← All tasks
pythongoogleapis/google-cloud-python #17510Not a task: already works

google-cloud-documentai-toolbox: Pillow dependency out of date

envgap__googleapis__google-cloud-python-17510

01 / FAILURE SIGNATURE

As reported upstream

No identifying execution failure has been captured.
Not a benchmark task.
  • The project already builds and runs before the fix, so there is nothing to repair.

02 / ENVIRONMENT RECIPE

Base commit
1890637d24280c7fe26747bcfaa557b529d85467
Manifest
packages/google-cloud-documentai-toolbox/setup.py
Reproduce
Awaiting issue-specific recipe
Run under trace
Awaiting a meaningful runtime command

03 / ORIGINAL ISSUE TEXT

googleapis/google-cloud-python #17510 · read the original issue
### Determine this is the right repository

- [x] I determined this is the correct repository in which to report this bug.

### Summary of the issue

**Context**
Pillow has several security vulnerabilities that are only fixed in major version 12:
* https://github.com/advisories/GHSA-cfh3-3jmp-rvhc
* https://github.com/advisories/GHSA-whj4-6x5x-4v2j
* https://github.com/advisories/GHSA-pwv6-vv43-88gr
* https://github.com/advisories/GHSA-r73j-pqj5-w3x7
* https://github.com/advisories/GHSA-wjx4-4jcj-g98j
* https://github.com/advisories/GHSA-5xmw-vc9v-4wf2

But [google-cloud-documentai-toolbox's version constraint](https://github.com/googleapis/google-cloud-python/blob/1890637d24280c7fe26747bcfaa557b529d85467/packages/google-cloud-documentai-toolbox/setup.py#L71) is `Pillow>=10.0.0, <12.0.0`, keeping dependent applications from resolving those vulnerabilities.

**Expected Behavior:**
Pillow >= 12.0.0 is allowed with google-cloud-documentai-toolbox.

**Actual Behavior:**
Pillow >= 10.0.0 < 12.0.0 is allowed with google-cloud-documentai-toolbox.

### API client name and version

_No response_

### Reproduction steps: code

_No response_

### Reproduction steps: supporting files

_No response_

### Reproduction steps: actual results

_No response_

### Reproduction steps: expected results

_No response_

### OS & version + platform

_No response_

### Python environment

_No response_

### Python dependencies

_No response_

### Additional context

_No response_
Continue on GitHub ↗

04 / LABELS

Labels from the report text only; not yet run

No supported category has been assigned.

Label rules and the text that matched
[]