radarhere]
• Removed Python and NumPy pinning on Cygwin [switch PNI product voting CSRF over to just-in-time fetching #7880](https://redirect.github.com/Removed Python and NumPy pinning on Cygwin python-pillow/Pillow#7880) [@​radarhere]
• Update UnidentifiedImageError and version imports [[PNI] - Subcategories - harden the subcategory form/save logic #7644](https://redirect.github.com/Update UnidentifiedImageError and __version__ imports python-pillow/Pillow#7644) [@​radarhere]
• Stop reading EPS image at EOF marker [WIP: Rich text product field update #7753](https://redirect.github.com/Stop reading EPS image at EOF marker python-pillow/Pillow#7753) [@​radarhere]
• PSD layer co-ordinates may be negative [added UL to tips to protect self #7706](https://redirect.github.com/PSD layer co-ordinates may be negative python-pillow/Pillow#7706) [@​radarhere]
• Use subprocess with CREATE_NO_WINDOW flag in ImageShow WindowsViewer [Youtube Regrets Extension Landing Page #7791](https://redirect.github.com/Use subprocess with CREATE_NO_WINDOW flag in ImageShow WindowsViewer python-pillow/Pillow#7791) [@​radarhere]
• When saving GIF frame that restores to background color, do not fill identical pixels [Link buttons on articles are misaligned #7788](https://redirect.github.com/When saving GIF frame that restores to background color, do not fill identical pixels python-pillow/Pillow#7788) [@​radarhere]
• Fixed reading PNG iCCP compression method [updated copy for press and why page #7823](https://redirect.github.com/Fixed reading PNG iCCP compression method python-pillow/Pillow#7823) [@​radarhere]
• Allow writing IFDRational to UNDEFINED tag [7703- Fixed spacing issues on product pages #7840](https://redirect.github.com/Allow writing IFDRational to UNDEFINED tag python-pillow/Pillow#7840) [@​radarhere]
• Fix logged tag name when loading Exif data [Yt regrets landing top half #7842](https://redirect.github.com/Fix logged tag name when loading Exif data python-pillow/Pillow#7842) [@​radarhere]
• Use maximum frame size in IHDR chunk when saving APNG images [Publishing the "Facebook Portal Go" product crashes with a locale key unique violation #7821](https://redirect.github.com/Use maximum frame size in IHDR chunk when saving APNG images python-pillow/Pillow#7821) [@​radarhere]
• Prevent opening P TGA images without a palette [Implement localization for landing page content #7797](https://redirect.github.com/Prevent opening P TGA images without a palette python-pillow/Pillow#7797) [@​radarhere]
• Use palette when loading ICO images [Delete old "master" branch from fomo repo #7798](https://redirect.github.com/Use palette when loading ICO images python-pillow/Pillow#7798) [@​radarhere]
• Use consistent arguments for load_read and load_seek [added web monetization message to foundation site #7713](https://redirect.github.com/Use consistent arguments for load_read and load_seek python-pillow/Pillow#7713) [@​radarhere]
• Turn off nullability warnings for macOS SDK [PNI cutoff date is not synchronized with translations #7827](https://redirect.github.com/Turn off nullability warnings for macOS SDK python-pillow/Pillow#7827) [@​radarhere]
• Fix shift-sign issue in Convert.c [Regrets Reporter Extension landing bottom half  #7838](https://redirect.github.com/Fix shift-sign issue in Convert.c python-pillow/Pillow#7838) [@​r-barnes]
• winbuild: Refactor dependency versions into constants [[PNI QA] Hide empty field subheadings (What data does the company collect?) #7843](https://redirect.github.com/winbuild: Refactor dependency versions into constants python-pillow/Pillow#7843) [@​hugovk]
• Build macOS arm64 wheels natively [Bump browserslist from 4.17.0 to 4.18.0 #7852](https://redirect.github.com/Build macOS arm64 wheels natively python-pillow/Pillow#7852) [@​radarhere]
• Fixed typo [Bump psycopg2-binary from 2.9.1 to 2.9.2 #7855](https://redirect.github.com/Fixed typo python-pillow/Pillow#7855) [@​radarhere]
• Open 16-bit grayscale PNGs as I;16 [Bump eslint-plugin-react from 7.25.1 to 7.27.0 #7849](https://redirect.github.com/Open 16-bit grayscale PNGs as I;16 python-pillow/Pillow#7849) [@​radarhere]
• Handle truncated chunks at the end of PNG images [load search when the page loads, rather than when react is done #7709](https://redirect.github.com/Handle truncated chunks at the end of PNG images python-pillow/Pillow#7709) [@​lajiyuan]
• Match mask size to pasted image size in GifImagePlugin [[PNI Website] Design support & reviews for dev work cont. V #7779](https://redirect.github.com/Match mask size to pasted image size in GifImagePlugin python-pillow/Pillow#7779) [@​radarhere]
• Changed SupportsGetMesh protocol to be public [Fix filter for loop error #7841](https://redirect.github.com/Changed SupportsGetMesh protocol to be public python-pillow/Pillow#7841) [@​radarhere]
• Release GIL while calling WebPAnimDecoderGetNext [[PNI Website] Create tags in google tag manager #7782](https://redirect.github.com/Release GIL while calling WebPAnimDecoderGetNext python-pillow/Pillow#7782) [@​evanmiller]
• Fixed reading FLI/FLC images with a prefix chunk [Bump @sentry/browser from 6.2.1 to 6.14.1 #7804](https://redirect.github.com/Fixed reading FLI/FLC images with a prefix chunk python-pillow/Pillow#7804) [@​twolife]
• Updated package name for Tidelift [Bump faker from 8.12.1 to 9.8.0 #7810](https://redirect.github.com/Updated package name for Tidelift python-pillow/Pillow#7810) [@​radarhere]
• Removed unused code [[DO NOT MERGE] Pni merge attempt 2 #7744](https://redirect.github.com/Removed unused code python-pillow/Pillow#7744) [@​radarhere]

... (truncated)

Changelog

Sourced from [pillow's changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst).

10.3.0 (2024-04-01)

• CVE-2024-28219: Use strncpy to avoid buffer overflow [[Due 12/6] Setting DNS Records for 2022 MozFest Plaza  #7928](https://redirect.github.com/CVE-2024-28219: Use strncpy to avoid buffer overflow python-pillow/Pillow#7928) [radarhere, hugovk]

• Deprecate eval(), replacing it with lambda_eval() and unsafe_eval() [7918 - Add youtube regrets page extension to parent #7927](https://redirect.github.com/Deprecate eval(), replacing it with lambda_eval() and unsafe_eval() python-pillow/Pillow#7927) [radarhere, hugovk]

• Raise ValueError if seeking to greater than offset-sized integer in TIFF [mozfest nav button should always be editable in the CMS #7883](https://redirect.github.com/Raise ValueError if seeking to greater than offset-sized integer in TIFF python-pillow/Pillow#7883) [radarhere]

• Add --report argument to **main**.py to omit supported formats [ensure product/category pairs never have NULL categories #7818](https://redirect.github.com/Add --report argument to __main__.py to omit supported formats python-pillow/Pillow#7818) [nulano, radarhere, hugovk]

• Added RGB to I;16, I;16L, I;16B and I;16N conversion [Manually build youtube regrets extension page #7918](https://redirect.github.com/Added RGB to I;16, I;16L and I;16B conversion python-pillow/Pillow#7918), [Make GIF for RegretsReporter Email #7920](https://redirect.github.com/Added RGB to I;16N conversion python-pillow/Pillow#7920) [radarhere]

• Fix editable installation with custom build backend and configuration options [Localize footer sign up snippet #7658](https://redirect.github.com/Fix editable installation with custom build backend and configuration options python-pillow/Pillow#7658) [nulano, radarhere]

• Fix putdata() for I;16N on big-endian [Wagtail demo pages #7209](https://redirect.github.com/Fix putdata() for I;16N on big-endian python-pillow/Pillow#7209) [Yay295, hugovk, radarhere]

• Determine MPO size from markers, not EXIF data [restore all content_panels, after which we can decide which to filter out #7884](https://redirect.github.com/Determine MPO size from markers, not EXIF data python-pillow/Pillow#7884) [radarhere]

• Improved conversion from RGB to RGBa, LA and La [Add nocache header for CSRF route #7888](https://redirect.github.com/Improved conversion from RGB to RGBa, LA and La python-pillow/Pillow#7888) [radarhere]

• Support FITS images with GZIP_1 compression [Set up google analytics events for RegretsReporter Landing Page #7894](https://redirect.github.com/Support FITS images with GZIP_1 compression python-pillow/Pillow#7894) [radarhere]

• Use I;16 mode for 9-bit JPEG 2000 images [7787 - drag to scroll on desktop #7900](https://redirect.github.com/Use I;16 mode for 9-bit JPEG 2000 images python-pillow/Pillow#7900) [scaramallion, radarhere]

• Raise ValueError if kmeans is negative [remove wagtail-modeltranslation inheritance #7891](https://redirect.github.com/Raise ValueError if kmeans is negative python-pillow/Pillow#7891) [radarhere]

• Remove TIFF tag OSUBFILETYPE when saving using libtiff [RegretsReporter Screen shots #7893](https://redirect.github.com/Remove TIFF tag OSUBFILETYPE when saving using libtiff python-pillow/Pillow#7893) [radarhere]

• Raise ValueError for negative values when loading P1-P3 PPM images [SEO improvements #7882](https://redirect.github.com/Raise ValueError for negative values when loading P1-P3 PPM images python-pillow/Pillow#7882) [radarhere]

• Added reading of JPEG2000 palettes [Fix link in PNI How to use page #7870](https://redirect.github.com/Added reading of JPEG2000 palettes python-pillow/Pillow#7870) [radarhere]

• Added alpha_quality argument when saving WebP images [[PNI] PNI specific error pages #7872](https://redirect.github.com/Added alpha_quality argument when saving WebP images python-pillow/Pillow#7872) [radarhere]

... (truncated)

Commits

• 5c89d88 10.3.0 version bump
• 63cbfcf Update CHANGES.rst [ci skip]
• 2776126 Merge pull request [[Due 12/6] Setting DNS Records for 2022 MozFest Plaza  #7928](https://redirect.github.com/CVE-2024-28219: Use strncpy to avoid buffer overflow python-pillow/Pillow#7928) from python-pillow/lcms
• aeb51cb Merge branch 'main' into lcms
• 5beb0b6 Update CHANGES.rst [ci skip]
• cac6ffa Merge pull request [7918 - Add youtube regrets page extension to parent #7927](https://redirect.github.com/Deprecate eval(), replacing it with lambda_eval() and unsafe_eval() python-pillow/Pillow#7927) from python-pillow/imagemath
• f5eeeac Name as 'options' in lambda_eval and unsafe_eval, but '_dict' in deprecated eval
• facf3af Added release notes
• 2a93aba Use strncpy to avoid buffer overflow
• a670597 Update CHANGES.rst [ci skip]
• Additional commits viewable in [compare view](https://github.com/python-pillow/Pillow/compare/10.2.0...10.3.0)

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

┆Issue is synchronized with this Jira Story

[robdivincenzo]

@dependabot rebase

[data-sync-user]

➤ Simon Acosta Torres commented:

PR has been merged.