google-cloud-documentai-toolbox: Pillow dependency out of date
envgap__googleapis__google-cloud-python-17510
01 / FAILURE SIGNATURE
As reported upstream
No identifying execution failure has been captured.
Not a benchmark task.
- The project already builds and runs before the fix, so there is nothing to repair.
02 / ENVIRONMENT RECIPE
- Base commit
1890637d24280c7fe26747bcfaa557b529d85467- Manifest
packages/google-cloud-documentai-toolbox/setup.py- Reproduce
Awaiting issue-specific recipe- Run under trace
Awaiting a meaningful runtime command
03 / ORIGINAL ISSUE TEXT
googleapis/google-cloud-python #17510 · read the original issue
### Determine this is the right repository - [x] I determined this is the correct repository in which to report this bug. ### Summary of the issue **Context** Pillow has several security vulnerabilities that are only fixed in major version 12: * https://github.com/advisories/GHSA-cfh3-3jmp-rvhc * https://github.com/advisories/GHSA-whj4-6x5x-4v2j * https://github.com/advisories/GHSA-pwv6-vv43-88gr * https://github.com/advisories/GHSA-r73j-pqj5-w3x7 * https://github.com/advisories/GHSA-wjx4-4jcj-g98j * https://github.com/advisories/GHSA-5xmw-vc9v-4wf2 But [google-cloud-documentai-toolbox's version constraint](https://github.com/googleapis/google-cloud-python/blob/1890637d24280c7fe26747bcfaa557b529d85467/packages/google-cloud-documentai-toolbox/setup.py#L71) is `Pillow>=10.0.0, <12.0.0`, keeping dependent applications from resolving those vulnerabilities. **Expected Behavior:** Pillow >= 12.0.0 is allowed with google-cloud-documentai-toolbox. **Actual Behavior:** Pillow >= 10.0.0 < 12.0.0 is allowed with google-cloud-documentai-toolbox. ### API client name and version _No response_ ### Reproduction steps: code _No response_ ### Reproduction steps: supporting files _No response_ ### Reproduction steps: actual results _No response_ ### Reproduction steps: expected results _No response_ ### OS & version + platform _No response_ ### Python environment _No response_ ### Python dependencies _No response_ ### Additional context _No response_
04 / LABELS
Labels from the report text only; not yet run
No supported category has been assigned.
Label rules and the text that matched
[]