feat(python): add local cross-encoder reranker support - #445
feat(python): add local cross-encoder reranker support#445Hendrixx-RE wants to merge 27 commits into
Conversation
|
|
There was a problem hiding this comment.
All reported issues were addressed
You’re at about 96% of the monthly reviewed-line limit. You may want to disable incremental reviews to conserve quota. Reviews will continue until that limit is exceeded. If you need help avoiding interruptions, please contact contact@cubic.dev.
Reply with feedback, questions, or to request a fix.
Fix all with cubic | Re-trigger cubic
7000b7d to
01dfb22
Compare
|
@HarshaNalluru if this is indeed the intended output,then Ill implement it on the js sdk also and wrap it up with tests and documentation |
01dfb22 to
6f56b8a
Compare
Codex reviewThe PR has a definite import-time syntax regression in one cookbook example and a release workflow ordering issue that can publish/tag ten-moss before all supported Python versions pass. |
## PR 1 of 2 — `ten-moss` session manager Deep integration between **Moss** (sub-10ms on-device semantic search) and the **[TEN Framework](https://github.com/ten-framework/ten-framework)** (real-time multimodal conversational AI). This first PR lands the reusable, offline-testable core; the runnable, Moss-wired TEN voice-assistant example follows in PR 2. ### What's in this PR `packages/ten-moss/` — a **Moss session manager** for TEN, built on the Moss [Sessions API](https://docs.moss.dev/docs/reference/python/sessions): - **`MossSessionManager`** — wraps a Moss session (`await client.session(index_name=...)`, a local in-process index) and manages a voice agent's session-scoped grounding. Its surface mirrors the Sessions SDK: - `await open()` — open the session (create-or-resume) - `await query_context(text) -> str` — injection-ready grounding for this turn; `""` on blank/no-hit/error (never raises into the caller, so the voice loop never stalls) - `await add_docs(docs)` / `await get_docs()` / `await delete_docs(ids)` — session document ops - `await push_index()` — persist the session to the cloud for durability / cross-agent handoff - `doc_count`; disabled via `enable_moss=false` (constructs no client, all methods no-op) - **`MossSessionConfig`** — pydantic model standardizing the `moss_*` property names (`moss_project_id`, `moss_index_name`, `moss_model_id`, `moss_top_k`, `moss_alpha`, `moss_context_header`, `enable_moss`) that the TEN app in PR 2 consumes from `property.json`. - **`examples/create_index.py`** — builds a demo index. - Packaging + docs: `pyproject.toml` (uv), `README.md`, `CHANGELOG.md`, `CONTRIBUTING.md`, `.env.example`, `LICENSE`; AGENTS.md entries. The callable surface is deliberately session-oriented — a control extension asks for grounding, it does not issue retrieval calls. ### How it will be used (preview of PR 2) In the TEN control extension, on each final ASR transcript: ```python ctx = await session.query_context(text) await agent.queue_llm_input(f"{ctx}\n\n[Current User Question]\n{text}" if ctx else text) ``` This mirrors TEN Agent's own memory/RAG integrations (`voice-assistant-with-memU`). ### Testing - **15 offline unit tests** (`uv run pytest tests/`), mocking the Moss client + session — no credentials, no network. Covers config defaults, `start`/`context_for`/`remember`/`persist`/`doc_count`, context formatting, and the degrade-to-`""` paths (blank input, no hits, exception, timeout). - `ruff check` + `ruff format --check` clean. ### Notes for reviewers - Tests use the repo's mocked-client convention (as in `examples/cookbook/langchain/test_integration.py`) — deterministic, always CI-green. - The root README **Integrations** table row is intentionally **deferred to PR 2**, where it can point at the runnable `apps/ten-moss/` demo instead of a helper-only package. ### The 2-PR plan 1. **`packages/ten-moss/`** (this PR) — reusable session-manager core + tests. 2. **`apps/ten-moss/`** — a full runnable TEN voice assistant with `MossSessionManager` wired into the control extension (vendored from TEN's `voice-assistant` example + the Moss delta), a sample knowledge corpus, and user-facing docs.
## Pull Request Checklist - [x] I have read the [CONTRIBUTING](CONTRIBUTING.md) guide. - [ ] I have updated the documentation (if applicable). — N/A, one-line tag fix - [x] My code follows the style guidelines of this project. - [x] I have performed a self-review of my own code. - [ ] I have added tests that prove my fix is effective. — N/A, syntax fix - [x] New and existing unit tests pass locally with my changes. ## Description The drop-zone `<label>` element in `apps/moss-llamaindex/frontend/components/demo/upload-section.tsx` was closed with `</div>` instead of `</label>` (line 92), causing Turbopack to fail on `npm run build` with `Expected '</', got 'jsx text'`. Changed the closing tag to `</label>`. Verified the file now parses cleanly. Fixes usemoss#440 ## Type of Change - [x] Bug fix (non-breaking change which fixes an issue) <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/usemoss/moss/pull/443?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. -->
## Pull Request Checklist Please ensure that your PR meets the following requirements: - [x] I have read the [CONTRIBUTING](CONTRIBUTING.md) guide. - [x] I have updated the documentation (if applicable). - [x] My code follows the style guidelines of this project. - [x] I have performed a self-review of my own code. - [x] I have added tests that prove my fix is effective or that my feature works. - [x] New and existing unit tests pass locally with my changes. ## Description Adds an n8n community node for Moss index and query operations (`packages/n8n-nodes-moss`), so no-code workflows can create indexes, upsert documents, and run semantic search via the Moss Control Plane HTTP API. Fixes usemoss#345 ## Type of Change - [ ] Bug fix (non-breaking change which fixes an issue) - [x] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] This change requires a documentation update --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
…#453) Follow-up to usemoss#396: make `ten-moss` **releasable** to PyPI. Release pipeline + package changes only — the usage/latency example is split into usemoss#454. ## What - **`.github/workflows/publish-ten-moss.yml`** — `workflow_dispatch` release, mirrors `publish-pipecat-moss.yml`: reads version from pyproject, builds, smoke-tests `import ten_moss`, publishes to PyPI (`PYPI_API_TOKEN`), tags `ten-moss-v<version>`. - **`MossSessionManager.last_time_taken_ms`** — exposes the engine-measured retrieval time from `SearchResult.time_taken_ms` (set on each `query_context`; `None` before first query / on error). Additive; all 24 offline tests pass. - Version **0.0.1 → 0.1.0**; CHANGELOG + README (API row). ## Release steps (after merge) 1. Merge this PR. 2. Run the **Publish ten-moss** workflow (`workflow_dispatch`). 3. Verify `pip install ten-moss==0.1.0` and `import ten_moss`. Depends on `moss>=1.7.1` (1.7.2 published), `pydantic>=2`, `loguru>=0.7`. --- Example / latency breakdown: **usemoss#454** (stacked on this PR).
…ant app (usemoss#399) ## PR 2 of 2 — `apps/ten-moss/`: TEN voice assistant with Moss session grounding The runnable half of the Moss ↔ [TEN Framework](https://github.com/ten-framework/ten-framework) integration. A real-time voice agent that, on each final ASR transcript, asks a **Moss session** for session-scoped grounding (~1–10ms, in-process) and injects it into the LLM prompt before the model responds. > **Depends on usemoss#396 — merge that first.** This branch's `main_python` imports > `ten_moss` (`MossSessionManager`), which ships in usemoss#396. On `main` (both merged) > the import resolves; in isolation this PR won't import `ten_moss`. ### The Moss delta (the part to review) The `tenapp/` baseline is vendored verbatim from TEN's `voice-assistant` example; the Moss integration is a small, localized delta in the `main_python` control extension: - **`config.py`** — `MainControlConfig(MossSessionConfig)` picks up the `moss_*` properties. - **`extension.py` `on_init`** — opens the session, best-effort: ```python if self.config.enable_moss and self.config.moss_index_name: self.moss = MossSessionManager.from_config(self.config) await self.moss.open() ``` - **`extension.py` `_on_asr_result`** (final turn) — grounds the turn (guarded so a grounding failure can't drop the turn): ```python ctx = await self.moss.query_context(event.text) llm_input = f"{ctx}\n\n[Current User Question]\n{event.text}" if ctx else event.text await self.agent.queue_llm_input(llm_input) ``` - **`manifest.json`** declares the `moss_*` properties; **`requirements.txt`** documents the `ten-moss` install (not a hard PyPI pin, since it isn't published yet). - **`tenapp/property.json`** sets `moss_*` on the `main_control` node (env-substituted). Plus a sample corpus (`data/knowledge.jsonl`) and `create_index.py` to build the demo index. ### Graph `agora_rtc → streamid_adapter → stt(deepgram) → main_control(main_python) → llm(openai) → tts(elevenlabs) → agora_rtc`, with `message_collector2` for transcripts. Identical to TEN's `voice-assistant` graph minus the weather tool. ### Provenance / license `tenapp/` (graph, `main_python`, agent runtime, scripts) is vendored from ten-framework at commit [`c385d27`](https://github.com/ten-framework/ten-framework/tree/c385d2724a1f3e6ac4ee0b81fcc7dada8346c0e0/ai_agents/agents/examples/voice-assistant) under **Apache-2.0** (headers preserved). Only the Moss delta above — plus two small correctness patches (`decorators.py` annotation, defensive `session_id` parse) — is applied on top. The repo-level TEN monorepo harness (Taskfile/Dockerfile/playground/server) is intentionally **not** vendored; this example is designed to run inside a TEN Framework checkout (it references shared `ten_packages` via `../../../`). See the app README. ### Validation Static checks all pass: JSON parse (4 files), JSONL corpus (10 docs), `py_compile` (all 11 modules incl. the vendored runtime), import graph resolves, `create_index.load_documents()` returns 10 docs. **Not** run end-to-end in CI — it needs the TEN toolchain (tman/Docker) plus Agora/Deepgram/OpenAI/ElevenLabs keys. Documented for manual runs in the app README. The `ten-moss` logic itself is covered by the offline unit tests in usemoss#396. ### Running (summary) ```bash cp .env.example .env # Moss + provider keys python create_index.py # build the demo index (from this dir; needs only the Moss SDK) ``` Then drop `tenapp/` into a TEN Framework checkout and run it with TEN's own tooling (after `uv pip install -e /path/to/moss/packages/ten-moss`). Full steps in the app README.
…semoss#451) Bumps the uv group with 6 updates in the /apps/agora-moss directory: | Package | From | To | | --- | --- | --- | | [mcp](https://github.com/modelcontextprotocol/python-sdk) | `1.27.0` | `1.28.1` | | [cryptography](https://github.com/pyca/cryptography) | `46.0.7` | `48.0.1` | | [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.13.1` | `2.14.2` | | [pyjwt](https://github.com/jpadilla/pyjwt) | `2.12.1` | `2.13.0` | | [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.27` | `0.0.31` | | [starlette](https://github.com/Kludex/starlette) | `1.0.1` | `1.3.1` | Bumps the uv group with 7 updates in the /apps/livekit-moss-vercel/livekit-voice-agent/livekit-moss-agent directory: | Package | From | To | | --- | --- | --- | | [mcp](https://github.com/modelcontextprotocol/python-sdk) | `1.23.0` | `1.28.1` | | [cryptography](https://github.com/pyca/cryptography) | `46.0.7` | `48.0.1` | | [pyjwt](https://github.com/jpadilla/pyjwt) | `2.12.1` | `2.13.0` | | [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.27` | `0.0.31` | | [starlette](https://github.com/Kludex/starlette) | `1.0.1` | `1.3.1` | | [aiohttp](https://github.com/aio-libs/aiohttp) | `3.14.0` | `3.14.1` | | [pillow](https://github.com/python-pillow/Pillow) | `12.2.0` | `12.3.0` | Bumps the uv group with 7 updates in the /apps/pipecat-moss/hume-ollama-local directory: | Package | From | To | | --- | --- | --- | | [cryptography](https://github.com/pyca/cryptography) | `46.0.7` | `48.0.1` | | [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.13.1` | `2.14.2` | | [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.27` | `0.0.31` | | [starlette](https://github.com/Kludex/starlette) | `1.0.1` | `1.3.1` | | [aiohttp](https://github.com/aio-libs/aiohttp) | `3.14.0` | `3.14.1` | | [pillow](https://github.com/python-pillow/Pillow) | `12.2.0` | `12.3.0` | | [nltk](https://github.com/nltk/nltk) | `3.9.4` | `3.10.0` | Bumps the uv group with 7 updates in the /apps/pipecat-moss/ollama-local directory: | Package | From | To | | --- | --- | --- | | [cryptography](https://github.com/pyca/cryptography) | `46.0.7` | `48.0.1` | | [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.13.1` | `2.14.2` | | [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.27` | `0.0.31` | | [starlette](https://github.com/Kludex/starlette) | `1.0.1` | `1.3.1` | | [aiohttp](https://github.com/aio-libs/aiohttp) | `3.14.0` | `3.14.1` | | [pillow](https://github.com/python-pillow/Pillow) | `12.2.0` | `12.3.0` | | [nltk](https://github.com/nltk/nltk) | `3.9.4` | `3.10.0` | Bumps the uv group with 4 updates in the /examples/cookbook/daytona directory: [python-multipart](https://github.com/Kludex/python-multipart), [aiohttp](https://github.com/aio-libs/aiohttp), [langchain](https://github.com/langchain-ai/langchain) and [langsmith](https://github.com/langchain-ai/langsmith-sdk). Bumps the uv group with 2 updates in the /examples/voice-agents/insurance-adjuster directory: [pillow](https://github.com/python-pillow/Pillow) and [json-repair](https://github.com/mangiucugna/json_repair). Bumps the uv group with 3 updates in the /examples/voice-agents/mortgage-lending directory: [pyjwt](https://github.com/jpadilla/pyjwt), [aiohttp](https://github.com/aio-libs/aiohttp) and [pillow](https://github.com/python-pillow/Pillow). Bumps the uv group with 4 updates in the /moss-live-labs/examples/advanced-voice-agent directory: [cryptography](https://github.com/pyca/cryptography), [pyjwt](https://github.com/jpadilla/pyjwt), [aiohttp](https://github.com/aio-libs/aiohttp) and [pillow](https://github.com/python-pillow/Pillow). Bumps the uv group with 1 update in the /moss-live-labs/examples/image-search/backend-py directory: [starlette](https://github.com/Kludex/starlette). Bumps the uv group with 3 updates in the /moss-live-labs/examples/voice-agent directory: [pyjwt](https://github.com/jpadilla/pyjwt), [aiohttp](https://github.com/aio-libs/aiohttp) and [pillow](https://github.com/python-pillow/Pillow). Bumps the uv group with 6 updates in the /packages/agora-moss directory: | Package | From | To | | --- | --- | --- | | [mcp](https://github.com/modelcontextprotocol/python-sdk) | `1.27.0` | `1.28.1` | | [cryptography](https://github.com/pyca/cryptography) | `46.0.7` | `48.0.1` | | [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.13.1` | `2.14.2` | | [pyjwt](https://github.com/jpadilla/pyjwt) | `2.12.1` | `2.13.0` | | [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.27` | `0.0.31` | | [starlette](https://github.com/Kludex/starlette) | `1.0.1` | `1.3.1` | Bumps the uv group with 2 updates in the /packages/moss-data-connector/moss-connector-supabase directory: [cryptography](https://github.com/pyca/cryptography) and [pyjwt](https://github.com/jpadilla/pyjwt). Bumps the uv group with 7 updates in the /packages/pipecat-moss directory: | Package | From | To | | --- | --- | --- | | [cryptography](https://github.com/pyca/cryptography) | `46.0.7` | `48.0.1` | | [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.12.0` | `2.14.2` | | [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.27` | `0.0.31` | | [starlette](https://github.com/Kludex/starlette) | `1.0.1` | `1.3.1` | | [aiohttp](https://github.com/aio-libs/aiohttp) | `3.14.0` | `3.14.1` | | [pillow](https://github.com/python-pillow/Pillow) | `12.2.0` | `12.3.0` | | [nltk](https://github.com/nltk/nltk) | `3.9.4` | `3.10.0` | Updates `mcp` from 1.27.0 to 1.28.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/modelcontextprotocol/python-sdk/releases">mcp's releases</a>.</em></p> <blockquote> <h2>v1.28.0</h2> <h2>Deprecations</h2> <p>Two API surfaces now emit <code>DeprecationWarning</code> ahead of their removal in v2. Nothing is removed in 1.x, and the warnings fire only when the deprecated API is <em>called</em> - importing the modules stays silent.</p> <ul> <li><strong>WebSocket transport</strong> - <code>mcp.client.websocket.websocket_client</code> and <code>mcp.server.websocket.websocket_server</code><code>modelcontextprotocol/typescript-sdk#1783</code></li> <li><strong>Experimental tasks API</strong> - <code>ClientSession.experimental</code>, <code>Server.experimental</code>, <code>ServerSession.experimental</code>, and the <code>experimental_task_handlers=</code> kwarg on <code>ClientSession</code>. Tasks (SEP-1686) were removed from the MCP specification and are expected to return as a separate MCP extension.</li> </ul> <p>If your test suite runs with <code>filterwarnings = ["error"]</code> and exercises these paths, add a scoped ignore such as <code>ignore:The experimental tasks API is deprecated:DeprecationWarning</code> or <code>ignore:The WebSocket .* transport is deprecated:DeprecationWarning</code>.</p> <p>See <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/2828">#2828</a> for full details.</p> <h2>What's Changed</h2> <ul> <li>[v1.x] Support Python 3.14 by <a href="https://github.com/maxisbey"><code>@maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2769">modelcontextprotocol/python-sdk#2769</a></li> <li>fix: omit null optional fields from task result payloads by <a href="https://github.com/liuzemei"><code>@liuzemei</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2809">modelcontextprotocol/python-sdk#2809</a></li> <li>[v1.x] Deprecate the WebSocket transport and the experimental tasks entry points by <a href="https://github.com/maxisbey"><code>@maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2828">modelcontextprotocol/python-sdk#2828</a></li> <li>[v1.x] Add a v2 status banner to the README by <a href="https://github.com/maxisbey"><code>@maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2835">modelcontextprotocol/python-sdk#2835</a></li> <li>[v1.x] Deflake the child process cleanup tests by <a href="https://github.com/maxisbey"><code>@maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2839">modelcontextprotocol/python-sdk#2839</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/liuzemei"><code>@liuzemei</code></a> made their first contribution in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2809">modelcontextprotocol/python-sdk#2809</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/modelcontextprotocol/python-sdk/compare/v1.27.2...v1.28.0">https://github.com/modelcontextprotocol/python-sdk/compare/v1.27.2...v1.28.0</a></p> <h2>v1.27.2</h2> <h2>What's Changed</h2> <ul> <li>[v1.x] ci: deploy docs to py.sdk.modelcontextprotocol.io via Pages artifact by <a href="https://github.com/maxisbey"><code>@maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2635">modelcontextprotocol/python-sdk#2635</a></li> <li>[v1.x] Add subject and claims to AccessToken by <a href="https://github.com/maxisbey"><code>@maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2690">modelcontextprotocol/python-sdk#2690</a></li> <li>[v1.x] Bind transport sessions to the authenticated principal by <a href="https://github.com/maxisbey"><code>@maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2719">modelcontextprotocol/python-sdk#2719</a></li> <li>[v1.x] Scope experimental tasks to the session that created them by <a href="https://github.com/maxisbey"><code>@maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2720">modelcontextprotocol/python-sdk#2720</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/modelcontextprotocol/python-sdk/compare/v1.27.1...v1.27.2">https://github.com/modelcontextprotocol/python-sdk/compare/v1.27.1...v1.27.2</a></p> <h2>v1.27.1</h2> <h2>What's Changed</h2> <ul> <li>[v1.x] fix: catch PydanticUserError when generating output schema (pydantic 2.13 compat) by <a href="https://github.com/maxisbey"><code>@maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2435">modelcontextprotocol/python-sdk#2435</a></li> <li>[v1.x] fix(auth): coerce empty-string optional URL fields to None in OAuthClientMetadata by <a href="https://github.com/felixweinberger"><code>@felixweinberger</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2405">modelcontextprotocol/python-sdk#2405</a></li> <li>[v1.x] build: restrict httpx to <1.0.0 by <a href="https://github.com/maxisbey"><code>@maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2559">modelcontextprotocol/python-sdk#2559</a></li> <li>[v1.x] refactor: import SSEError from httpx_sse public API by <a href="https://github.com/maxisbey"><code>@maxisbey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2561">modelcontextprotocol/python-sdk#2561</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/modelcontextprotocol/python-sdk/compare/v1.27.0...v1.27.1">https://github.com/modelcontextprotocol/python-sdk/compare/v1.27.0...v1.27.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/777b8d06710c140e3606b0d4598e2aa48546c266"><code>777b8d0</code></a> [v1.x] Support TransportSecuritySettings in the WebSocket server transport (#...</li> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/47204674fb26185c2cf45f065831f27b8e5d5c65"><code>4720467</code></a> [v1.x] Set Development Status classifier to Production/Stable (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/2976">#2976</a>)</li> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/6df3d734265eb49bf758a5e5eb420937337184e9"><code>6df3d73</code></a> [v1.x] Buffer per-request StreamableHTTP streams; store priming event before ...</li> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/32d32908feb7b15eddeb46872774bf95869cc5f0"><code>32d3290</code></a> [v1.x] Pass a list to parametrize in test_docs_examples (pytest 9.1.0 compat)...</li> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/0dca751056dc87d04893d53af129fd00b56a18da"><code>0dca751</code></a> [v1.x] Deflake the child process cleanup tests (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/2839">#2839</a>)</li> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/52258a95645c66fccbe925289c3382712b9bc68a"><code>52258a9</code></a> [v1.x] Add a v2 status banner to the README (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/2835">#2835</a>)</li> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/b8f491724c45dbf89d6569364b58d6e8d25d7e42"><code>b8f4917</code></a> [v1.x] Deprecate the WebSocket transport and the experimental tasks entry poi...</li> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/2309e5ef974062748e0268c396eba73cfdb6f5e3"><code>2309e5e</code></a> fix: omit null optional fields from task result payloads (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/2809">#2809</a>)</li> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/494eb11d36b4238226cc0551da6015e1c73f7f3b"><code>494eb11</code></a> [v1.x] Support Python 3.14 (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/2769">#2769</a>)</li> <li><a href="https://github.com/modelcontextprotocol/python-sdk/commit/62137874ff26dd74d2fea80ff528a7fd9ca7a5e7"><code>6213787</code></a> [v1.x] Scope experimental tasks to the session that created them (<a href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/2720">#2720</a>)</li> <li>Additional commits viewable in <a href="https://github.com/modelcontextprotocol/python-sdk/compare/v1.27.0...v1.28.1">compare view</a></li> </ul> </details> <br /> Updates `cryptography` from 46.0.7 to 48.0.1 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst">cryptography's changelog</a>.</em></p> <blockquote> <p>48.0.1 - 2026-06-09</p> <pre><code> * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.1. <p>.. _v48-0-0:</p> <p>48.0.0 - 2026-05-04<br /> </code></pre></p> <ul> <li> <p><strong>BACKWARDS INCOMPATIBLE:</strong> Support for Python 3.8 has been removed. <code>cryptography</code> now requires Python 3.9 or later.</p> </li> <li> <p><strong>BACKWARDS INCOMPATIBLE:</strong> Loading an X.509 CRL whose inner <code>TBSCertList.signature</code> algorithm does not match the outer <code>signatureAlgorithm</code> now raises <code>ValueError</code>. Previously, such CRLs were parsed successfully and only rejected during signature validation.</p> </li> <li> <p>Added support for :doc:<code>/hazmat/primitives/asymmetric/mlkem</code> and :doc:<code>/hazmat/primitives/asymmetric/mldsa</code> when using OpenSSL 3.5.0 or later, in addition to the existing AWS-LC and BoringSSL support. This means post-quantum algorithms are now available to users of our wheels.</p> <ul> <li><strong>Note:</strong> Going forward, we do not guarantee that all functionality in <code>cryptography</code> will be available when building against OpenSSL. See :doc:<code>/statements/state-of-openssl</code> for more information.</li> </ul> </li> </ul> <p>.. _v47-0-0:</p> <p>47.0.0 - 2026-04-24</p> <pre><code> * Support for Python 3.8 is deprecated and will be removed in the next ``cryptography`` release. * **BACKWARDS INCOMPATIBLE:** Support for binary elliptic curves (``SECT*`` classes) has been removed. These curves are rarely used and have additional security considerations that make them undesirable. * **BACKWARDS INCOMPATIBLE:** Support for OpenSSL 1.1.x has been removed. OpenSSL 3.0.0 or later is now required. LibreSSL, BoringSSL, and AWS-LC continue to be supported. * **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL < 4.1. * **BACKWARDS INCOMPATIBLE:** Loading keys with unsupported algorithms or keys with unsupported explicit curve encodings now raises :class:`~cryptography.exceptions.UnsupportedAlgorithm` instead of ``ValueError``. This change affects :func:`~cryptography.hazmat.primitives.serialization.load_pem_private_key`, :func:`~cryptography.hazmat.primitives.serialization.load_der_private_key`, :func:`~cryptography.hazmat.primitives.serialization.load_pem_public_key`, :func:`~cryptography.hazmat.primitives.serialization.load_der_public_key`, and :meth:`~cryptography.x509.Certificate.public_key` when called on certificates with unsupported public key algorithms. </tr></table> </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pyca/cryptography/commit/de987ce48ccfeb1abca41efa23b2bf73ec704f74"><code>de987ce</code></a> 48.0.1 version bump and changelog (<a href="https://redirect.github.com/pyca/cryptography/issues/14996">#14996</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/8e03e30e3aae01632a697e903e3593c924f0139d"><code>8e03e30</code></a> bump for 48.0.0 release (<a href="https://redirect.github.com/pyca/cryptography/issues/14796">#14796</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/295e0d254ef31ab864730aa41312ec355416ee71"><code>295e0d2</code></a> Add AGENTS.md with CLAUDE.md symlink (<a href="https://redirect.github.com/pyca/cryptography/issues/14794">#14794</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/104a2de19e268a433e6da92be9cb872dcf0003c8"><code>104a2de</code></a> Bump BoringSSL, OpenSSL, AWS-LC in CI (<a href="https://redirect.github.com/pyca/cryptography/issues/14793">#14793</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/67ec1e51988195e17993d2edef5258b27509b926"><code>67ec1e5</code></a> call check_length early on AesSiv::encrypt (<a href="https://redirect.github.com/pyca/cryptography/issues/14792">#14792</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/b2da57a0d9e4bfd2b95364299091a18f74127b26"><code>b2da57a</code></a> changelog for mldsa/mlkem for openssl (<a href="https://redirect.github.com/pyca/cryptography/issues/14791">#14791</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/3cf44adee25c368d4a136e072fa9f80465d91eb0"><code>3cf44ad</code></a> ML-KEM OpenSSL support (<a href="https://redirect.github.com/pyca/cryptography/issues/14781">#14781</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/2e31639666766f846fbab2c605879db0fa64fe83"><code>2e31639</code></a> ML-DSA OpenSSL support (<a href="https://redirect.github.com/pyca/cryptography/issues/14773">#14773</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/5affe5a286a986fdf512c4a5cb280d28a96c10e3"><code>5affe5a</code></a> fix rust nightly clippy (<a href="https://redirect.github.com/pyca/cryptography/issues/14790">#14790</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/2e73ca448eaf64b6f0d4ffbb794cf96170cef5ec"><code>2e73ca4</code></a> bump rust-openssl dep and update EcPoint::mul_generator to mul_generator2 (<a href="https://redirect.github.com/pyca/cryptography/issues/1">#1</a>...</li> <li>Additional commits viewable in <a href="https://github.com/pyca/cryptography/compare/46.0.7...48.0.1">compare view</a></li> </ul> </details> <br /> Updates `pydantic-settings` from 2.13.1 to 2.14.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pydantic/pydantic-settings/releases">pydantic-settings's releases</a>.</em></p> <blockquote> <h2>v2.14.2</h2> <h2>What's Changed</h2> <p>This is a security patch release.</p> <ul> <li>Prevent <code>NestedSecretsSettingsSource</code> from following symlinks outside <code>secrets_dir</code> by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/889">pydantic/pydantic-settings#889</a></li> <li>Prepare release 2.14.2 by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/890">pydantic/pydantic-settings#890</a></li> </ul> <h3>Security</h3> <p>Fixes <a href="https://github.com/pydantic/pydantic-settings/security/advisories/GHSA-4xgf-cpjx-pc3j">GHSA-4xgf-cpjx-pc3j</a>: <code>NestedSecretsSettingsSource</code> with <code>secrets_nested_subdir=True</code> could follow a symbolic link inside <code>secrets_dir</code> pointing outside it, reading out-of-tree files into settings values and bypassing the <code>secrets_dir_max_size</code> cap. Affected versions: <code>>= 2.12.0, < 2.14.2</code>.</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/pydantic/pydantic-settings/compare/v2.14.1...v2.14.2">https://github.com/pydantic/pydantic-settings/compare/v2.14.1...v2.14.2</a></p> <h2>v2.14.1</h2> <h2>What's Changed</h2> <ul> <li>Bump the python-packages group with 4 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/850">pydantic/pydantic-settings#850</a></li> <li>Bump the python-packages group with 5 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/854">pydantic/pydantic-settings#854</a></li> <li>Bump the github-actions group with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/853">pydantic/pydantic-settings#853</a></li> <li>Bump the python-packages group with 2 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/856">pydantic/pydantic-settings#856</a></li> <li>Fix field named <code>cls</code> conflicting with classmethod parameter by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/858">pydantic/pydantic-settings#858</a></li> <li>Prepare release 2.14.1 by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/859">pydantic/pydantic-settings#859</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pydantic/pydantic-settings/compare/v2.14.0...v2.14.1">https://github.com/pydantic/pydantic-settings/compare/v2.14.0...v2.14.1</a></p> <h2>v2.14.0</h2> <h2>What's Changed</h2> <ul> <li>Fix parsing env vars into Optional Strict types by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/792">pydantic/pydantic-settings#792</a></li> <li>Fix RecursionError with mutually recursive models in CLI by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/794">pydantic/pydantic-settings#794</a></li> <li>Fix env_file from model_config ignored in CliApp.run() (<a href="https://redirect.github.com/pydantic/pydantic-settings/issues/795">#795</a>) by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/796">pydantic/pydantic-settings#796</a></li> <li>Update dependencies by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/798">pydantic/pydantic-settings#798</a></li> <li>Add Dependabot configuration by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/801">pydantic/pydantic-settings#801</a></li> <li>Bump samuelcolvin/check-python-version from 4.1 to 5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/802">pydantic/pydantic-settings#802</a></li> <li>Bump actions/upload-artifact from 4 to 7 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/803">pydantic/pydantic-settings#803</a></li> <li>Bump actions/checkout from 4 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/804">pydantic/pydantic-settings#804</a></li> <li>Bump astral-sh/setup-uv from 5 to 7 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/805">pydantic/pydantic-settings#805</a></li> <li>Bump actions/setup-python from 5 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/806">pydantic/pydantic-settings#806</a></li> <li>Ignore chardet and group GitHub Actions in Dependabot by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/808">pydantic/pydantic-settings#808</a></li> <li>Bump actions/download-artifact from 4 to 8 in the github-actions group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/809">pydantic/pydantic-settings#809</a></li> <li>Bump the python-packages group with 2 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/810">pydantic/pydantic-settings#810</a></li> <li>Support reading .env files from FIFOs (e.g. 1Password Environments) by <a href="https://github.com/JacobHayes"><code>@JacobHayes</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/776">pydantic/pydantic-settings#776</a></li> <li>Fix AliasChoices ignored when changing provider priority by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/813">pydantic/pydantic-settings#813</a></li> <li>fix: resolve KeyError in run_subcommand for underscore field names by <a href="https://github.com/bradykieffer"><code>@bradykieffer</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/799">pydantic/pydantic-settings#799</a></li> <li>Bump the python-packages group with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/814">pydantic/pydantic-settings#814</a></li> <li>Fix <code>Literal[numeric Enum]</code> coercion for CLI and env vars by <a href="https://github.com/m9810223"><code>@m9810223</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/811">pydantic/pydantic-settings#811</a></li> <li>Fix nested discriminated unions not discovered by env/CLI providers by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/816">pydantic/pydantic-settings#816</a></li> <li>Bump the python-packages group with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/820">pydantic/pydantic-settings#820</a></li> <li>CLI ensure env nested max split internally. by <a href="https://github.com/kschwab"><code>@kschwab</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/821">pydantic/pydantic-settings#821</a></li> <li>Bump the python-packages group with 4 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/824">pydantic/pydantic-settings#824</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pydantic/pydantic-settings/commit/d703bd717e5e07439fa89da2245eee6139413e9e"><code>d703bd7</code></a> Prepare release 2.14.2 (<a href="https://redirect.github.com/pydantic/pydantic-settings/issues/890">#890</a>)</li> <li><a href="https://github.com/pydantic/pydantic-settings/commit/e95c30bec8cfaee88ee275138c064aea97a25bdf"><code>e95c30b</code></a> Prepare release 2.14.1 (<a href="https://redirect.github.com/pydantic/pydantic-settings/issues/859">#859</a>)</li> <li><a href="https://github.com/pydantic/pydantic-settings/commit/0c8734581b6cf70a995afad603ac456631d00621"><code>0c87345</code></a> Fix field named <code>cls</code> conflicting with classmethod parameter (<a href="https://redirect.github.com/pydantic/pydantic-settings/issues/858">#858</a>)</li> <li><a href="https://github.com/pydantic/pydantic-settings/commit/7bd0072795a800065b42210b6dca90fc9b83daf7"><code>7bd0072</code></a> Bump the python-packages group with 2 updates (<a href="https://redirect.github.com/pydantic/pydantic-settings/issues/856">#856</a>)</li> <li><a href="https://github.com/pydantic/pydantic-settings/commit/b03e573d017ed48e1c2774a5e0b715db9766c76b"><code>b03e573</code></a> Bump the github-actions group with 3 updates (<a href="https://redirect.github.com/pydantic/pydantic-settings/issues/853">#853</a>)</li> <li><a href="https://github.com/pydantic/pydantic-settings/commit/eaa3b434938411ec8a3717ea646614561e713f51"><code>eaa3b43</code></a> Bump the python-packages group with 5 updates (<a href="https://redirect.github.com/pydantic/pydantic-settings/issues/854">#854</a>)</li> <li><a href="https://github.com/pydantic/pydantic-settings/commit/9f95615c24c6813c1d7d203576581a79cb6d9e8e"><code>9f95615</code></a> Bump the python-packages group with 4 updates (<a href="https://redirect.github.com/pydantic/pydantic-settings/issues/850">#850</a>)</li> <li><a href="https://github.com/pydantic/pydantic-settings/commit/8916beeecc6d0510e3d0532a0ed839937400ddc3"><code>8916bee</code></a> Prepare release 2.14.0 (<a href="https://redirect.github.com/pydantic/pydantic-settings/issues/848">#848</a>)</li> <li><a href="https://github.com/pydantic/pydantic-settings/commit/39e551c0910c85505b608ff85a103b2c9f7396c5"><code>39e551c</code></a> Fix CLI descriptions lost under <code>python -OO</code> by falling back to `json_schema_...</li> <li><a href="https://github.com/pydantic/pydantic-settings/commit/9ed7f48ea2c90f436a03b01f721fe6656c869b14"><code>9ed7f48</code></a> Bump the python-packages group with 4 updates (<a href="https://redirect.github.com/pydantic/pydantic-settings/issues/847">#847</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pydantic/pydantic-settings/compare/v2.13.1...v2.14.2">compare view</a></li> </ul> </details> <br /> Updates `pyjwt` from 2.12.1 to 2.13.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/releases">pyjwt's releases</a>.</em></p> <blockquote> <h2>2.13.0</h2> <h1>PyJWT 2.13.0 — Security Release</h1> <p>This release bundles five security fixes plus three additional hardening / spec-compliance changes. We recommend all users upgrade.</p> <h2>Security</h2> <ul> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx"><code>GHSA-xgmm-8j9v-c9wx</code></a> — JWK JSON accepted as HMAC secret (algorithm confusion).</strong> <code>HMACAlgorithm.prepare_key</code> previously rejected PEM- and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw JSON string. In a verifier configured with both symmetric and asymmetric algorithms in <code>algorithms=[…]</code> and a raw-JSON JWK as the key, an attacker could forge HS256 tokens using the JWK text as the HMAC secret. The guard has been extended to reject any JWK-shaped JSON. <em>Reported by <a href="https://github.com/aradona91"><code>@aradona91</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f"><code>GHSA-jq35-7prp-9v3f</code></a> — Algorithm allow-list bypass with <code>PyJWK</code> / <code>PyJWKClient</code>.</strong> When verifying with a <code>PyJWK</code>, the caller's <code>algorithms=[…]</code> allow-list was checked against the token header <code>alg</code> as a string only; actual verification used the algorithm bound to the <code>PyJWK</code>. An attacker who controlled a registered JWKS key could sign with one algorithm and advertise another on the header. PyJWT now requires the token header <code>alg</code> to match the <code>PyJWK</code>'s algorithm before verification. <em>Reported by <a href="https://github.com/sushi-gif"><code>@sushi-gif</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39"><code>GHSA-w7vc-732c-9m39</code></a> — DoS via base64 decode of unused payload segment when <code>b64=false</code>.</strong> For detached-payload JWS (<code>b64=false</code>), the compact-form payload segment was base64-decoded before being discarded in favor of the caller-supplied <code>detached_payload</code>. An attacker could inflate the unused segment to force CPU + memory cost without holding a valid signature. The segment is now required to be empty per RFC 7515 Appendix F, and is no longer decoded. <em>Reported by <a href="https://github.com/thesmartshadow"><code>@thesmartshadow</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4"><code>GHSA-993g-76c3-p5m4</code></a> — <code>PyJWKClient</code> accepts non-HTTP(S) URIs.</strong> <code>PyJWKClient.fetch_data</code> passed its URI to <code>urllib.request.urlopen</code>, which by default also handles <code>file://</code>, <code>ftp://</code>, and <code>data:</code> schemes. An application that fed an attacker-influenced URI into <code>PyJWKClient</code> could be coerced into reading local files or reaching other unintended schemes. <code>PyJWKClient</code> now rejects any URI whose scheme isn't <code>http</code> or <code>https</code>. <em>Reported by <a href="https://github.com/KEIJOT"><code>@KEIJOT</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8"><code>GHSA-fhv5-28vv-h8m8</code></a> — <code>PyJWKClient</code> cache wiped on fetch error.</strong> A <code>finally</code>-block <code>put(jwk_set=None)</code> cleared the JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint outage into application-wide auth failure. The cache write was moved into the success path; transient errors no longer evict valid cached keys. <em>Reported by <a href="https://github.com/eddieran"><code>@eddieran</code></a>.</em></p> </li> </ul> <h2>Fixed</h2> <ul> <li>Reject empty HMAC keys outright in <code>HMACAlgorithm.prepare_key</code> with <code>InvalidKeyError</code> instead of accepting them with only a warning. Defends against the <code>os.getenv("JWT_SECRET", "")</code> footgun. <em>Thanks to <a href="https://github.com/SnailSploit"><code>@SnailSploit</code></a> and <a href="https://github.com/spartan8806"><code>@spartan8806</code></a> for the reports.</em></li> <li>Forward per-call <code>options</code> (including <code>enforce_minimum_key_length</code>) from <code>PyJWT.decode</code> through to <code>PyJWS._verify_signature</code>. The option was previously silently dropped between the two layers, so it only took effect when set on the <code>PyJWT</code> instance. <em>Thanks to <a href="https://github.com/WLUB"><code>@WLUB</code></a> for the report.</em></li> <li><strong>RFC 7797 §3 compliance for <code>b64=false</code>:</strong> the encoder now auto-adds <code>"b64"</code> to <code>crit</code>, and the decoder rejects tokens that set <code>b64=false</code> without listing it in <code>crit</code>. <em>Thanks to <a href="https://github.com/MachineLearning-Nerd"><code>@MachineLearning-Nerd</code></a> for the report.</em></li> </ul> <h2>Changed</h2> <ul> <li>Migrate the <code>dev</code>, <code>docs</code>, and <code>tests</code> package extras to dependency groups, by <a href="https://github.com/kurtmckee"><code>@kurtmckee</code></a> in <a href="https://redirect.github.com/jpadilla/pyjwt/pull/1152">#1152</a>.</li> </ul> <h2>Upgrade notes</h2> <p>Most fixes are invisible to correctly-configured callers. A few behavioral changes you may encounter:</p> <ul> <li><strong>Empty HMAC keys now raise.</strong> If your app passed <code>""</code> or <code>b""</code> as a secret (often via a missing env var, e.g. <code>os.getenv("JWT_SECRET", "")</code>), <code>encode</code>/<code>decode</code> will now raise <code>InvalidKeyError</code>. This is the intended behavior — fix the configuration.</li> <li><strong><code>PyJWK</code> decoding now requires the token's <code>alg</code> to match the JWK's algorithm.</strong> Previously a mismatch was silently honored if the header <code>alg</code> appeared in the allow-list. Tokens that relied on this mismatch will now fail with <code>InvalidAlgorithmError</code>.</li> <li><strong><code>PyJWKClient</code> now rejects non-HTTP(S) URIs at construction time.</strong> Tests or dev environments that fetched JWKS from <code>file://</code> URIs need to switch to a local HTTP server or load the JWKS by other means (e.g. construct <code>PyJWKSet.from_dict(...)</code> directly).</li> <li><strong><code>b64=false</code> tokens are now strictly RFC 7515 / 7797 compliant.</strong> Tokens with a non-empty compact-form payload segment, or that omit <code>"b64"</code> from <code>crit</code>, will be rejected. PyJWT-produced tokens always satisfy both invariants, so round-trips through PyJWT are unaffected.</li> <li><strong><code>enforce_minimum_key_length</code> set per-call now takes effect.</strong> Callers who passed <code>options={"enforce_minimum_key_length": True}</code> to <code>jwt.decode()</code> previously got no enforcement; they will now get <code>InvalidKeyError</code> on undersized keys, as documented.</li> </ul> <p><strong>Full changelog:</strong> <a href="https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0">https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst">pyjwt's changelog</a>.</em></p> <blockquote> <h2><code>v2.13.0 <https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0></code>__</h2> <p>Security</p> <pre><code> - Reject JWK JSON documents passed as raw HMAC secrets in ``HMACAlgorithm.prepare_key`` to close an algorithm-confusion gap that the existing PEM/SSH guard did not cover. Reported by @aradona91 in `GHSA-xgmm-8j9v-c9wx <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx>`__. - Bind the JWT header ``alg`` to ``PyJWK.algorithm_name`` during verification so the caller's ``algorithms=[...]`` allow-list cannot be bypassed when decoding with a ``PyJWK`` / ``PyJWKClient`` key. Reported by @sushi-gif in `GHSA-jq35-7prp-9v3f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f>`__. - Reject non-``http(s)`` URI schemes in ``PyJWKClient`` so attacker- influenced URIs cannot read local files or reach unintended schemes via urllib's default ``file://`` / ``ftp://`` / ``data:`` handlers. Reported by @KEIJOT in `GHSA-993g-76c3-p5m4 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4>`__. - Preserve the cached JWK Set on fetch errors in ``PyJWKClient.fetch_data``. The previous ``finally``-block ``put(None)`` pattern cleared the cache on any transient outage, turning one bad JWKS request into application- wide auth failure. Reported by @eddieran in `GHSA-fhv5-28vv-h8m8 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8>`__. - Skip the unconditional base64 decode of the compact-form payload segment when ``b64=false`` is set in the protected header, and require that segment to be empty (RFC 7515 Appendix F detached form). Closes an unauthenticated DoS amplifier. Reported by @thesmartshadow in `GHSA-w7vc-732c-9m39 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39>`__. <p>Fixed</p> <pre><code> - Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with ``InvalidKeyError`` instead of accepting them with only a warning. Thanks to @SnailSploit and @spartan8806 for independently flagging the footgun. - Forward per-call ``options`` (including ``enforce_minimum_key_length``) from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the option actually takes effect when set at the call site rather than only on the ``PyJWT`` instance. Thanks to @WLUB for the report. - RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds ``&quot;b64&quot;`` to the ``crit`` header parameter, and the decoder rejects tokens that set ``b64=false`` without listing it in ``crit``. Thanks to @MachineLearning-Nerd for the report. Changed </code></pre> <ul> <li>Migrate the <code>dev</code>, <code>docs</code>, and <code>tests</code> package extras to dependency groups by <a href="https://github.com/kurtmckee"><code>@kurtmckee</code></a> in <code>[#1152](https://github.com/jpadilla/pyjwt/issues/1152) &lt;https://github.com/jpadilla/pyjwt/pull/1152&gt;</code>__ </code></pre></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jpadilla/pyjwt/commit/7144e4534c34810f4525dc4578a32addd8212cff"><code>7144e45</code></a> Apply ruff format</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/d2f4bec4963897c0ef96ef64a875894f2c8542ab"><code>d2f4bec</code></a> Restore <code>cast()</code> calls with cross-version <code>type: ignore</code> for <code>prepare_key</code></li> <li><a href="https://github.com/jpadilla/pyjwt/commit/22f478cebddd8294259c30f037ecb92b0b348774"><code>22f478c</code></a> Remove redundant casts in <code>RSAAlgorithm.prepare_key</code> and `ECAlgorithm.prepare...</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81"><code>95791b1</code></a> Bundle security fixes and hardening into 2.13.0</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/dcc27a9d3182a2349c30b160758785c6ce7a6508"><code>dcc27a9</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1155">#1155</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/9d08a9a1896845ed8eaf88e6f6ac61e5800c3e7a"><code>9d08a9a</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1146">#1146</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/b87c10014d4109f0214fea188d00faaaf8a80e64"><code>b87c100</code></a> Bump codecov/codecov-action from 5 to 6 (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1154">#1154</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/40e3147eb5f790d8d041772e5fc00728a176c812"><code>40e3147</code></a> Migrate development extras to dependency groups (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1152">#1152</a>)</li> <li>See full diff in <a href="https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0">compare view</a></li> </ul> </details> <br /> Updates `python-multipart` from 0.0.27 to 0.0.31 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/python-multipart/releases">python-multipart's releases</a>.</em></p> <blockquote> <h2>Version 0.0.31</h2> <h2>What's Changed</h2> <ul> <li>Speed up multipart header parsing and callback dispatch by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/295">Kludex/python-multipart#295</a></li> <li>Bound header field name size before validating by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/296">Kludex/python-multipart#296</a></li> <li>Validate Content-Length is non-negative in parse_form by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/297">Kludex/python-multipart#297</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/python-multipart/compare/0.0.30...0.0.31">https://github.com/Kludex/python-multipart/compare/0.0.30...0.0.31</a></p> <h2>Version 0.0.30</h2> <h2>What's Changed</h2> <ul> <li>Treat only <code>&</code> as the urlencoded field separator by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/290">Kludex/python-multipart#290</a></li> <li>Ignore RFC 2231 extended parameters in <code>parse_options_header</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/291">Kludex/python-multipart#291</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/python-multipart/compare/0.0.29...0.0.30">https://github.com/Kludex/python-multipart/compare/0.0.29...0.0.30</a></p> <h2>Version 0.0.29</h2> <h2>What's Changed</h2> <ul> <li>Handle malformed RFC 2231 continuations in <code>parse_options_header</code> by <a href="https://github.com/manunio"><code>@manunio</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/270">Kludex/python-multipart#270</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/python-multipart/compare/0.0.28...0.0.29">https://github.com/Kludex/python-multipart/compare/0.0.28...0.0.29</a></p> <h2>Version 0.0.28</h2> <h2>What's Changed</h2> <ul> <li>Speed up partial-boundary tail scan via <code>bytes.find</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/281">Kludex/python-multipart#281</a></li> <li>Cap multipart boundary length at 256 bytes by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/282">Kludex/python-multipart#282</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/python-multipart/compare/0.0.27...0.0.28">https://github.com/Kludex/python-multipart/compare/0.0.27...0.0.28</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md">python-multipart's changelog</a>.</em></p> <blockquote> <h2>0.0.31 (2026-06-04)</h2> <ul> <li>Speed up multipart header parsing and callback dispatch <a href="https://redirect.github.com/Kludex/python-multipart/pull/295">#295</a>.</li> <li>Bound header field name size before validating <a href="https://redirect.github.com/Kludex/python-multipart/pull/296">#296</a>.</li> <li>Validate <code>Content-Length</code> is non-negative in <code>parse_form</code> <a href="https://redirect.github.com/Kludex/python-multipart/pull/297">#297</a>.</li> </ul> <h2>0.0.30 (2026-05-31)</h2> <ul> <li>Parse <code>application/x-www-form-urlencoded</code> bodies per the WHATWG URL standard, treating only <code>&</code> as a field separator <a href="https://redirect.github.com/Kludex/python-multipart/pull/290">#290</a>.</li> <li>Ignore RFC 2231/5987 extended parameters (<code>name*</code>, <code>filename*</code>) in <code>parse_options_header</code>, keeping the plain parameter authoritative per <a href="https://datatracker.ietf.org/doc/html/rfc7578#section-4.2">RFC 7578 §4.2</a> <a href="https://redirect.github.com/Kludex/python-multipart/pull/291">#291</a>.</li> </ul> <h2>0.0.29 (2026-05-17)</h2> <ul> <li>Handle malformed RFC 2231 continuations in <code>parse_options_header</code> <a href="https://redirect.github.com/Kludex/python-multipart/pull/270">#270</a>.</li> </ul> <h2>0.0.28 (2026-05-10)</h2> <ul> <li>Speed up partial-boundary tail scan via <code>bytes.find</code> <a href="https://redirect.github.com/Kludex/python-multipart/pull/281">#281</a>.</li> <li>Cap multipart boundary length at 256 bytes <a href="https://redirect.github.com/Kludex/python-multipart/pull/282">#282</a>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Kludex/python-multipart/commit/4cffc68a165f7a6f6b7756ce006fabf07a05b7a4"><code>4cffc68</code></a> Version 0.0.31 (<a href="https://redirect.github.com/Kludex/python-multipart/issues/298">#298</a>)</li> <li><a href="https://github.com/Kludex/python-multipart/commit/c814948acf509cef7881fa75c969969b19239bbf"><code>c814948</code></a> Reject negative <code>Content-Length</code> in <code>parse_form</code> (<a href="https://redirect.github.com/Kludex/python-multipart/issues/297">#297</a>)</li> <li><a href="https://github.com/Kludex/python-multipart/commit/6b837d47bc68826ed5cbbcb50c6c6a6093444494"><code>6b837d4</code></a> Bound header field name size before validating (<a href="https://redirect.github.com/Kludex/python-multipart/issues/296">#296</a>)</li> <li><a href="https://github.com/Kludex/python-multipart/commit/e0c4f9df2e737d1663fbbdd6563f80613a2089f9"><code>e0c4f9d</code></a> Bump the github-actions group with 3 updates (<a href="https://redirect.github.com/Kludex/python-multipart/issues/294">#294</a>)</li> <li><a href="https://github.com/Kludex/python-multipart/commit/b8a01bb683e8e8675fdb5d831b206a478c8215aa"><code>b8a01bb</code></a> Bump the python-packages group with 3 updates (<a href="https://redirect.github.com/Kludex/python-multipart/issues/293">#293</a>)</li> <li><a href="https://github.com/Kludex/python-multipart/commit/6732164f30c58e28589a1e22213d2f6b8c6bad9f"><code>6732164</code></a> Speed up multipart header parsing and callback dispatch (<a href="https://redirect.github.com/Kludex/python-multipart/issues/295">#295</a>)</li> <li><a href="https://github.com/Kludex/python-multipart/commit/9d3ead568a259f222cff6425262ff63e88d930d4"><code>9d3ead5</code></a> Version 0.0.30 (<a href="https://redirect.github.com/Kludex/python-multipart/issues/292">#292</a>)</li> <li><a href="https://github.com/Kludex/python-multipart/commit/3506c15ce99cb62faf2d5ceb3c4c1e5800cb843d"><code>3506c15</code></a> Ignore RFC 2231 extended parameters in <code>parse_options_header</code> (<a href="https://redirect.github.com/Kludex/python-multipart/issues/291">#291</a>)</li> <li><a href="https://github.com/Kludex/python-multipart/commit/d69df35cd2cad9c72794c2c340db646afae957d8"><code>d69df35</code></a> Treat only <code>&</code> as the urlencoded field separator (<a href="https://redirect.github.com/Kludex/python-multipart/issues/290">#290</a>)</li> <li><a href="https://github.com/Kludex/python-multipart/commit/1e6ff9740b09fb439755f30e2b0e2ada1d297325"><code>1e6ff97</code></a> Bump idna from 3.11 to 3.15 (<a href="https://redirect.github.com/Kludex/python-multipart/issues/289">#289</a>)</li> <li>Additional commits viewable in <a href="https://github.com/Kludex/python-multipart/compare/0.0.27...0.0.31">compare view</a></li> </ul> </details> <br /> Updates `starlette` from 1.0.1 to 1.3.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/releases">starlette's releases</a>.</em></p> <blockquote> <h2>Version 1.3.1</h2> <h2>What's Changed</h2> <ul> <li>Use <code>StarletteDeprecationWarning</code> instead of <code>DeprecationWarning</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3119">Kludex/starlette#3119</a></li> <li>Enforce <code>max_fields</code> and <code>max_part_size</code> in <code>FormParser</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3329">Kludex/starlette#3329</a></li> <li>Enforce <code>FormParser</code> limits in parser callbacks by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3331">Kludex/starlette#3331</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.3.0...1.3.1">https://github.com/Kludex/starlette/compare/1.3.0...1.3.1</a></p> <h2>Version 1.3.0</h2> <h2>What's Changed</h2> <ul> <li>Clamp oversized suffix ranges in <code>FileResponse</code> by <a href="https://github.com/jiyujie2006"><code>@jiyujie2006</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3307">Kludex/starlette#3307</a></li> <li>Catch <code>OSError</code> alongside <code>MultiPartException</code> when closing temp files by <a href="https://github.com/N3XT3R1337"><code>@N3XT3R1337</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3191">Kludex/starlette#3191</a></li> <li>Add <code>httpx2</code> to the <code>full</code> extra by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3323">Kludex/starlette#3323</a></li> <li>Adjust testclient typing and warnings by <a href="https://github.com/waketzheng"><code>@waketzheng</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3322">Kludex/starlette#3322</a></li> <li>Fix IndexError in URL.replace() on a URL with no authority by <a href="https://github.com/LeSingh1"><code>@LeSingh1</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3317">Kludex/starlette#3317</a></li> <li>Annotate URLPath protocol parameter with Literal by <a href="https://github.com/Chang-LeHung"><code>@Chang-LeHung</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3285">Kludex/starlette#3285</a></li> <li>avoid collapsing exception groups from user code by <a href="https://github.com/graingert"><code>@graingert</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/2830">Kludex/starlette#2830</a></li> <li>Use <code>removeprefix</code> to strip weak ETag indicator in <code>is_not_modified</code> by <a href="https://github.com/gnosyslambda"><code>@gnosyslambda</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3193">Kludex/starlette#3193</a></li> <li>Build <code>request.url</code> from structured components by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3326">Kludex/starlette#3326</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/jiyujie2006"><code>@jiyujie2006</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3307">Kludex/starlette#3307</a></li> <li><a href="https://github.com/N3XT3R1337"><code>@N3XT3R1337</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3191">Kludex/starlette#3191</a></li> <li><a href="https://github.com/leestana01"><code>@leestana01</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3319">Kludex/starlette#3319</a></li> <li><a href="https://github.com/LeSingh1"><code>@LeSingh1</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3317">Kludex/starlette#3317</a></li> <li><a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3204">Kludex/starlette#3204</a></li> <li><a href="https://github.com/Chang-LeHung"><code>@Chang-LeHung</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3285">Kludex/starlette#3285</a></li> <li><a href="https://github.com/gnosyslambda"><code>@gnosyslambda</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3193">Kludex/starlette#3193</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.2.1...1.3.0">https://github.com/Kludex/starlette/compare/1.2.1...1.3.0</a></p> <h2>Version 1.2.1</h2> <h2>What's Changed</h2> <ul> <li>Use <code>httpx2</code> for type checking in the <code>testclient</code> module by <a href="https://github.com/leifwar"><code>@leifwar</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3304">Kludex/starlette#3304</a></li> <li>Add assert error for requires() when request param is not Request type by <a href="https://github.com/KeeganOP"><code>@KeeganOP</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3298">Kludex/starlette#3298</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/leifwar"><code>@leifwar</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3304">Kludex/starlette#3304</a></li> <li><a href="https://github.com/diskeu"><code>@diskeu</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3243">Kludex/starlette#3243</a></li> <li><a href="https://github.com/KeeganOP"><code>@KeeganOP</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3298">Kludex/starlette#3298</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.2.0...1.2.1">https://github.com/Kludex/starlette/compare/1.2.0...1.2.1</a></p> <h2>Version 1.2.0</h2> <h2>What's Changed</h2> <ul> <li>Support httpx2 in the test client by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3291">Kludex/starlette#3291</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.1.0...1.2.0">https://github.com/Kludex/starlette/compare/1.1.0...1.2.0</a></p> <h2>Version 1.1.0</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/blob/main/docs/release-notes.md">starlette's changelog</a>.</em></p> <blockquote> <h2>1.3.1 (June 12, 2026)</h2> <h4>Fixed</h4> <ul> <li>Enforce <code>max_fields</code> and <code>max_part_size</code> in <code>FormParser</code> <a href="https://redirect.github.com/encode/starlette/pull/3329">#3329</a>.</li> <li>Enforce <code>FormParser</code> limits in parser callbacks <a href="https://redirect.github.com/encode/starlette/pull/3331">#3331</a>.</li> </ul> <h2>1.3.0 (June 11, 2026)</h2> <h4>Added</h4> <ul> <li>Add <code>httpx2</code> to the <code>full</code> extra <a href="https://redirect.github.com/encode/starlette/pull/3323">#3323</a>.</li> <li>Annotate the <code>URLPath</code> <code>protocol</code> parameter with <code>Literal</code> <a href="https://redirect.github.com/encode/starlette/pull/3285">#3285</a>.</li> </ul> <h4>Fixed</h4> <ul> <li>Build <code>request.url</code> from structured components <a href="https://redirect.github.com/encode/starlette/pull/3326">#3326</a>.</li> <li>Clamp oversized suffix ranges in <code>FileResponse</code> <a href="https://redirect.github.com/encode/starlette/pull/3307">#3307</a>.</li> <li>Catch <code>OSError</code> alongside <code>MultiPartException</code> when closing temp files <a href="https://redirect.github.com/encode/starlette/pull/3191">#3191</a>.</li> <li>Avoid collapsing exception groups raised from user code <a href="https://redirect.github.com/encode/starlette/pull/2830">#2830</a>.</li> <li>Use <code>removeprefix</code> to strip the weak <code>ETag</code> indicator in <code>is_not_modified</code> <a href="https://redirect.github.com/encode/starlette/pull/3193">#3193</a>.</li> <li>Fix <code>IndexError</code> in <code>URL.replace()</code> on a URL with no authority <a href="https://redirect.github.com/encode/starlette/pull/3317">#3317</a>.</li> <li>Adjust <code>testclient</code> typing and warnings <a href="https://redirect.github.com/encode/starlette/pull/3322">#3322</a>.</li> </ul> <h2>1.2.1 (May 31, 2026)</h2> <h4>Fixed</h4> <ul> <li>Use <code>httpx2</code> for type checking in the <code>testclient</code> module <a href="https://redirect.github.com/encode/starlette/pull/3304">#3304</a>.</li> <li>Add assert error for <code>requires()</code> when the request parameter is not a <code>Request</code> type <a href="https://redirect.github.com/encode/starlette/pull/3298">#3298</a>.</li> </ul> <h2>1.2.0 (May 28, 2026)</h2> <h4>Added</h4> <ul> <li>Support httpx2 in the test client <a href="https://redirect.github.com/encode/starlette/pull/3291">#3291</a>.</li> </ul> <h2>1.1.0 (May 23, 2026)</h2> <h4>Added</h4> <ul> <li>Use <code>"application/octet-stream"</code> as the <code>FileResponse</code> media type fallback <a href="https://redirect.github.com/encode/starlette/pull/3283">#3283</a>.</li> </ul> <h4>Fixed</h4> <ul> <li>Only dispatch standard HTTP verbs in <code>HTTPEndpoint</code> <a href="https://redirect.github.com/encode/starlette/pull/3286">#3286</a>.</li> <li>Reject absolute paths in <code>StaticFiles.lookup_path</code> <a href="https://redirect.github.com/encode/starlette/pull/3287">#3287</a>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Kludex/starlette/commit/8ebffd0678570ddd5d5bb11c6f3c3c7fd4682ab9"><code>8ebffd0</code></a> Version 1.3.1 (<a href="https://redirect.github.com/Kludex/starlette/issues/3330">#3330</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/25b8e179d8d7ed86769c02f648772dd5fb43dc3c"><code>25b8e17</code></a> Enforce <code>FormParser</code> limits in parser callbacks (<a href="https://redirect.github.com/Kludex/starlette/issues/3331">#3331</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/dba1c4babc4f99ad2622bb913d87045775dda735"><code>dba1c4b</code></a> Enforce <code>max_fields</code> and <code>max_part_size</code> in <code>FormParser</code> (<a href="https://redirect.github.com/Kludex/starlette/issues/3329">#3329</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/45e51dcf99f3a270b0bcec1aec5410b4345863a9"><code>45e51dc</code></a> Use <code>StarletteDeprecationWarning</code> instead of <code>DeprecationWarning</code> (<a href="https://redirect.github.com/Kludex/starlette/issues/3119">#3119</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/5f8610c386e13de1d80d36efa961e1486a1d2d01"><code>5f8610c</code></a> Version 1.3.0 (<a href="https://redirect.github.com/Kludex/starlette/issues/3327">#3327</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/167b5850e809f38b27fbfed62d58bf6442855975"><code>167b585</code></a> Build <code>request.url</code> from structured components (<a href="https://redirect.github.com/Kludex/starlette/issues/3326">#3326</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/37309255b4c1b9c381a2d24a1eaf83100984a16a"><code>3730925</code></a> Use <code>removeprefix</code> to strip weak ETag indicator in <code>is_not_modified</code> (<a href="https://redirect.github.com/Kludex/starlette/issues/3193">#3193</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/e6f7ad1ab85efb27ab7910d8007b3f4531f7b083"><code>e6f7ad1</code></a> avoid collapsing exception groups from user code (<a href="https://redirect.github.com/Kludex/starlette/issues/2830">#2830</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/115228fcdca0e0ef5bf4a95a40ddce5a9fced428"><code>115228f</code></a> Annotate URLPath protocol parameter with Literal (<a href="https://redirect.github.com/Kludex/starlette/issues/3285">#3285</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/113f193a34353c9153857028c1074351d22fad07"><code>113f193</code></a> docs: replace inline ASGI server list with link to canonical implemen… (<a href="https://redirect.github.com/Kludex/starlette/issues/3204">#3204</a>)</li> <li>Additional commits viewable in <a href="https://github.com/Kludex/starlette/compare/1.0.1...1.3.1">compare view</a></li> </ul> </details> <br /> Updates `mcp` from 1.23.0 to 1.28.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/modelcontextprotocol/…
…emoss#452) Bumps the uv group with 1 update in the /apps/pipecat-moss/ollama-local directory: [pillow](https://github.com/python-pillow/Pillow). Bumps the uv group with 1 update in the /examples/cookbook/smolagents directory: [pillow](https://github.com/python-pillow/Pillow). Bumps the uv group with 1 update in the /examples/voice-agents/airline-pnr directory: [pillow](https://github.com/python-pillow/Pillow). Bumps the uv group with 1 update in the /examples/voice-agents/candidate-screening directory: [pillow](https://github.com/python-pillow/Pillow). Bumps the uv group with 1 update in the /examples/voice-agents/insurance-adjuster directory: [pillow](https://github.com/python-pillow/Pillow). Bumps the uv group with 1 update in the /examples/voice-agents/mortgage-lending directory: [pillow](https://github.com/python-pillow/Pillow). Bumps the uv group with 1 update in the /moss-live-labs/examples/advanced-voice-agent directory: [pillow](https://github.com/python-pillow/Pillow). Bumps the uv group with 1 update in the /moss-live-labs/examples/voice-agent directory: [pillow](https://github.com/python-pillow/Pillow). Bumps the uv group with 1 update in the /packages/pipecat-moss directory: [pillow](https://github.com/python-pillow/Pillow). Updates `pillow` from 12.2.0 to 12.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/python-pillow/Pillow/releases">pillow's releases</a>.</em></p> <blockquote> <h2>12.3.0</h2> <p><a href="https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html">https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html</a></p> <h2>Removals</h2> <ul> <li>Remove non-image ImageCms modes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9697">#9697</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Documentation</h2> <ul> <li>Add release notes for SBOM and performance improvements <a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add security release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9741">#9741</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add release notes for Python 3.15 beta wheels <a href="https://redirect.github.com/python-pillow/Pillow/issues/9696">#9696</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>ImageFont can also be used with ImageText <a href="https://redirect.github.com/python-pillow/Pillow/issues/9597">#9597</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Additional guidelines for security reports <a href="https://redirect.github.com/python-pillow/Pillow/issues/9659">#9659</a> [<a href="https://github.com/wiredfool"><code>@wiredfool</code></a>]</li> <li>Fixed typo <a href="https://redirect.github.com/python-pillow/Pillow/issues/9636">#9636</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Added CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9591">#9591</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Revise development support information in README <a href="https://redirect.github.com/python-pillow/Pillow/issues/9583">#9583</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add INCIDENT_RESPONSE.md <a href="https://redirect.github.com/python-pillow/Pillow/issues/9555">#9555</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add STRIDE threat model to security docs <a href="https://redirect.github.com/python-pillow/Pillow/issues/9562">#9562</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9556">#9556</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update README with revised security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9553">#9553</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9552">#9552</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Update macOS tested Python versions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9534">#9534</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Dependencies</h2> <ul> <li>Update dependency harfbuzz to v14.2.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9720">#9720</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency mypy to v2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9653">#9653</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency cibuildwheel to v4 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9665">#9665</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update github-actions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9655">#9655</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency libavif to v1.4.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9652">#9652</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency lcms2 to v2.19.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9651">#9651</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency check-jsonschema to v0.37.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9650">#9650</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update google/oss-fuzz digest to d872252 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9614">#9614</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency lcms2 to v2.19 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9609">#9609</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency libpng to v1.6.58 - autoclosed <a href="https://redirect.github.com/python-pillow/Pillow/issues/9608">#9608</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency harfbuzz to v14 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9610">#9610</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency mypy to v1.20.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9599">#9599</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update github-actions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9611">#9611</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency cibuildwheel to v3.4.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9607">#9607</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Move dependency versions to single JSON and enable Renovate <a href="https://redirect.github.com/python-pillow/Pillow/issues/9559">#9559</a> [<a href="https://github.com/hugovk"><code>@hugovk</code></a>]</li> <li>Updated raqm to 0.10.5 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9557">#9557</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update dependency cibuildwheel to v3.4.0 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9532">#9532</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> </ul> <h2>Testing</h2> <ul> <li>Remove matrix.os from benchmark <a href="https://redirect.github.com/python-pillow/Pillow/issues/9735">#9735</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Remove references to libavif patch <a href="https://redirect.github.com/python-pillow/Pillow/issues/9734">#9734</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add benchmark tests <a href="https://redirect.github.com/python-pillow/Pillow/issues/9654">#9654</a> [<a href="https://github.com/akx"><code>@akx</code></a>]</li> <li>Use reshape() instead of setting NumPy array shape directly <a href="https://redirect.github.com/python-pillow/Pillow/issues/9728">#9728</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python-pillow/Pillow/commit/bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d"><code>bb1d8e8</code></a> 12.3.0 version bump</li> <li><a href="https://github.com/python-pillow/Pillow/commit/e63fc481dc2e07e21d5403deafb8f1ed98a513af"><code>e63fc48</code></a> Add release notes for SBOM and performance improvements (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/13b701bbab291eec4bc87ea17ba06c94e5fe3054"><code>13b701b</code></a> Add release notes for <a href="https://redirect.github.com/python-pillow/Pillow/issues/9679">#9679</a></li> <li><a href="https://github.com/python-pillow/Pillow/commit/5564ca72fcd59d040e270af5dcf17a0d7161c364"><code>5564ca7</code></a> List methods</li> <li><a href="https://github.com/python-pillow/Pillow/commit/a0920fd384f800b5d0ba3dd29ecdeae4f1d4043b"><code>a0920fd</code></a> Speed up ImageChops operations (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9738">#9738</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/07e9a6cd5336dc6cf8cae9165cd70cdd2b3e42fc"><code>07e9a6c</code></a> Speed up <code>Image.filter()</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9736">#9736</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/a94578cf9649ea13e426cf7fb2b71b39ffc0dd50"><code>a94578c</code></a> Speed up <code>Image.getchannel()</code>, <code>Image.merge()</code>, <code>Image.putalpha()</code> and `Image...</li> <li><a href="https://github.com/python-pillow/Pillow/commit/53e02c43c919d149b2a154a5180079f9df18fbbb"><code>53e02c4</code></a> Speed up <code>Image.fill()</code>, <code>Image.linear_gradient()</code> and `Image.radial_gradient...</li> <li><a href="https://github.com/python-pillow/Pillow/commit/af037475be8634ba739744243164ba9e2c8346a6"><code>af03747</code></a> Speed up <code>Image.resample()</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9739">#9739</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/5c9ca56c3e5fba52b647809fbb0986c87e73a571"><code>5c9ca56</code></a> Speed up <code>alpha_composite</code>, <code>matrix</code>, <code>negative</code>, <code>quantize</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9740">#9740</a>)</li> <li>Additional commits viewable in <a href="https://github.com/python-pillow/Pillow/compare/12.2.0...12.3.0">compare view</a></li> </ul> </details> <br /> Updates `pillow` from 12.2.0 to 12.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/python-pillow/Pillow/releases">pillow's releases</a>.</em></p> <blockquote> <h2>12.3.0</h2> <p><a href="https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html">https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html</a></p> <h2>Removals</h2> <ul> <li>Remove non-image ImageCms modes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9697">#9697</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Documentation</h2> <ul> <li>Add release notes for SBOM and performance improvements <a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add security release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9741">#9741</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add release notes for Python 3.15 beta wheels <a href="https://redirect.github.com/python-pillow/Pillow/issues/9696">#9696</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>ImageFont can also be used with ImageText <a href="https://redirect.github.com/python-pillow/Pillow/issues/9597">#9597</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Additional guidelines for security reports <a href="https://redirect.github.com/python-pillow/Pillow/issues/9659">#9659</a> [<a href="https://github.com/wiredfool"><code>@wiredfool</code></a>]</li> <li>Fixed typo <a href="https://redirect.github.com/python-pillow/Pillow/issues/9636">#9636</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Added CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9591">#9591</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Revise development support information in README <a href="https://redirect.github.com/python-pillow/Pillow/issues/9583">#9583</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add INCIDENT_RESPONSE.md <a href="https://redirect.github.com/python-pillow/Pillow/issues/9555">#9555</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add STRIDE threat model to security docs <a href="https://redirect.github.com/python-pillow/Pillow/issues/9562">#9562</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9556">#9556</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update README with revised security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9553">#9553</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9552">#9552</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Update macOS tested Python versions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9534">#9534</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Dependencies</h2> <ul> <li>Update dependency harfbuzz to v14.2.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9720">#9720</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency mypy to v2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9653">#9653</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency cibuildwheel to v4 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9665">#9665</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update github-actions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9655">#9655</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency libavif to v1.4.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9652">#9652</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency lcms2 to v2.19.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9651">#9651</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency check-jsonschema to v0.37.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9650">#9650</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update google/oss-fuzz digest to d872252 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9614">#9614</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency lcms2 to v2.19 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9609">#9609</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency libpng to v1.6.58 - autoclosed <a href="https://redirect.github.com/python-pillow/Pillow/issues/9608">#9608</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency harfbuzz to v14 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9610">#9610</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency mypy to v1.20.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9599">#9599</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update github-actions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9611">#9611</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency cibuildwheel to v3.4.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9607">#9607</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Move dependency versions to single JSON and enable Renovate <a href="https://redirect.github.com/python-pillow/Pillow/issues/9559">#9559</a> [<a href="https://github.com/hugovk"><code>@hugovk</code></a>]</li> <li>Updated raqm to 0.10.5 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9557">#9557</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update dependency cibuildwheel to v3.4.0 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9532">#9532</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> </ul> <h2>Testing</h2> <ul> <li>Remove matrix.os from benchmark <a href="https://redirect.github.com/python-pillow/Pillow/issues/9735">#9735</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Remove references to libavif patch <a href="https://redirect.github.com/python-pillow/Pillow/issues/9734">#9734</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add benchmark tests <a href="https://redirect.github.com/python-pillow/Pillow/issues/9654">#9654</a> [<a href="https://github.com/akx"><code>@akx</code></a>]</li> <li>Use reshape() instead of setting NumPy array shape directly <a href="https://redirect.github.com/python-pillow/Pillow/issues/9728">#9728</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python-pillow/Pillow/commit/bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d"><code>bb1d8e8</code></a> 12.3.0 version bump</li> <li><a href="https://github.com/python-pillow/Pillow/commit/e63fc481dc2e07e21d5403deafb8f1ed98a513af"><code>e63fc48</code></a> Add release notes for SBOM and performance improvements (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/13b701bbab291eec4bc87ea17ba06c94e5fe3054"><code>13b701b</code></a> Add release notes for <a href="https://redirect.github.com/python-pillow/Pillow/issues/9679">#9679</a></li> <li><a href="https://github.com/python-pillow/Pillow/commit/5564ca72fcd59d040e270af5dcf17a0d7161c364"><code>5564ca7</code></a> List methods</li> <li><a href="https://github.com/python-pillow/Pillow/commit/a0920fd384f800b5d0ba3dd29ecdeae4f1d4043b"><code>a0920fd</code></a> Speed up ImageChops operations (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9738">#9738</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/07e9a6cd5336dc6cf8cae9165cd70cdd2b3e42fc"><code>07e9a6c</code></a> Speed up <code>Image.filter()</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9736">#9736</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/a94578cf9649ea13e426cf7fb2b71b39ffc0dd50"><code>a94578c</code></a> Speed up <code>Image.getchannel()</code>, <code>Image.merge()</code>, <code>Image.putalpha()</code> and `Image...</li> <li><a href="https://github.com/python-pillow/Pillow/commit/53e02c43c919d149b2a154a5180079f9df18fbbb"><code>53e02c4</code></a> Speed up <code>Image.fill()</code>, <code>Image.linear_gradient()</code> and `Image.radial_gradient...</li> <li><a href="https://github.com/python-pillow/Pillow/commit/af037475be8634ba739744243164ba9e2c8346a6"><code>af03747</code></a> Speed up <code>Image.resample()</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9739">#9739</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/5c9ca56c3e5fba52b647809fbb0986c87e73a571"><code>5c9ca56</code></a> Speed up <code>alpha_composite</code>, <code>matrix</code>, <code>negative</code>, <code>quantize</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9740">#9740</a>)</li> <li>Additional commits viewable in <a href="https://github.com/python-pillow/Pillow/compare/12.2.0...12.3.0">compare view</a></li> </ul> </details> <br /> Updates `pillow` from 12.2.0 to 12.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/python-pillow/Pillow/releases">pillow's releases</a>.</em></p> <blockquote> <h2>12.3.0</h2> <p><a href="https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html">https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html</a></p> <h2>Removals</h2> <ul> <li>Remove non-image ImageCms modes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9697">#9697</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Documentation</h2> <ul> <li>Add release notes for SBOM and performance improvements <a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add security release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9741">#9741</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add release notes for Python 3.15 beta wheels <a href="https://redirect.github.com/python-pillow/Pillow/issues/9696">#9696</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>ImageFont can also be used with ImageText <a href="https://redirect.github.com/python-pillow/Pillow/issues/9597">#9597</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Additional guidelines for security reports <a href="https://redirect.github.com/python-pillow/Pillow/issues/9659">#9659</a> [<a href="https://github.com/wiredfool"><code>@wiredfool</code></a>]</li> <li>Fixed typo <a href="https://redirect.github.com/python-pillow/Pillow/issues/9636">#9636</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Added CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9591">#9591</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Revise development support information in README <a href="https://redirect.github.com/python-pillow/Pillow/issues/9583">#9583</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add INCIDENT_RESPONSE.md <a href="https://redirect.github.com/python-pillow/Pillow/issues/9555">#9555</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add STRIDE threat model to security docs <a href="https://redirect.github.com/python-pillow/Pillow/issues/9562">#9562</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9556">#9556</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update README with revised security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9553">#9553</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9552">#9552</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Update macOS tested Python versions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9534">#9534</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Dependencies</h2> <ul> <li>Update dependency harfbuzz to v14.2.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9720">#9720</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency mypy to v2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9653">#9653</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency cibuildwheel to v4 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9665">#9665</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update github-actions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9655">#9655</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency libavif to v1.4.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9652">#9652</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency lcms2 to v2.19.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9651">#9651</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency check-jsonschema to v0.37.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9650">#9650</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update google/oss-fuzz digest to d872252 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9614">#9614</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency lcms2 to v2.19 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9609">#9609</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency libpng to v1.6.58 - autoclosed <a href="https://redirect.github.com/python-pillow/Pillow/issues/9608">#9608</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency harfbuzz to v14 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9610">#9610</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency mypy to v1.20.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9599">#9599</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update github-actions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9611">#9611</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency cibuildwheel to v3.4.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9607">#9607</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Move dependency versions to single JSON and enable Renovate <a href="https://redirect.github.com/python-pillow/Pillow/issues/9559">#9559</a> [<a href="https://github.com/hugovk"><code>@hugovk</code></a>]</li> <li>Updated raqm to 0.10.5 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9557">#9557</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update dependency cibuildwheel to v3.4.0 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9532">#9532</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> </ul> <h2>Testing</h2> <ul> <li>Remove matrix.os from benchmark <a href="https://redirect.github.com/python-pillow/Pillow/issues/9735">#9735</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Remove references to libavif patch <a href="https://redirect.github.com/python-pillow/Pillow/issues/9734">#9734</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add benchmark tests <a href="https://redirect.github.com/python-pillow/Pillow/issues/9654">#9654</a> [<a href="https://github.com/akx"><code>@akx</code></a>]</li> <li>Use reshape() instead of setting NumPy array shape directly <a href="https://redirect.github.com/python-pillow/Pillow/issues/9728">#9728</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python-pillow/Pillow/commit/bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d"><code>bb1d8e8</code></a> 12.3.0 version bump</li> <li><a href="https://github.com/python-pillow/Pillow/commit/e63fc481dc2e07e21d5403deafb8f1ed98a513af"><code>e63fc48</code></a> Add release notes for SBOM and performance improvements (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/13b701bbab291eec4bc87ea17ba06c94e5fe3054"><code>13b701b</code></a> Add release notes for <a href="https://redirect.github.com/python-pillow/Pillow/issues/9679">#9679</a></li> <li><a href="https://github.com/python-pillow/Pillow/commit/5564ca72fcd59d040e270af5dcf17a0d7161c364"><code>5564ca7</code></a> List methods</li> <li><a href="https://github.com/python-pillow/Pillow/commit/a0920fd384f800b5d0ba3dd29ecdeae4f1d4043b"><code>a0920fd</code></a> Speed up ImageChops operations (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9738">#9738</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/07e9a6cd5336dc6cf8cae9165cd70cdd2b3e42fc"><code>07e9a6c</code></a> Speed up <code>Image.filter()</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9736">#9736</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/a94578cf9649ea13e426cf7fb2b71b39ffc0dd50"><code>a94578c</code></a> Speed up <code>Image.getchannel()</code>, <code>Image.merge()</code>, <code>Image.putalpha()</code> and `Image...</li> <li><a href="https://github.com/python-pillow/Pillow/commit/53e02c43c919d149b2a154a5180079f9df18fbbb"><code>53e02c4</code></a> Speed up <code>Image.fill()</code>, <code>Image.linear_gradient()</code> and `Image.radial_gradient...</li> <li><a href="https://github.com/python-pillow/Pillow/commit/af037475be8634ba739744243164ba9e2c8346a6"><code>af03747</code></a> Speed up <code>Image.resample()</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9739">#9739</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/5c9ca56c3e5fba52b647809fbb0986c87e73a571"><code>5c9ca56</code></a> Speed up <code>alpha_composite</code>, <code>matrix</code>, <code>negative</code>, <code>quantize</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9740">#9740</a>)</li> <li>Additional commits viewable in <a href="https://github.com/python-pillow/Pillow/compare/12.2.0...12.3.0">compare view</a></li> </ul> </details> <br /> Updates `pillow` from 12.2.0 to 12.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/python-pillow/Pillow/releases">pillow's releases</a>.</em></p> <blockquote> <h2>12.3.0</h2> <p><a href="https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html">https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html</a></p> <h2>Removals</h2> <ul> <li>Remove non-image ImageCms modes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9697">#9697</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Documentation</h2> <ul> <li>Add release notes for SBOM and performance improvements <a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add security release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9741">#9741</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add release notes for Python 3.15 beta wheels <a href="https://redirect.github.com/python-pillow/Pillow/issues/9696">#9696</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>ImageFont can also be used with ImageText <a href="https://redirect.github.com/python-pillow/Pillow/issues/9597">#9597</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Additional guidelines for security reports <a href="https://redirect.github.com/python-pillow/Pillow/issues/9659">#9659</a> [<a href="https://github.com/wiredfool"><code>@wiredfool</code></a>]</li> <li>Fixed typo <a href="https://redirect.github.com/python-pillow/Pillow/issues/9636">#9636</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Added CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9591">#9591</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Revise development support information in README <a href="https://redirect.github.com/python-pillow/Pillow/issues/9583">#9583</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add INCIDENT_RESPONSE.md <a href="https://redirect.github.com/python-pillow/Pillow/issues/9555">#9555</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add STRIDE threat model to security docs <a href="https://redirect.github.com/python-pillow/Pillow/issues/9562">#9562</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9556">#9556</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update README with revised security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9553">#9553</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9552">#9552</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Update macOS tested Python versions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9534">#9534</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Dependencies</h2> <ul> <li>Update dependency harfbuzz to v14.2.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9720">#9720</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency mypy to v2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9653">#9653</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency cibuildwheel to v4 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9665">#9665</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update github-actions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9655">#9655</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency libavif to v1.4.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9652">#9652</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency lcms2 to v2.19.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9651">#9651</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency check-jsonschema to v0.37.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9650">#9650</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update google/oss-fuzz digest to d872252 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9614">#9614</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency lcms2 to v2.19 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9609">#9609</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency libpng to v1.6.58 - autoclosed <a href="https://redirect.github.com/python-pillow/Pillow/issues/9608">#9608</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency harfbuzz to v14 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9610">#9610</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency mypy to v1.20.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9599">#9599</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update github-actions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9611">#9611</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency cibuildwheel to v3.4.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9607">#9607</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Move dependency versions to single JSON and enable Renovate <a href="https://redirect.github.com/python-pillow/Pillow/issues/9559">#9559</a> [<a href="https://github.com/hugovk"><code>@hugovk</code></a>]</li> <li>Updated raqm to 0.10.5 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9557">#9557</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update dependency cibuildwheel to v3.4.0 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9532">#9532</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> </ul> <h2>Testing</h2> <ul> <li>Remove matrix.os from benchmark <a href="https://redirect.github.com/python-pillow/Pillow/issues/9735">#9735</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Remove references to libavif patch <a href="https://redirect.github.com/python-pillow/Pillow/issues/9734">#9734</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add benchmark tests <a href="https://redirect.github.com/python-pillow/Pillow/issues/9654">#9654</a> [<a href="https://github.com/akx"><code>@akx</code></a>]</li> <li>Use reshape() instead of setting NumPy array shape directly <a href="https://redirect.github.com/python-pillow/Pillow/issues/9728">#9728</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python-pillow/Pillow/commit/bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d"><code>bb1d8e8</code></a> 12.3.0 version bump</li> <li><a href="https://github.com/python-pillow/Pillow/commit/e63fc481dc2e07e21d5403deafb8f1ed98a513af"><code>e63fc48</code></a> Add release notes for SBOM and performance improvements (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/13b701bbab291eec4bc87ea17ba06c94e5fe3054"><code>13b701b</code></a> Add release notes for <a href="https://redirect.github.com/python-pillow/Pillow/issues/9679">#9679</a></li> <li><a href="https://github.com/python-pillow/Pillow/commit/5564ca72fcd59d040e270af5dcf17a0d7161c364"><code>5564ca7</code></a> List methods</li> <li><a href="https://github.com/python-pillow/Pillow/commit/a0920fd384f800b5d0ba3dd29ecdeae4f1d4043b"><code>a0920fd</code></a> Speed up ImageChops operations (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9738">#9738</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/07e9a6cd5336dc6cf8cae9165cd70cdd2b3e42fc"><code>07e9a6c</code></a> Speed up <code>Image.filter()</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9736">#9736</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/a94578cf9649ea13e426cf7fb2b71b39ffc0dd50"><code>a94578c</code></a> Speed up <code>Image.getchannel()</code>, <code>Image.merge()</code>, <code>Image.putalpha()</code> and `Image...</li> <li><a href="https://github.com/python-pillow/Pillow/commit/53e02c43c919d149b2a154a5180079f9df18fbbb"><code>53e02c4</code></a> Speed up <code>Image.fill()</code>, <code>Image.linear_gradient()</code> and `Image.radial_gradient...</li> <li><a href="https://github.com/python-pillow/Pillow/commit/af037475be8634ba739744243164ba9e2c8346a6"><code>af03747</code></a> Speed up <code>Image.resample()</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9739">#9739</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/5c9ca56c3e5fba52b647809fbb0986c87e73a571"><code>5c9ca56</code></a> Speed up <code>alpha_composite</code>, <code>matrix</code>, <code>negative</code>, <code>quantize</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9740">#9740</a>)</li> <li>Additional commits viewable in <a href="https://github.com/python-pillow/Pillow/compare/12.2.0...12.3.0">compare view</a></li> </ul> </details> <br /> Updates `pillow` from 12.2.0 to 12.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/python-pillow/Pillow/releases">pillow's releases</a>.</em></p> <blockquote> <h2>12.3.0</h2> <p><a href="https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html">https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html</a></p> <h2>Removals</h2> <ul> <li>Remove non-image ImageCms modes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9697">#9697</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Documentation</h2> <ul> <li>Add release notes for SBOM and performance improvements <a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add security release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9741">#9741</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add release notes for Python 3.15 beta wheels <a href="https://redirect.github.com/python-pillow/Pillow/issues/9696">#9696</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>ImageFont can also be used with ImageText <a href="https://redirect.github.com/python-pillow/Pillow/issues/9597">#9597</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Additional guidelines for security reports <a href="https://redirect.github.com/python-pillow/Pillow/issues/9659">#9659</a> [<a href="https://github.com/wiredfool"><code>@wiredfool</code></a>]</li> <li>Fixed typo <a href="https://redirect.github.com/python-pillow/Pillow/issues/9636">#9636</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Added CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9591">#9591</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Revise development support information in README <a href="https://redirect.github.com/python-pillow/Pillow/issues/9583">#9583</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add INCIDENT_RESPONSE.md <a href="https://redirect.github.com/python-pillow/Pillow/issues/9555">#9555</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add STRIDE threat model to security docs <a href="https://redirect.github.com/python-pillow/Pillow/issues/9562">#9562</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9556">#9556</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update README with revised security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9553">#9553</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9552">#9552</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Update macOS tested Python versions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9534">#9534</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Dependencies</h2> <ul> <li>Update dependency harfbuzz to v14.2.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9720">#9720</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency mypy to v2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9653">#9653</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency cibuildwheel to v4 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9665">#9665</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update github-actions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9655">#9655</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency libavif to v1.4.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9652">#9652</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency lcms2 to v2.19.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9651">#9651</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency check-jsonschema to v0.37.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9650">#9650</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update google/oss-fuzz digest to d872252 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9614">#9614</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency lcms2 to v2.19 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9609">#9609</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency libpng to v1.6.58 - autoclosed <a href="https://redirect.github.com/python-pillow/Pillow/issues/9608">#9608</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency harfbuzz to v14 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9610">#9610</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency mypy to v1.20.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9599">#9599</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update github-actions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9611">#9611</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency cibuildwheel to v3.4.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9607">#9607</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Move dependency versions to single JSON and enable Renovate <a href="https://redirect.github.com/python-pillow/Pillow/issues/9559">#9559</a> [<a href="https://github.com/hugovk"><code>@hugovk</code></a>]</li> <li>Updated raqm to 0.10.5 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9557">#9557</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update dependency cibuildwheel to v3.4.0 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9532">#9532</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> </ul> <h2>Testing</h2> <ul> <li>Remove matrix.os from benchmark <a href="https://redirect.github.com/python-pillow/Pillow/issues/9735">#9735</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Remove references to libavif patch <a href="https://redirect.github.com/python-pillow/Pillow/issues/9734">#9734</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add benchmark tests <a href="https://redirect.github.com/python-pillow/Pillow/issues/9654">#9654</a> [<a href="https://github.com/akx"><code>@akx</code></a>]</li> <li>Use reshape() instead of setting NumPy array shape directly <a href="https://redirect.github.com/python-pillow/Pillow/issues/9728">#9728</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python-pillow/Pillow/commit/bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d"><code>bb1d8e8</code></a> 12.3.0 version bump</li> <li><a href="https://github.com/python-pillow/Pillow/commit/e63fc481dc2e07e21d5403deafb8f1ed98a513af"><code>e63fc48</code></a> Add release notes for SBOM and performance improvements (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/13b701bbab291eec4bc87ea17ba06c94e5fe3054"><code>13b701b</code></a> Add release notes for <a href="https://redirect.github.com/python-pillow/Pillow/issues/9679">#9679</a></li> <li><a href="https://github.com/python-pillow/Pillow/commit/5564ca72fcd59d040e270af5dcf17a0d7161c364"><code>5564ca7</code></a> List methods</li> <li><a href="https://github.com/python-pillow/Pillow/commit/a0920fd384f800b5d0ba3dd29ecdeae4f1d4043b"><code>a0920fd</code></a> Speed up ImageChops operations (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9738">#9738</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/07e9a6cd5336dc6cf8cae9165cd70cdd2b3e42fc"><code>07e9a6c</code></a> Speed up <code>Image.filter()</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9736">#9736</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/a94578cf9649ea13e426cf7fb2b71b39ffc0dd50"><code>a94578c</code></a> Speed up <code>Image.getchannel()</code>, <code>Image.merge()</code>, <code>Image.putalpha()</code> and `Image...</li> <li><a href="https://github.com/python-pillow/Pillow/commit/53e02c43c919d149b2a154a5180079f9df18fbbb"><code>53e02c4</code></a> Speed up <code>Image.fill()</code>, <code>Image.linear_gradient()</code> and `Image.radial_gradient...</li> <li><a href="https://github.com/python-pillow/Pillow/commit/af037475be8634ba739744243164ba9e2c8346a6"><code>af03747</code></a> Speed up <code>Image.resample()</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9739">#9739</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/5c9ca56c3e5fba52b647809fbb0986c87e73a571"><code>5c9ca56</code></a> Speed up <code>alpha_composite</code>, <code>matrix</code>, <code>negative</code>, <code>quantize</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9740">#9740</a>)</li> <li>Additional commits viewable in <a href="https://github.com/python-pillow/Pillow/compare/12.2.0...12.3.0">compare view</a></li> </ul> </details> <br /> Updates `pillow` from 12.2.0 to 12.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/python-pillow/Pillow/releases">pillow's releases</a>.</em></p> <blockquote> <h2>12.3.0</h2> <p><a href="https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html">https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html</a></p> <h2>Removals</h2> <ul> <li>Remove non-image ImageCms modes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9697">#9697</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Documentation</h2> <ul> <li>Add release notes for SBOM and performance improvements <a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add security release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9741">#9741</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add release notes for Python 3.15 beta wheels <a href="https://redirect.github.com/python-pillow/Pillow/issues/9696">#9696</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>ImageFont can also be used with ImageText <a href="https://redirect.github.com/python-pillow/Pillow/issues/9597">#9597</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Additional guidelines for security reports <a href="https://redirect.github.com/python-pillow/Pillow/issues/9659">#9659</a> [<a href="https://github.com/wiredfool"><code>@wiredfool</code></a>]</li> <li>Fixed typo <a href="https://redirect.github.com/python-pillow/Pillow/issues/9636">#9636</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Added CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9591">#9591</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Revise development support information in README <a href="https://redirect.github.com/python-pillow/Pillow/issues/9583">#9583</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add INCIDENT_RESPONSE.md <a href="https://redirect.github.com/python-pillow/Pillow/issues/9555">#9555</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add STRIDE threat model to security docs <a href="https://redirect.github.com/python-pillow/Pillow/issues/9562">#9562</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9556">#9556</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update README with revised security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9553">#9553</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9552">#9552</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Update macOS tested Python versions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9534">#9534</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Dependencies</h2> <ul> <li>Update dependency harfbuzz to v14.2.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9720">#9720</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency mypy to v2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9653">#9653</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency cibuildwheel to v4 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9665">#9665</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update github-actions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9655">#9655</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency libavif to v1.4.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9652">#9652</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency lcms2 to v2.19.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9651">#9651</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency check-jsonschema to v0.37.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9650">#9650</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update google/oss-fuzz digest to d872252 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9614">#9614</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency lcms2 to v2.19 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9609">#9609</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency libpng to v1.6.58 - autoclosed <a href="https://redirect.github.com/python-pillow/Pillow/issues/9608">#9608</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency harfbuzz to v14 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9610">#9610</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency mypy to v1.20.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9599">#9599</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update github-actions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9611">#9611</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency cibuildwheel to v3.4.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9607">#9607</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Move dependency versions to single JSON and enable Renovate <a href="https://redirect.github.com/python-pillow/Pillow/issues/9559">#9559</a> [<a href="https://github.com/hugovk"><code>@hugovk</code></a>]</li> <li>Updated raqm to 0.10.5 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9557">#9557</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update dependency cibuildwheel to v3.4.0 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9532">#9532</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> </ul> <h2>Testing</h2> <ul> <li>Remove matrix.os from benchmark <a href="https://redirect.github.com/python-pillow/Pillow/issues/9735">#9735</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Remove references to libavif patch <a href="https://redirect.github.com/python-pillow/Pillow/issues/9734">#9734</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add benchmark tests <a href="https://redirect.github.com/python-pillow/Pillow/issues/9654">#9654</a> [<a href="https://github.com/akx"><code>@akx</code></a>]</li> <li>Use reshape() instead of setting NumPy array shape directly <a href="https://redirect.github.com/python-pillow/Pillow/issues/9728">#9728</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python-pillow/Pillow/commit/bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d"><code>bb1d8e8</code></a> 12.3.0 version bump</li> <li><a href="https://github.com/python-pillow/Pillow/commit/e63fc481dc2e07e21d5403deafb8f1ed98a513af"><code>e63fc48</code></a> Add release notes for SBOM and performance improvements (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/13b701bbab291eec4bc87ea17ba06c94e5fe3054"><code>13b701b</code></a> Add release notes for <a href="https://redirect.github.com/python-pillow/Pillow/issues/9679">#9679</a></li> <li><a href="https://github.com/python-pillow/Pillow/commit/5564ca72fcd59d040e270af5dcf17a0d7161c364"><code>5564ca7</code></a> List methods</li> <li><a href="https://github.com/python-pillow/Pillow/commit/a0920fd384f800b5d0ba3dd29ecdeae4f1d4043b"><code>a0920fd</code></a> Speed up ImageChops operations (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9738">#9738</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/07e9a6cd5336dc6cf8cae9165cd70cdd2b3e42fc"><code>07e9a6c</code></a> Speed up <code>Image.filter()</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9736">#9736</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/a94578cf9649ea13e426cf7fb2b71b39ffc0dd50"><code>a94578c</code></a> Speed up <code>Image.getchannel()</code>, <code>Image.merge()</code>, <code>Image.putalpha()</code> and `Image...</li> <li><a href="https://github.com/python-pillow/Pillow/commit/53e02c43c919d149b2a154a5180079f9df18fbbb"><code>53e02c4</code></a> Speed up <code>Image.fill()</code>, <code>Image.linear_gradient()</code> and `Image.radial_gradient...</li> <li><a href="https://github.com/python-pillow/Pillow/commit/af037475be8634ba739744243164ba9e2c8346a6"><code>af03747</code></a> Speed up <code>Image.resample()</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9739">#9739</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/5c9ca56c3e5fba52b647809fbb0986c87e73a571"><code>5c9ca56</code></a> Speed up <code>alpha_composite</code>, <code>matrix</code>, <code>negative</code>, <code>quantize</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9740">#9740</a>)</li> <li>Additional commits viewable in <a href="https://github.com/python-pillow/Pillow/compare/12.2.0...12.3.0">compare view</a></li> </ul> </details> <br /> Updates `pillow` from 12.2.0 to 12.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/python-pillow/Pillow/releases">pillow's releases</a>.</em></p> <blockquote> <h2>12.3.0</h2> <p><a href="https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html">https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html</a></p> <h2>Removals</h2> <ul> <li>Remove non-image ImageCms modes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9697">#9697</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Documentation</h2> <ul> <li>Add release notes for SBOM and performance improvements <a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add security release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9741">#9741</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add release notes for Python 3.15 beta wheels <a href="https://redirect.github.com/python-pillow/Pillow/issues/9696">#9696</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>ImageFont can also be used with ImageText <a href="https://redirect.github.com/python-pillow/Pillow/issues/9597">#9597</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Additional guidelines for security reports <a href="https://redirect.github.com/python-pillow/Pillow/issues/9659">#9659</a> [<a href="https://github.com/wiredfool"><code>@wiredfool</code></a>]</li> <li>Fixed typo <a href="https://redirect.github.com/python-pillow/Pillow/issues/9636">#9636</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Added CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9591">#9591</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Revise development support information in README <a href="https://redirect.github.com/python-pillow/Pillow/issues/9583">#9583</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add INCIDENT_RESPONSE.md <a href="https://redirect.github.com/python-pillow/Pillow/issues/9555">#9555</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add STRIDE threat model to security docs <a href="https://redirect.github.com/python-pillow/Pillow/issues/9562">#9562</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9556">#9556</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update README with revised security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9553">#9553</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9552">#9552</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Update macOS tested Python versions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9534">#9534</a> [<a…
…semoss#456) [//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps the uv group with 2 updates in the /apps/livekit-moss-vercel/livekit-voice-agent/livekit-moss-agent directory: [pillow](https://github.com/python-pillow/Pillow) and [pyasn1](https://github.com/pyasn1/pyasn1). Bumps the uv group with 1 update in the /examples/cookbook/smolagents directory: [pillow](https://github.com/python-pillow/Pillow). Bumps the uv group with 1 update in the /examples/voice-agents/airline-pnr directory: [pillow](https://github.com/python-pillow/Pillow). Bumps the uv group with 1 update in the /examples/voice-agents/candidate-screening directory: [pillow](https://github.com/python-pillow/Pillow). Bumps the uv group with 1 update in the /examples/voice-agents/insurance-adjuster directory: [pillow](https://github.com/python-pillow/Pillow). Bumps the uv group with 1 update in the /examples/voice-agents/mortgage-lending directory: [pillow](https://github.com/python-pillow/Pillow). Bumps the uv group with 2 updates in the /moss-live-labs/examples/advanced-voice-agent directory: [pillow](https://github.com/python-pillow/Pillow) and [pyasn1](https://github.com/pyasn1/pyasn1). Bumps the uv group with 1 update in the /moss-live-labs/examples/voice-agent directory: [pillow](https://github.com/python-pillow/Pillow). Bumps the uv group with 1 update in the /packages/pipecat-moss directory: [pillow](https://github.com/python-pillow/Pillow). Updates `pillow` from 12.2.0 to 12.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/python-pillow/Pillow/releases">pillow's releases</a>.</em></p> <blockquote> <h2>12.3.0</h2> <p><a href="https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html">https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html</a></p> <h2>Removals</h2> <ul> <li>Remove non-image ImageCms modes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9697">#9697</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Documentation</h2> <ul> <li>Add release notes for SBOM and performance improvements <a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add security release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9741">#9741</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add release notes for Python 3.15 beta wheels <a href="https://redirect.github.com/python-pillow/Pillow/issues/9696">#9696</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>ImageFont can also be used with ImageText <a href="https://redirect.github.com/python-pillow/Pillow/issues/9597">#9597</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Additional guidelines for security reports <a href="https://redirect.github.com/python-pillow/Pillow/issues/9659">#9659</a> [<a href="https://github.com/wiredfool"><code>@wiredfool</code></a>]</li> <li>Fixed typo <a href="https://redirect.github.com/python-pillow/Pillow/issues/9636">#9636</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Added CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9591">#9591</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Revise development support information in README <a href="https://redirect.github.com/python-pillow/Pillow/issues/9583">#9583</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add INCIDENT_RESPONSE.md <a href="https://redirect.github.com/python-pillow/Pillow/issues/9555">#9555</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add STRIDE threat model to security docs <a href="https://redirect.github.com/python-pillow/Pillow/issues/9562">#9562</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9556">#9556</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update README with revised security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9553">#9553</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9552">#9552</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Update macOS tested Python versions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9534">#9534</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Dependencies</h2> <ul> <li>Update dependency harfbuzz to v14.2.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9720">#9720</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency mypy to v2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9653">#9653</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency cibuildwheel to v4 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9665">#9665</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update github-actions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9655">#9655</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency libavif to v1.4.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9652">#9652</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency lcms2 to v2.19.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9651">#9651</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency check-jsonschema to v0.37.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9650">#9650</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update google/oss-fuzz digest to d872252 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9614">#9614</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency lcms2 to v2.19 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9609">#9609</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency libpng to v1.6.58 - autoclosed <a href="https://redirect.github.com/python-pillow/Pillow/issues/9608">#9608</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency harfbuzz to v14 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9610">#9610</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency mypy to v1.20.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9599">#9599</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update github-actions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9611">#9611</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency cibuildwheel to v3.4.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9607">#9607</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Move dependency versions to single JSON and enable Renovate <a href="https://redirect.github.com/python-pillow/Pillow/issues/9559">#9559</a> [<a href="https://github.com/hugovk"><code>@hugovk</code></a>]</li> <li>Updated raqm to 0.10.5 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9557">#9557</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update dependency cibuildwheel to v3.4.0 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9532">#9532</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> </ul> <h2>Testing</h2> <ul> <li>Remove matrix.os from benchmark <a href="https://redirect.github.com/python-pillow/Pillow/issues/9735">#9735</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Remove references to libavif patch <a href="https://redirect.github.com/python-pillow/Pillow/issues/9734">#9734</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add benchmark tests <a href="https://redirect.github.com/python-pillow/Pillow/issues/9654">#9654</a> [<a href="https://github.com/akx"><code>@akx</code></a>]</li> <li>Use reshape() instead of setting NumPy array shape directly <a href="https://redirect.github.com/python-pillow/Pillow/issues/9728">#9728</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python-pillow/Pillow/commit/bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d"><code>bb1d8e8</code></a> 12.3.0 version bump</li> <li><a href="https://github.com/python-pillow/Pillow/commit/e63fc481dc2e07e21d5403deafb8f1ed98a513af"><code>e63fc48</code></a> Add release notes for SBOM and performance improvements (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/13b701bbab291eec4bc87ea17ba06c94e5fe3054"><code>13b701b</code></a> Add release notes for <a href="https://redirect.github.com/python-pillow/Pillow/issues/9679">#9679</a></li> <li><a href="https://github.com/python-pillow/Pillow/commit/5564ca72fcd59d040e270af5dcf17a0d7161c364"><code>5564ca7</code></a> List methods</li> <li><a href="https://github.com/python-pillow/Pillow/commit/a0920fd384f800b5d0ba3dd29ecdeae4f1d4043b"><code>a0920fd</code></a> Speed up ImageChops operations (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9738">#9738</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/07e9a6cd5336dc6cf8cae9165cd70cdd2b3e42fc"><code>07e9a6c</code></a> Speed up <code>Image.filter()</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9736">#9736</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/a94578cf9649ea13e426cf7fb2b71b39ffc0dd50"><code>a94578c</code></a> Speed up <code>Image.getchannel()</code>, <code>Image.merge()</code>, <code>Image.putalpha()</code> and `Image...</li> <li><a href="https://github.com/python-pillow/Pillow/commit/53e02c43c919d149b2a154a5180079f9df18fbbb"><code>53e02c4</code></a> Speed up <code>Image.fill()</code>, <code>Image.linear_gradient()</code> and `Image.radial_gradient...</li> <li><a href="https://github.com/python-pillow/Pillow/commit/af037475be8634ba739744243164ba9e2c8346a6"><code>af03747</code></a> Speed up <code>Image.resample()</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9739">#9739</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/5c9ca56c3e5fba52b647809fbb0986c87e73a571"><code>5c9ca56</code></a> Speed up <code>alpha_composite</code>, <code>matrix</code>, <code>negative</code>, <code>quantize</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9740">#9740</a>)</li> <li>Additional commits viewable in <a href="https://github.com/python-pillow/Pillow/compare/12.2.0...12.3.0">compare view</a></li> </ul> </details> <br /> Updates `pyasn1` from 0.6.3 to 0.6.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pyasn1/pyasn1/releases">pyasn1's releases</a>.</em></p> <blockquote> <h2>Release 0.6.4</h2> <p>This is a security release.</p> <ul> <li>CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU.</li> <li>CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits). Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory.</li> <li>CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in <code>Real.__float__()</code> for values with large base-10 exponents.</li> <li>Pinned PyPI publish GitHub Action to an immutable commit.</li> </ul> <p>All changes are noted in the <a href="https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst">CHANGELOG</a>.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst">pyasn1's changelog</a>.</em></p> <blockquote> <h2>Revision 0.6.4, released 08-07-2026</h2> <ul> <li>CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU. Arcs are now accumulated in linear time; decoded values are unchanged (thanks for reporting, tynus2)</li> <li>CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits), matching the OID arc limit introduced in 0.6.2. Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory; longer tag IDs are now rejected with PyAsn1Error. Also fixed Tag and TagSet repr() failing on huge tag (thanks for reporting, mikeappsec) IDs due to the integer-to-string conversion limit (Python 3.11+)</li> <li>CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in Real.<strong>float</strong>() for values with large base-10 exponents. Conversion no longer materializes huge intermediate integers; values too large to represent as a Python float raise OverflowError promptly, and prettyPrint() renders them as '<!-- raw HTML omitted -->' as before. Also fixed base-10 mantissa normalization to use exact integer arithmetic; mantissas larger than 2**53 could previously lose precision through float division (thanks for reporting, gvozdila)</li> <li>Pinned PyPI publish GitHub Action to an immutable commit [pr <a href="https://redirect.github.com/pyasn1/pyasn1/issues/113">#113</a>](<a href="https://redirect.github.com/pyasn1/pyasn1/pull/113">pyasn1/pyasn1#113</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pyasn1/pyasn1/commit/72e4803405816c371ed3b2cb4be181c47f038406"><code>72e4803</code></a> Prepare release 0.6.4</li> <li><a href="https://github.com/pyasn1/pyasn1/commit/0c19eeb853731db1c717ff125ea001a1e558332d"><code>0c19eeb</code></a> Pin PyPI publish action to immutable commit (<a href="https://redirect.github.com/pyasn1/pyasn1/issues/113">#113</a>)</li> <li><a href="https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9"><code>45bdb19</code></a> Merge commit from fork</li> <li><a href="https://github.com/pyasn1/pyasn1/commit/628e36ecbb5277a3f01572ce418ef54271b165a5"><code>628e36e</code></a> Merge commit from fork</li> <li><a href="https://github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886"><code>e60c691</code></a> Merge commit from fork</li> <li>See full diff in <a href="https://github.com/pyasn1/pyasn1/compare/v0.6.3...v0.6.4">compare view</a></li> </ul> </details> <br /> Updates `pillow` from 12.2.0 to 12.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/python-pillow/Pillow/releases">pillow's releases</a>.</em></p> <blockquote> <h2>12.3.0</h2> <p><a href="https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html">https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html</a></p> <h2>Removals</h2> <ul> <li>Remove non-image ImageCms modes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9697">#9697</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Documentation</h2> <ul> <li>Add release notes for SBOM and performance improvements <a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add security release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9741">#9741</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add release notes for Python 3.15 beta wheels <a href="https://redirect.github.com/python-pillow/Pillow/issues/9696">#9696</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>ImageFont can also be used with ImageText <a href="https://redirect.github.com/python-pillow/Pillow/issues/9597">#9597</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Additional guidelines for security reports <a href="https://redirect.github.com/python-pillow/Pillow/issues/9659">#9659</a> [<a href="https://github.com/wiredfool"><code>@wiredfool</code></a>]</li> <li>Fixed typo <a href="https://redirect.github.com/python-pillow/Pillow/issues/9636">#9636</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Added CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9591">#9591</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Revise development support information in README <a href="https://redirect.github.com/python-pillow/Pillow/issues/9583">#9583</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add INCIDENT_RESPONSE.md <a href="https://redirect.github.com/python-pillow/Pillow/issues/9555">#9555</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add STRIDE threat model to security docs <a href="https://redirect.github.com/python-pillow/Pillow/issues/9562">#9562</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9556">#9556</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update README with revised security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9553">#9553</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9552">#9552</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Update macOS tested Python versions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9534">#9534</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Dependencies</h2> <ul> <li>Update dependency harfbuzz to v14.2.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9720">#9720</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency mypy to v2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9653">#9653</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency cibuildwheel to v4 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9665">#9665</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update github-actions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9655">#9655</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency libavif to v1.4.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9652">#9652</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency lcms2 to v2.19.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9651">#9651</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency check-jsonschema to v0.37.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9650">#9650</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update google/oss-fuzz digest to d872252 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9614">#9614</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency lcms2 to v2.19 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9609">#9609</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency libpng to v1.6.58 - autoclosed <a href="https://redirect.github.com/python-pillow/Pillow/issues/9608">#9608</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency harfbuzz to v14 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9610">#9610</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency mypy to v1.20.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9599">#9599</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update github-actions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9611">#9611</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency cibuildwheel to v3.4.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9607">#9607</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Move dependency versions to single JSON and enable Renovate <a href="https://redirect.github.com/python-pillow/Pillow/issues/9559">#9559</a> [<a href="https://github.com/hugovk"><code>@hugovk</code></a>]</li> <li>Updated raqm to 0.10.5 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9557">#9557</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update dependency cibuildwheel to v3.4.0 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9532">#9532</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> </ul> <h2>Testing</h2> <ul> <li>Remove matrix.os from benchmark <a href="https://redirect.github.com/python-pillow/Pillow/issues/9735">#9735</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Remove references to libavif patch <a href="https://redirect.github.com/python-pillow/Pillow/issues/9734">#9734</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add benchmark tests <a href="https://redirect.github.com/python-pillow/Pillow/issues/9654">#9654</a> [<a href="https://github.com/akx"><code>@akx</code></a>]</li> <li>Use reshape() instead of setting NumPy array shape directly <a href="https://redirect.github.com/python-pillow/Pillow/issues/9728">#9728</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python-pillow/Pillow/commit/bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d"><code>bb1d8e8</code></a> 12.3.0 version bump</li> <li><a href="https://github.com/python-pillow/Pillow/commit/e63fc481dc2e07e21d5403deafb8f1ed98a513af"><code>e63fc48</code></a> Add release notes for SBOM and performance improvements (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/13b701bbab291eec4bc87ea17ba06c94e5fe3054"><code>13b701b</code></a> Add release notes for <a href="https://redirect.github.com/python-pillow/Pillow/issues/9679">#9679</a></li> <li><a href="https://github.com/python-pillow/Pillow/commit/5564ca72fcd59d040e270af5dcf17a0d7161c364"><code>5564ca7</code></a> List methods</li> <li><a href="https://github.com/python-pillow/Pillow/commit/a0920fd384f800b5d0ba3dd29ecdeae4f1d4043b"><code>a0920fd</code></a> Speed up ImageChops operations (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9738">#9738</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/07e9a6cd5336dc6cf8cae9165cd70cdd2b3e42fc"><code>07e9a6c</code></a> Speed up <code>Image.filter()</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9736">#9736</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/a94578cf9649ea13e426cf7fb2b71b39ffc0dd50"><code>a94578c</code></a> Speed up <code>Image.getchannel()</code>, <code>Image.merge()</code>, <code>Image.putalpha()</code> and `Image...</li> <li><a href="https://github.com/python-pillow/Pillow/commit/53e02c43c919d149b2a154a5180079f9df18fbbb"><code>53e02c4</code></a> Speed up <code>Image.fill()</code>, <code>Image.linear_gradient()</code> and `Image.radial_gradient...</li> <li><a href="https://github.com/python-pillow/Pillow/commit/af037475be8634ba739744243164ba9e2c8346a6"><code>af03747</code></a> Speed up <code>Image.resample()</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9739">#9739</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/5c9ca56c3e5fba52b647809fbb0986c87e73a571"><code>5c9ca56</code></a> Speed up <code>alpha_composite</code>, <code>matrix</code>, <code>negative</code>, <code>quantize</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9740">#9740</a>)</li> <li>Additional commits viewable in <a href="https://github.com/python-pillow/Pillow/compare/12.2.0...12.3.0">compare view</a></li> </ul> </details> <br /> Updates `pillow` from 12.2.0 to 12.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/python-pillow/Pillow/releases">pillow's releases</a>.</em></p> <blockquote> <h2>12.3.0</h2> <p><a href="https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html">https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html</a></p> <h2>Removals</h2> <ul> <li>Remove non-image ImageCms modes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9697">#9697</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Documentation</h2> <ul> <li>Add release notes for SBOM and performance improvements <a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add security release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9741">#9741</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add release notes for Python 3.15 beta wheels <a href="https://redirect.github.com/python-pillow/Pillow/issues/9696">#9696</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>ImageFont can also be used with ImageText <a href="https://redirect.github.com/python-pillow/Pillow/issues/9597">#9597</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Additional guidelines for security reports <a href="https://redirect.github.com/python-pillow/Pillow/issues/9659">#9659</a> [<a href="https://github.com/wiredfool"><code>@wiredfool</code></a>]</li> <li>Fixed typo <a href="https://redirect.github.com/python-pillow/Pillow/issues/9636">#9636</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Added CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9591">#9591</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Revise development support information in README <a href="https://redirect.github.com/python-pillow/Pillow/issues/9583">#9583</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add INCIDENT_RESPONSE.md <a href="https://redirect.github.com/python-pillow/Pillow/issues/9555">#9555</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add STRIDE threat model to security docs <a href="https://redirect.github.com/python-pillow/Pillow/issues/9562">#9562</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9556">#9556</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update README with revised security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9553">#9553</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9552">#9552</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Update macOS tested Python versions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9534">#9534</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Dependencies</h2> <ul> <li>Update dependency harfbuzz to v14.2.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9720">#9720</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency mypy to v2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9653">#9653</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency cibuildwheel to v4 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9665">#9665</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update github-actions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9655">#9655</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency libavif to v1.4.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9652">#9652</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency lcms2 to v2.19.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9651">#9651</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency check-jsonschema to v0.37.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9650">#9650</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update google/oss-fuzz digest to d872252 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9614">#9614</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency lcms2 to v2.19 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9609">#9609</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency libpng to v1.6.58 - autoclosed <a href="https://redirect.github.com/python-pillow/Pillow/issues/9608">#9608</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency harfbuzz to v14 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9610">#9610</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency mypy to v1.20.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9599">#9599</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update github-actions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9611">#9611</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency cibuildwheel to v3.4.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9607">#9607</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Move dependency versions to single JSON and enable Renovate <a href="https://redirect.github.com/python-pillow/Pillow/issues/9559">#9559</a> [<a href="https://github.com/hugovk"><code>@hugovk</code></a>]</li> <li>Updated raqm to 0.10.5 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9557">#9557</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update dependency cibuildwheel to v3.4.0 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9532">#9532</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> </ul> <h2>Testing</h2> <ul> <li>Remove matrix.os from benchmark <a href="https://redirect.github.com/python-pillow/Pillow/issues/9735">#9735</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Remove references to libavif patch <a href="https://redirect.github.com/python-pillow/Pillow/issues/9734">#9734</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add benchmark tests <a href="https://redirect.github.com/python-pillow/Pillow/issues/9654">#9654</a> [<a href="https://github.com/akx"><code>@akx</code></a>]</li> <li>Use reshape() instead of setting NumPy array shape directly <a href="https://redirect.github.com/python-pillow/Pillow/issues/9728">#9728</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python-pillow/Pillow/commit/bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d"><code>bb1d8e8</code></a> 12.3.0 version bump</li> <li><a href="https://github.com/python-pillow/Pillow/commit/e63fc481dc2e07e21d5403deafb8f1ed98a513af"><code>e63fc48</code></a> Add release notes for SBOM and performance improvements (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/13b701bbab291eec4bc87ea17ba06c94e5fe3054"><code>13b701b</code></a> Add release notes for <a href="https://redirect.github.com/python-pillow/Pillow/issues/9679">#9679</a></li> <li><a href="https://github.com/python-pillow/Pillow/commit/5564ca72fcd59d040e270af5dcf17a0d7161c364"><code>5564ca7</code></a> List methods</li> <li><a href="https://github.com/python-pillow/Pillow/commit/a0920fd384f800b5d0ba3dd29ecdeae4f1d4043b"><code>a0920fd</code></a> Speed up ImageChops operations (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9738">#9738</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/07e9a6cd5336dc6cf8cae9165cd70cdd2b3e42fc"><code>07e9a6c</code></a> Speed up <code>Image.filter()</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9736">#9736</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/a94578cf9649ea13e426cf7fb2b71b39ffc0dd50"><code>a94578c</code></a> Speed up <code>Image.getchannel()</code>, <code>Image.merge()</code>, <code>Image.putalpha()</code> and `Image...</li> <li><a href="https://github.com/python-pillow/Pillow/commit/53e02c43c919d149b2a154a5180079f9df18fbbb"><code>53e02c4</code></a> Speed up <code>Image.fill()</code>, <code>Image.linear_gradient()</code> and `Image.radial_gradient...</li> <li><a href="https://github.com/python-pillow/Pillow/commit/af037475be8634ba739744243164ba9e2c8346a6"><code>af03747</code></a> Speed up <code>Image.resample()</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9739">#9739</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/5c9ca56c3e5fba52b647809fbb0986c87e73a571"><code>5c9ca56</code></a> Speed up <code>alpha_composite</code>, <code>matrix</code>, <code>negative</code>, <code>quantize</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9740">#9740</a>)</li> <li>Additional commits viewable in <a href="https://github.com/python-pillow/Pillow/compare/12.2.0...12.3.0">compare view</a></li> </ul> </details> <br /> Updates `pillow` from 12.2.0 to 12.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/python-pillow/Pillow/releases">pillow's releases</a>.</em></p> <blockquote> <h2>12.3.0</h2> <p><a href="https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html">https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html</a></p> <h2>Removals</h2> <ul> <li>Remove non-image ImageCms modes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9697">#9697</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Documentation</h2> <ul> <li>Add release notes for SBOM and performance improvements <a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add security release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9741">#9741</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add release notes for Python 3.15 beta wheels <a href="https://redirect.github.com/python-pillow/Pillow/issues/9696">#9696</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>ImageFont can also be used with ImageText <a href="https://redirect.github.com/python-pillow/Pillow/issues/9597">#9597</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Additional guidelines for security reports <a href="https://redirect.github.com/python-pillow/Pillow/issues/9659">#9659</a> [<a href="https://github.com/wiredfool"><code>@wiredfool</code></a>]</li> <li>Fixed typo <a href="https://redirect.github.com/python-pillow/Pillow/issues/9636">#9636</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Added CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9591">#9591</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Revise development support information in README <a href="https://redirect.github.com/python-pillow/Pillow/issues/9583">#9583</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add INCIDENT_RESPONSE.md <a href="https://redirect.github.com/python-pillow/Pillow/issues/9555">#9555</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add STRIDE threat model to security docs <a href="https://redirect.github.com/python-pillow/Pillow/issues/9562">#9562</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9556">#9556</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update README with revised security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9553">#9553</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9552">#9552</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Update macOS tested Python versions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9534">#9534</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Dependencies</h2> <ul> <li>Update dependency harfbuzz to v14.2.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9720">#9720</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency mypy to v2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9653">#9653</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency cibuildwheel to v4 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9665">#9665</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update github-actions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9655">#9655</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency libavif to v1.4.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9652">#9652</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency lcms2 to v2.19.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9651">#9651</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency check-jsonschema to v0.37.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9650">#9650</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update google/oss-fuzz digest to d872252 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9614">#9614</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency lcms2 to v2.19 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9609">#9609</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency libpng to v1.6.58 - autoclosed <a href="https://redirect.github.com/python-pillow/Pillow/issues/9608">#9608</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency harfbuzz to v14 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9610">#9610</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency mypy to v1.20.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9599">#9599</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update github-actions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9611">#9611</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency cibuildwheel to v3.4.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9607">#9607</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Move dependency versions to single JSON and enable Renovate <a href="https://redirect.github.com/python-pillow/Pillow/issues/9559">#9559</a> [<a href="https://github.com/hugovk"><code>@hugovk</code></a>]</li> <li>Updated raqm to 0.10.5 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9557">#9557</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update dependency cibuildwheel to v3.4.0 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9532">#9532</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> </ul> <h2>Testing</h2> <ul> <li>Remove matrix.os from benchmark <a href="https://redirect.github.com/python-pillow/Pillow/issues/9735">#9735</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Remove references to libavif patch <a href="https://redirect.github.com/python-pillow/Pillow/issues/9734">#9734</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add benchmark tests <a href="https://redirect.github.com/python-pillow/Pillow/issues/9654">#9654</a> [<a href="https://github.com/akx"><code>@akx</code></a>]</li> <li>Use reshape() instead of setting NumPy array shape directly <a href="https://redirect.github.com/python-pillow/Pillow/issues/9728">#9728</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python-pillow/Pillow/commit/bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d"><code>bb1d8e8</code></a> 12.3.0 version bump</li> <li><a href="https://github.com/python-pillow/Pillow/commit/e63fc481dc2e07e21d5403deafb8f1ed98a513af"><code>e63fc48</code></a> Add release notes for SBOM and performance improvements (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/13b701bbab291eec4bc87ea17ba06c94e5fe3054"><code>13b701b</code></a> Add release notes for <a href="https://redirect.github.com/python-pillow/Pillow/issues/9679">#9679</a></li> <li><a href="https://github.com/python-pillow/Pillow/commit/5564ca72fcd59d040e270af5dcf17a0d7161c364"><code>5564ca7</code></a> List methods</li> <li><a href="https://github.com/python-pillow/Pillow/commit/a0920fd384f800b5d0ba3dd29ecdeae4f1d4043b"><code>a0920fd</code></a> Speed up ImageChops operations (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9738">#9738</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/07e9a6cd5336dc6cf8cae9165cd70cdd2b3e42fc"><code>07e9a6c</code></a> Speed up <code>Image.filter()</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9736">#9736</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/a94578cf9649ea13e426cf7fb2b71b39ffc0dd50"><code>a94578c</code></a> Speed up <code>Image.getchannel()</code>, <code>Image.merge()</code>, <code>Image.putalpha()</code> and `Image...</li> <li><a href="https://github.com/python-pillow/Pillow/commit/53e02c43c919d149b2a154a5180079f9df18fbbb"><code>53e02c4</code></a> Speed up <code>Image.fill()</code>, <code>Image.linear_gradient()</code> and `Image.radial_gradient...</li> <li><a href="https://github.com/python-pillow/Pillow/commit/af037475be8634ba739744243164ba9e2c8346a6"><code>af03747</code></a> Speed up <code>Image.resample()</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9739">#9739</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/5c9ca56c3e5fba52b647809fbb0986c87e73a571"><code>5c9ca56</code></a> Speed up <code>alpha_composite</code>, <code>matrix</code>, <code>negative</code>, <code>quantize</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9740">#9740</a>)</li> <li>Additional commits viewable in <a href="https://github.com/python-pillow/Pillow/compare/12.2.0...12.3.0">compare view</a></li> </ul> </details> <br /> Updates `pillow` from 12.2.0 to 12.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/python-pillow/Pillow/releases">pillow's releases</a>.</em></p> <blockquote> <h2>12.3.0</h2> <p><a href="https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html">https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html</a></p> <h2>Removals</h2> <ul> <li>Remove non-image ImageCms modes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9697">#9697</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Documentation</h2> <ul> <li>Add release notes for SBOM and performance improvements <a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add security release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9741">#9741</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add release notes for Python 3.15 beta wheels <a href="https://redirect.github.com/python-pillow/Pillow/issues/9696">#9696</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>ImageFont can also be used with ImageText <a href="https://redirect.github.com/python-pillow/Pillow/issues/9597">#9597</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Additional guidelines for security reports <a href="https://redirect.github.com/python-pillow/Pillow/issues/9659">#9659</a> [<a href="https://github.com/wiredfool"><code>@wiredfool</code></a>]</li> <li>Fixed typo <a href="https://redirect.github.com/python-pillow/Pillow/issues/9636">#9636</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Added CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9591">#9591</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Revise development support information in README <a href="https://redirect.github.com/python-pillow/Pillow/issues/9583">#9583</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add INCIDENT_RESPONSE.md <a href="https://redirect.github.com/python-pillow/Pillow/issues/9555">#9555</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add STRIDE threat model to security docs <a href="https://redirect.github.com/python-pillow/Pillow/issues/9562">#9562</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9556">#9556</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update README with revised security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9553">#9553</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9552">#9552</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Update macOS tested Python versions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9534">#9534</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Dependencies</h2> <ul> <li>Update dependency harfbuzz to v14.2.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9720">#9720</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency mypy to v2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9653">#9653</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency cibuildwheel to v4 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9665">#9665</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update github-actions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9655">#9655</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency libavif to v1.4.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9652">#9652</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency lcms2 to v2.19.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9651">#9651</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency check-jsonschema to v0.37.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9650">#9650</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update google/oss-fuzz digest to d872252 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9614">#9614</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency lcms2 to v2.19 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9609">#9609</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency libpng to v1.6.58 - autoclosed <a href="https://redirect.github.com/python-pillow/Pillow/issues/9608">#9608</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency harfbuzz to v14 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9610">#9610</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency mypy to v1.20.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9599">#9599</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update github-actions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9611">#9611</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency cibuildwheel to v3.4.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9607">#9607</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Move dependency versions to single JSON and enable Renovate <a href="https://redirect.github.com/python-pillow/Pillow/issues/9559">#9559</a> [<a href="https://github.com/hugovk"><code>@hugovk</code></a>]</li> <li>Updated raqm to 0.10.5 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9557">#9557</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update dependency cibuildwheel to v3.4.0 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9532">#9532</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> </ul> <h2>Testing</h2> <ul> <li>Remove matrix.os from benchmark <a href="https://redirect.github.com/python-pillow/Pillow/issues/9735">#9735</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Remove references to libavif patch <a href="https://redirect.github.com/python-pillow/Pillow/issues/9734">#9734</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add benchmark tests <a href="https://redirect.github.com/python-pillow/Pillow/issues/9654">#9654</a> [<a href="https://github.com/akx"><code>@akx</code></a>]</li> <li>Use reshape() instead of setting NumPy array shape directly <a href="https://redirect.github.com/python-pillow/Pillow/issues/9728">#9728</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python-pillow/Pillow/commit/bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d"><code>bb1d8e8</code></a> 12.3.0 version bump</li> <li><a href="https://github.com/python-pillow/Pillow/commit/e63fc481dc2e07e21d5403deafb8f1ed98a513af"><code>e63fc48</code></a> Add release notes for SBOM and performance improvements (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/13b701bbab291eec4bc87ea17ba06c94e5fe3054"><code>13b701b</code></a> Add release notes for <a href="https://redirect.github.com/python-pillow/Pillow/issues/9679">#9679</a></li> <li><a href="https://github.com/python-pillow/Pillow/commit/5564ca72fcd59d040e270af5dcf17a0d7161c364"><code>5564ca7</code></a> List methods</li> <li><a href="https://github.com/python-pillow/Pillow/commit/a0920fd384f800b5d0ba3dd29ecdeae4f1d4043b"><code>a0920fd</code></a> Speed up ImageChops operations (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9738">#9738</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/07e9a6cd5336dc6cf8cae9165cd70cdd2b3e42fc"><code>07e9a6c</code></a> Speed up <code>Image.filter()</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9736">#9736</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/a94578cf9649ea13e426cf7fb2b71b39ffc0dd50"><code>a94578c</code></a> Speed up <code>Image.getchannel()</code>, <code>Image.merge()</code>, <code>Image.putalpha()</code> and `Image...</li> <li><a href="https://github.com/python-pillow/Pillow/commit/53e02c43c919d149b2a154a5180079f9df18fbbb"><code>53e02c4</code></a> Speed up <code>Image.fill()</code>, <code>Image.linear_gradient()</code> and `Image.radial_gradient...</li> <li><a href="https://github.com/python-pillow/Pillow/commit/af037475be8634ba739744243164ba9e2c8346a6"><code>af03747</code></a> Speed up <code>Image.resample()</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9739">#9739</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/5c9ca56c3e5fba52b647809fbb0986c87e73a571"><code>5c9ca56</code></a> Speed up <code>alpha_composite</code>, <code>matrix</code>, <code>negative</code>, <code>quantize</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9740">#9740</a>)</li> <li>Additional commits viewable in <a href="https://github.com/python-pillow/Pillow/compare/12.2.0...12.3.0">compare view</a></li> </ul> </details> <br /> Updates `pillow` from 12.2.0 to 12.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/python-pillow/Pillow/releases">pillow's releases</a>.</em></p> <blockquote> <h2>12.3.0</h2> <p><a href="https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html">https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html</a></p> <h2>Removals</h2> <ul> <li>Remove non-image ImageCms modes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9697">#9697</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Documentation</h2> <ul> <li>Add release notes for SBOM and performance improvements <a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add security release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9741">#9741</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add release notes for Python 3.15 beta wheels <a href="https://redirect.github.com/python-pillow/Pillow/issues/9696">#9696</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>ImageFont can also be used with ImageText <a href="https://redirect.github.com/python-pillow/Pillow/issues/9597">#9597</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Additional guidelines for security reports <a href="https://redirect.github.com/python-pillow/Pillow/issues/9659">#9659</a> [<a href="https://github.com/wiredfool"><code>@wiredfool</code></a>]</li> <li>Fixed typo <a href="https://redirect.github.com/python-pillow/Pillow/issues/9636">#9636</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Added CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9591">#9591</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Revise development support information in README <a href="https://redirect.github.com/python-pillow/Pillow/issues/9583">#9583</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add INCIDENT_RESPONSE.md <a href="https://redirect.github.com/python-pillow/Pillow/issues/9555">#9555</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add STRIDE threat model to security docs <a href="https://redirect.github.com/python-pillow/Pillow/issues/9562">#9562</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Add CVEs to 12.2.0 release notes <a href="https://redirect.github.com/python-pillow/Pillow/issues/9556">#9556</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update README with revised security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9553">#9553</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update security policy <a href="https://redirect.github.com/python-pillow/Pillow/issues/9552">#9552</a> [<a href="https://github.com/aclark4life"><code>@aclark4life</code></a>]</li> <li>Update macOS tested Python versions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9534">#9534</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <h2>Dependencies</h2> <ul> <li>Update dependency harfbuzz to v14.2.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9720">#9720</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency mypy to v2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9653">#9653</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency cibuildwheel to v4 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9665">#9665</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update github-actions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9655">#9655</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency libavif to v1.4.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9652">#9652</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency lcms2 to v2.19.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9651">#9651</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency check-jsonschema to v0.37.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9650">#9650</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update google/oss-fuzz digest to d872252 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9614">#9614</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency lcms2 to v2.19 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9609">#9609</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency libpng to v1.6.58 - autoclosed <a href="https://redirect.github.com/python-pillow/Pillow/issues/9608">#9608</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency harfbuzz to v14 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9610">#9610</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency mypy to v1.20.2 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9599">#9599</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update github-actions <a href="https://redirect.github.com/python-pillow/Pillow/issues/9611">#9611</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Update dependency cibuildwheel to v3.4.1 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9607">#9607</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> <li>Move dependency versions to single JSON and enable Renovate <a href="https://redirect.github.com/python-pillow/Pillow/issues/9559">#9559</a> [<a href="https://github.com/hugovk"><code>@hugovk</code></a>]</li> <li>Updated raqm to 0.10.5 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9557">#9557</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Update dependency cibuildwheel to v3.4.0 <a href="https://redirect.github.com/python-pillow/Pillow/issues/9532">#9532</a> [@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li> </ul> <h2>Testing</h2> <ul> <li>Remove matrix.os from benchmark <a href="https://redirect.github.com/python-pillow/Pillow/issues/9735">#9735</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Remove references to libavif patch <a href="https://redirect.github.com/python-pillow/Pillow/issues/9734">#9734</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> <li>Add benchmark tests <a href="https://redirect.github.com/python-pillow/Pillow/issues/9654">#9654</a> [<a href="https://github.com/akx"><code>@akx</code></a>]</li> <li>Use reshape() instead of setting NumPy array shape directly <a href="https://redirect.github.com/python-pillow/Pillow/issues/9728">#9728</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python-pillow/Pillow/commit/bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d"><code>bb1d8e8</code></a> 12.3.0 version bump</li> <li><a href="https://github.com/python-pillow/Pillow/commit/e63fc481dc2e07e21d5403deafb8f1ed98a513af"><code>e63fc48</code></a> Add release notes for SBOM and performance improvements (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/13b701bbab291eec4bc87ea17ba06c94e5fe3054"><code>13b701b</code></a> Add release notes for <a href="https://redirect.github.com/python-pillow/Pillow/issues/9679">#9679</a></li> <li><a href="https://github.com/python-pillow/Pillow/commit/5564ca72fcd59d040e270af5dcf17a0d7161c364"><code>5564ca7</code></a> List methods</li> <li><a href="https://github.com/python-pillow/Pillow/commit/a0920fd384f800b5d0ba3dd29ecdeae4f1d4043b"><code>a0920fd</code></a> Speed up ImageChops operations (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9738">#9738</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/07e9a6cd5336dc6cf8cae9165cd70cdd2b3e42fc"><code>07e9a6c</code></a> Speed up <code>Image.filter()</code> (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9736">#9736</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/a94578cf9649ea13e426cf7fb2b71b39ffc0dd50"><code>a94578c</code></a> Speed up <code>Image.getchannel()</code>, <code>Image.merge()</code>, <code>Image.putalpha()</code> and `Image...</li> <li><a href="https://github.com/python-pillow/Pillow/commit/53e02c4…
## What Adds `Client.GetIndexInfo(ctx, indexName)` to the Go SDK's public API. ## Why `bindings/libmoss.go` already implements `IndexManager.GetIndexInfo` against the native runtime, but nothing in `sdk/` exposed it. The existing `Client.GetIndex` only queries the cloud/manage-plane index metadata and there was no way to ask "what does the copy I currently have loaded in memory look like right now" (doc count, model, staleness relative to a `RefreshIndex` call, etc.) without dropping down to the internal bindings package directly. ## Changes - `sdk/local.go`: new `Client.GetIndexInfo`, mirroring the existing `RefreshIndex` method and validates credentials, gets the index runtime, delegates to `manager.GetIndexInfo`, converts via `fromCoreIndexInfo`. - `sdk/client_test.go`: two new tests - confirms `GetIndexInfo` reads from the local index runtime, not the manage runtime (this is the whole point of the method) - confirms credential validation happens before the index runtime is ever initialized, consistent with the pattern used by `RefreshIndex` - `sdks/go/README.md` / `sdks/go/sdk/README.md`: updated capability lists to mention `GetIndexInfo`. ## Testing `go test ./...` passes locally (stub build, no native `libmoss` required and this method has no cgo-specific logic of its own, it's a thin wrapper, consistent with the rest of `local.go`). <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/usemoss/moss/pull/444?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. -->
Rewrites apps/ten-moss/README.md for a cleaner, more professional read. - Replaces the ASCII pipeline diagram with two GitHub-native Mermaid diagrams (architecture flowchart and per-turn sequence diagram), both verified to render. - Adds a stack-at-a-glance table and converts the Moss delta, latency-breakdown fields, simulate-remote values, and configuration into proper tables. Config defaults are sourced from property.json and MossSessionConfig (including the previously undocumented moss_max_context_chars). - Tightens section structure and wording; no technical content changed. <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/usemoss/moss/pull/458?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> --------- Co-authored-by: Harsha Nalluru <harsha.nalluru1997@gmail.com>
## Summary - Sync `ROADMAP.md` with integrations that are already in the repo: Go SDK, Langflow, n8n, and TEN Framework - Remove Go from “Next Up → New SDK Bindings” now that `sdks/go/` exists - Correct the Next.js example version from 15 → 16 to match `apps/next-js` ## Test plan - [ ] Check shipped sections against `README.md` / `AGENTS.md` - [ ] Confirm Go is no longer listed under “Next Up” <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/usemoss/moss/pull/465?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> Co-authored-by: Cursor <cursoragent@cursor.com>
## Pull Request Checklist Please ensure that your PR meets the following requirements: - [x] I have read the [CONTRIBUTING](CONTRIBUTING.md) guide. - [ ] I have updated the documentation (if applicable). - [x] My code follows the style guidelines of this project. - [x] I have performed a self-review of my own code. - [ ] I have added tests that prove my fix is effective or that my feature works. - [x] New and existing unit tests pass locally with my changes. ## Description Bumps `lodash` from `4.17.23` to the patched `4.18.1` release in `packages/n8n-nodes-moss`, the only project in the repo still resolving a vulnerable lodash version. `lodash` is pulled in transitively (dev-only) via `n8n-workflow` → `@n8n/expression-runtime`, which pins an exact `4.17.23`, so a top-level `overrides` entry was added to `package.json` (matching the pattern already used at the repo root and in `vitepress-plugin-moss`) to force resolution to `^4.18.1`, then `package-lock.json` was regenerated via `npm install`. 4.18.0/4.18.1 fix a prototype-pollution issue in `_.unset`/`_.omit` (GHSA-f23m-r3pf-42rh) and a code-injection issue in `_.template` (GHSA-r5fr-rjxr-66jc, CVE-2026-4800), plus a follow-up bugfix. Other lockfiles in the repo that reference lodash (`apps/livekit-moss-vercel/agent-react`, `apps/moss-vscode`, `sdks/javascript/sdk`) were already on `4.18.1`; the rest only contain unrelated standalone packages (`lodash.merge`, `lodash.sortby`, etc.) unaffected by this bump. Fixes usemoss#467 ## Type of Change - [x] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] This change requires a documentation update fill it accordingly <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/usemoss/moss/pull/474?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. -->
## Pull Request Checklist - [x] I have read the [CONTRIBUTING](CONTRIBUTING.md) guide. - [x] I have updated the documentation (not applicable: lockfile-only update). - [x] My changes follow the style guidelines of this project. - [x] I have performed a self-review of my changes. - [x] I have added tests that prove my fix is effective (not applicable: generated dependency metadata only). - [x] New and existing unit tests pass locally with my changes. ## Description Update `idna` from `3.13` or `3.15` to `3.18` in the 22 stale Python lockfiles, bringing all 26 `uv.lock` files that resolve `idna` onto the latest release. Regenerating the locks also synchronizes six stale package metadata constraints with their existing `pyproject.toml` declarations. No package version other than `idna` changes. Fixes usemoss#423 ## Type of Change - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] This change requires a documentation update - [x] Dependency update (non-breaking) ## Testing - `uv lock --check` for all 22 changed projects - `ruff check . --extend-exclude "**/*.ipynb"` - CI-equivalent repository mypy check - Python SDK Ruff and mypy checks - Python SDK tests: 86 passed, 44 credential-dependent tests skipped - Affected project tests: 55 passed, 4 live integration tests skipped - `idna 3.18` Unicode hostname encode/decode smoke test <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/usemoss/moss/pull/462?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. -->
…usemoss#457) Fixes usemoss#424 ## What Bumps `json-repair` from 0.59.10 to 0.60.1 in `examples/voice-agents/insurance-adjuster/uv.lock`, the only lockfile in the repo that carries it. `json-repair` is a transitive dependency pinned exactly (`json-repair==0.60.1`) by `livekit-agents`, so moving it required upgrading the livekit family as well (1.6.3 → 1.6.6, all within the manifest's `>=1.0` constraint). 0.60.1 is the newest json-repair version any published `livekit-agents` release allows — 0.61.x is not reachable until upstream relaxes its exact pin. Generated with `uv lock --upgrade-package livekit-agents --upgrade-package json-repair`; no manifest changes. ## Verification - `uv sync` installs the updated lockfile cleanly (Python 3.14) - `json_repair` imports and repairs a malformed JSON sample at 0.60.1 - `agent.py` and `create_indexes.py` compile, and `livekit.agents` 1.6.6 imports without errors <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/usemoss/moss/pull/457?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. -->
## Pull Request Checklist * [x] I have read the [[CONTRIBUTING](https://chatgpt.com/c/CONTRIBUTING.md)](CONTRIBUTING.md) guide. * [ ] I have updated the documentation (not applicable). * [x] My code follows the style guidelines of this project. * [x] I have performed a self-review of my own code. * [ ] I have added tests that prove my fix is effective or that my feature works (not applicable for a dependency update). * [x] New and existing unit tests pass locally with my changes, where applicable. ## Description This PR upgrades `postcss` to `^8.5.19` in the relevant packages and refreshes the corresponding lockfiles (`package-lock.json` and `pnpm-lock.yaml`). I verified that the updated dependency is installed (`postcss@8.5.19`) and confirmed the affected site builds successfully after the upgrade. Fixes usemoss#429 ## Type of Change * [x] Bug fix (dependency maintenance/update) * [ ] New feature * [ ] Breaking change * [ ] This change requires a documentation update <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/usemoss/moss/pull/439?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
…oss#437) ## What Makes the Codex PR reviewer run on **all pull requests, including forks/contributors** — today fork PRs are silently skipped. ## Why forks were skipped A fork's `pull_request` run gets a read-only token and **no secrets** (GitHub's fork-safety default), so the reviewer can't get `OPENAI_API_KEY`. The old workflow acknowledged this by gating itself to same-repo branches (`sameRepo` check), so every contributor PR got `Skipping Codex review: … is from a fork`. You can't fix this by dropping the gate — the secret still isn't there on fork runs. You need a trigger that *has* secrets, without ever running fork code next to them. ## How — two-stage split | Stage | File | Trigger | Secrets? | Touches PR code? | |---|---|---|---|---| | 1. Collect diff | `codex-review.yml` | `pull_request` (all PRs) | ❌ none | checkout + `git diff` only (no build/install) | | 2. Review + post | `codex-review-post.yml` | `workflow_run` (base context) | ✅ | ❌ — reads the diff artifact only | Stage 1 runs on every PR with no secrets, computes the diff, and uploads it as an artifact. Stage 2 is triggered by Stage 1's completion, runs in the **base-repo** context (so it has secrets even for forks), downloads the diff, runs Codex over the **diff text only**, and posts the inline review. **Fork code never executes in a job that holds the key** — that's the structural guarantee that makes reviewing fork PRs safe, and it's more robust than `pull_request_target` (which would put fork code on disk beside the secret and rely on "no one ever adds a build step"). ## Security notes - **Anti-spoofing:** the artifact carries the PR number; Stage 2 requires `pr.head.sha === workflow_run.head_sha` (a value GitHub sets, not the fork) before posting, so a tampered artifact can't redirect the review onto another PR. PR number is validated as digits-only. - **Least privilege:** Stage 1 is `contents: read`. Stage 2 is `contents: read`, `actions: read` (to fetch the artifact), `pull-requests/issues: write` (to post). - **Residual risk — please use a scoped key.** Codex still reads the untrusted diff as *data*, and per the action's docs the API key "flows through the proxy, so Codex could read it if it can reach process memory." A prompt-injection payload in a diff could in principle try to coax the key into a review comment. The two-stage split does **not** remove this (it removes code *execution*), so use a low-limit / restricted `OPENAI_API_KEY` for this workflow. ## Behavior changes - Auto-reviews **all non-draft, non-bot PRs** (previously same-repo only). - **Drops** the `@codex review` comment trigger and the trusted-commenter gate (no longer needed to keep forks out). Easy to re-add as an opt-in gate if you'd prefer maintainer-triggered reviews on forks to control cost. ## Activation caveat `workflow_run` only fires for the copy of these workflows **on the default branch**, so Codex review activates once this is merged to `main` — **this PR will not review itself.** After merge, opening any fork PR (or re-syncing an existing one like usemoss#391/usemoss#393) will exercise it end-to-end. ## Not tested in CI here The `openai/codex-action` step reviews a pre-computed `pr.diff` in an empty `git init`'d working dir (rather than a full checkout). YAML + embedded JS are validated locally; the first live run after merge is the real end-to-end test. <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/usemoss/moss/pull/437?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. -->
## Summary Fixes two setup failures hit while standing up the ten-moss example from a clean machine, and automates the drop-in step. - **Commit the executable bit on `tenapp/scripts/*.sh`.** They were committed as `100644`, so `task install` failed with `permission denied` at `install_python_deps.sh` for every fresh checkout. - **Pre-warm the `moss-minilm` model cache during `task install`.** Two workers starting at the same moment on a cold cache race the model download and corrupt `~/.cache/moss-models` (one worker saw `IO error: No such file or directory`, the other `tokenization failed: trailing characters`). Because the extension opens Moss best-effort, the agent then runs silently ungrounded. Warming the cache from a single process at install time removes the race window in practice; the durable fix (atomic download or lock) belongs in the SDK layer and is out of scope here. - **Add `setup.sh`** to automate README Quick start step 2 (copy the `voice-assistant` harness, swap in `tenapp/`, seed `ai_agents/.env`), with guards for a non-TEN path and an existing target. - **README**: document the above, plus an Apple Silicon note (`ten_agent_build` is amd64-only; colima needs `--vz-rosetta`, since the Go toolchain segfaults under qemu emulation). ## Testing - `setup.sh` exercised against a mock TEN skeleton: drop-in, env seeding, re-run guard, and bad-path guard all verified. - Modified `install_python_deps.sh` run inside the `ten_agent_build:0.7.14` container: builds, installs, and reports `Moss model cache warm (doc_count=10)`; with `MOSS_*` unset it skips cleanly. - Full example validated end to end on this branch's content: playground session with Deepgram STT, gpt-4o-mini, ElevenLabs TTS, and `Moss session opened` with grounded retrieval in the transcript. <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/usemoss/moss/pull/479?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> --------- Co-authored-by: Harsha Nalluru <harsha.nalluru1997@gmail.com>
## Problem `main` and every open PR are currently red on the required checks **`python-lint`** and **`python-sdk-test`** (all Python versions). Root cause is a floating linter, not any code change: - Both jobs install ruff **unpinned** (`pip install ruff` in the `python-lint` job and again in the `python-sdk-test` "Lint with ruff" step). - **ruff 0.16.0** was published `2026-07-23T19:10:46Z`. The next `main` run (`378d72b`/`c3e6ddb`) executed at `19:14Z` — ~4 minutes later — and picked it up. - 0.16.0 turned on a large new default rule surface, which flags **~460 pre-existing findings** repo-wide: `UP045` (120), `I001` (84), `UP006` (79), `BLE001` (71), `UP035` (31), plus `S110`, `RUF*`, `SIM*`, `DTZ005`, etc. The last green `main` runs (01:00Z the same day) used **ruff 0.15.22**. **No `.py` changed** between those and the first red run (only `.yml` / lockfiles), so this is purely the ruff version. ## Fix Pin both installs to `ruff==0.15.22` (the last green version), with a comment explaining why. ## Verification (local, on current `main`) - `ruff==0.15.22 check . --extend-exclude '**/*.ipynb'` -> **All checks passed!** - `ruff==0.15.22 check src/ tests/` in `sdks/python/sdk` -> **All checks passed!** ## Note This is a deliberate stopgap to unblock merges immediately. The 460 findings under 0.16.0 are real lint signal; a follow-up can address (or selectively `ignore`) them and then bump the pin. Filing/So they don't get lost, happy to open that follow-up. <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/usemoss/moss/pull/480?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. -->
…semoss#402) ## Summary Adds an Amazon S3 source connector, built from the `packages/moss-data-connector/_template` pattern (with the DynamoDB connector as the boto3 style reference). It indexes documents from an S3 bucket and — per the watch-a-bucket story — re-indexes automatically when the bucket contents change. Closes usemoss#381 ## What's included **`S3Connector`** (`src/connector.py`) - Lists the bucket with `list_objects_v2`, following continuation tokens automatically - `prefix` filtering server-side, `suffix` filtering client-side (`".md"` or a tuple like `(".md", ".txt")`) — non-matching objects are skipped without being downloaded - Zero-byte "folder" placeholder keys (ending in `/`) always skipped - Hands the mapper a row dict: `key`, `text` (decoded body, configurable encoding), `etag`, `last_modified`, `size`, `content_type`, and S3 user metadata - `**boto3_kwargs` passthrough (`region_name`, `endpoint_url`, credentials) so MinIO/LocalStack work out of the box - `snapshot()` returns `{key: etag}` from a list-only pass — no bodies downloaded **`watch()`** (`src/watch.py`) — the re-index-on-change piece - Ingests once, then polls `snapshot()` on `poll_interval` and rebuilds the index whenever an object is added, removed, or modified - Snapshot is taken *before* each ingest, so changes landing mid-ingest are caught on the next poll rather than lost - `max_polls` for one-shot sync jobs and tests; `on_change` callback with the new snapshot - Per the template rules, sync/loop logic lives in the connector's own code — `ingest.py` is copied verbatim from the template **Tests** - `tests/test_s3.py` — 12 unit tests, moto-mocked, no AWS needed: ingest end-to-end, prefix/suffix filters, pagination (`page_size=1`), empty bucket, `auto_id`, user-metadata passthrough, snapshot add/modify/delete tracking, watch re-index on change, and watch no-op when unchanged - `tests/test_integration_s3_moss.py` — live round trip (S3 → ingest → Moss query → cleanup) plus a live watch test; skip-gated the same way as the DynamoDB connector (`S3_ENDPOINT_URL` for MinIO/LocalStack, or `MOSS_CONNECTOR_S3_ALLOW_AWS=1` to opt in to real AWS) **Docs & extras** - Package README with one-shot ingest and watch-a-bucket usage, mapper row reference, MinIO/LocalStack notes - `demo.py` end-to-end walkthrough (create bucket → upload → ingest → query → add object → watch re-indexes → cleanup) - `.env.example`, and a new row in the parent `moss-data-connector` README layout + table ## Test results ``` tests/test_s3.py ............ 12 passed ruff check . All checks passed! ``` (Unit tests run fully offline via moto. Integration tests verified to collect and skip cleanly without credentials.) --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
## Pull Request Checklist Please ensure that your PR meets the following requirements: - [ ] I have read the [CONTRIBUTING](CONTRIBUTING.md) guide. - [ ] I have updated the documentation (if applicable). - [ ] My code follows the style guidelines of this project. - [ ] I have performed a self-review of my own code. - [ ] I have added tests that prove my fix is effective or that my feature works. - [ ] New and existing unit tests pass locally with my changes. ## Description Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. Fixes # (issue number) ## Type of Change - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] This change requires a documentation update <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/usemoss/moss/pull/491?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. -->
) ## Pull Request Checklist Please ensure that your PR meets the following requirements: - [x] I have read the [CONTRIBUTING](CONTRIBUTING.md) guide. - [ ] I have updated the documentation (if applicable). — N/A, lockfile-only change - [x] My code follows the style guidelines of this project. - [x] I have performed a self-review of my own code. - [ ] I have added tests that prove my fix is effective or that my feature works. — N/A, dependency bump - [x] New and existing unit tests pass locally with my changes. ## Description Bumps `@babel/core` from 7.28.6 to 7.29.7 in `apps/next-js/package-lock.json` via `npm update @babel/core`. The `@babel/*` family versions in lockstep, so 16 @babel packages move to 7.29.7 together, plus in-range refreshes of babel's browserslist data dependencies (browserslist, caniuse-lite, electron-to-chromium, node-releases, baseline-browser-mapping). Lockfile-only; no manifest changes. 7.29.7 is the latest 7.x; Babel 8 (8.0.1) is outside the dependents' `^7.x` ranges, so it does not apply here. Context: Dependabot attempted this in usemoss#449, which ended up targeting 0 directories after a group-rule rebase and was auto-closed — this completes what usemoss#422 asks for. How verified: clean `npm ci` baseline first, then after the bump: `tsc --noEmit` clean and `vitest run` 25/25 tests passing (same 25/25 on the unmodified baseline). Fixes usemoss#422 <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/usemoss/moss/pull/483?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
usemoss#485) ## Pull Request Checklist Please ensure that your PR meets the following requirements: - [x] I have read the [CONTRIBUTING](CONTRIBUTING.md) guide. - [ ] I have updated the documentation (if applicable). -- N/A - [x] My code follows the style guidelines of this project. - [x] I have performed a self-review of my own code. - [ ] I have added tests that prove my fix is effective or that my feature works. -- N/A as this is a dependency bump - [x] New and existing unit tests pass locally with my changes. ## Description Addressing [this issue](usemoss#470) suggesting to update `fast-uri` to latest version. Also bumped `ajv` in one spot, since I noticed it wasn't consistent with other versions across the project. `fast-uri` is now updated to version `4.1.1`. Fixes usemoss#470 ## Type of Change - [x] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] This change requires a documentation update <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/usemoss/moss/pull/485?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. -->
| """Input schema for MossListIndexesTool.""" | ||
|
|
||
| pass # No input needed | ||
| # No input needed |
There was a problem hiding this comment.
BLOCKING ```python
class MossListIndexesInput(BaseModel):
"""Input schema for MossListIndexesTool."""
# No input needed
Removing the `pass` leaves this class with no executable body, so the module raises `IndentationError` on import. Restore `pass` (or use `...`) under the comment.
Pull Request Checklist
Please ensure that your PR meets the following requirements:
Description
I'm working on adding the cross-encoder option and have made the changes to the python sdk.
So far,Ive added a new QueryOptions class and removed the import from the precompiled rust core to add the flag and the top-k meathod.
This is still a work in progress as I have to:
-Update the JS sdk
-Update the elixir sdk
-Documentation
-Tests
Fixes #416
Type of Change