chore(deps): [ai] Update dependency Pillow to >=10.4.0 [SECURITY] - autoclosed

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
Pillow (changelog)	>=10.0.0 → >=10.4.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

libwebp: OOB write in BuildHuffmanTable

A-299477569 / ASB-A-299477569 / CVE-2023-4863 / CVE-2023-5129 / GHSA-j7hp-h8jx-5ppr / RUSTSEC-2023-0060 / RUSTSEC-2023-0061

More information

Details

Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page.

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-4863
• https://github.com/qnighy/libwebp-sys2-rs/pull/21
• https://github.com/python-pillow/Pillow/pull/7395
• https://github.com/jaredforth/webp/pull/30
• https://github.com/electron/electron/pull/39823
• https://github.com/electron/electron/pull/39825
• https://github.com/electron/electron/pull/39826
• https://github.com/electron/electron/pull/39827
• https://github.com/electron/electron/pull/39828
• https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a
• https://github.com/qnighy/libwebp-sys2-rs/commit/4560c473a76ec8bd8c650f19ddf9d7a44f719f8b
• https://github.com/jaredforth/webp/commit/9d4c56e63abecc777df71c702503c3eaabd7dcbc
• https://security.gentoo.org/glsa/202401-10
• https://security.gentoo.org/glsa/202309-05
• https://security-tracker.debian.org/tracker/CVE-2023-4863
• https://rustsec.org/advisories/RUSTSEC-2023-0061.html
• https://rustsec.org/advisories/RUSTSEC-2023-0060.html
• https://pillow.readthedocs.io/en/stable/releasenotes/10.0.1.html#security
• https://news.ycombinator.com/item?id=37478403
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863
• https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway
• https://security.netapp.com/advisory/ntap-20230929-0011
• https://sethmlarson.dev/security-developer-in-residence-weekly-report-16
• https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863
• https://www.bentley.com/advisories/be-2023-0001
• https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks
• https://www.debian.org/security/2023/dsa-5496
• https://www.debian.org/security/2023/dsa-5497
• https://www.debian.org/security/2023/dsa-5498
• https://www.mozilla.org/en-US/security/advisories/mfsa2023-40
• https://www.vicarius.io/vsociety/posts/zero-day-webp-vulnerability-cve-2023-4863
• https://blog.isosceles.com/the-webp-0day
• https://bugzilla.suse.com/show_bug.cgi?id=1215231
• https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html
• https://crbug.com/1479274
• https://en.bandisoft.com/honeyview/history
• https://github.com/ImageMagick/ImageMagick/discussions/6664
• https://github.com/dlemstra/Magick.NET/releases/tag/13.3.0
• https://github.com/webmproject/libwebp
• https://github.com/webmproject/libwebp/releases/tag/v1.3.2
• https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html
• https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html
• https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I
• http://www.openwall.com/lists/oss-security/2023/09/21/4
• http://www.openwall.com/lists/oss-security/2023/09/22/1
• http://www.openwall.com/lists/oss-security/2023/09/22/3
• http://www.openwall.com/lists/oss-security/2023/09/22/4
• http://www.openwall.com/lists/oss-security/2023/09/22/5
• http://www.openwall.com/lists/oss-security/2023/09/22/6
• http://www.openwall.com/lists/oss-security/2023/09/22/7
• http://www.openwall.com/lists/oss-security/2023/09/22/8
• http://www.openwall.com/lists/oss-security/2023/09/26/1
• http://www.openwall.com/lists/oss-security/2023/09/26/7
• http://www.openwall.com/lists/oss-security/2023/09/28/1
• http://www.openwall.com/lists/oss-security/2023/09/28/2
• http://www.openwall.com/lists/oss-security/2023/09/28/4

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

PYSEC-2023-175

More information

Details

Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2.

Severity

Unknown

References

• https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst#1001-2023-09-15
• https://nvd.nist.gov/vuln/detail/CVE-2023-5129
• https://nvd.nist.gov/vuln/detail/CVE-2023-4863

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

---

Arbitrary Code Execution in Pillow

BIT-pillow-2023-50447 / CVE-2023-50447 / GHSA-3f63-hfp8-52jq

More information

Details

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-50447
• https://github.com/python-pillow/Pillow/commit/45c726fd4daa63236a8f3653530f297dc87b160a
• https://devhub.checkmarx.com/cve-details/CVE-2023-50447
• https://duartecsantos.github.io/2023-01-02-CVE-2023-50447
• https://duartecsantos.github.io/2024-01-02-CVE-2023-50447
• https://github.com/python-pillow/Pillow
• https://github.com/python-pillow/Pillow/releases
• https://lists.debian.org/debian-lts-announce/2024/01/msg00019.html
• https://pillow.readthedocs.io/en/stable/releasenotes/10.2.0.html#security
• http://www.openwall.com/lists/oss-security/2024/01/20/1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Pillow buffer overflow vulnerability

BIT-pillow-2024-28219 / CVE-2024-28219 / GHSA-44wm-f244-xhp3

More information

Details

In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.

Severity

• CVSS Score: 7.3 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-28219
• https://github.com/python-pillow/Pillow/commit/2a93aba5cfcf6e241ab4f9392c13e3b74032c061
• https://github.com/python-pillow/Pillow
• https://lists.debian.org/debian-lts-announce/2024/04/msg00008.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M
• https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html#security

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Pillow has a PDF Parsing Trailer Infinite Loop (DoS)

BIT-pillow-2026-42310 / CVE-2026-42310 / GHSA-r73j-pqj5-w3x7

More information

Details

Impact

An attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive.

Patches

Patched version: 12.2.0.

PdfParser (introduced in Pillow 4.2.0) follows Prev pointers in PDF trailers to read cross-reference sections. If a
trailer's Prev pointer references an offset that has already been processed — either pointing to itself or forming a
longer cycle — the parser enters an infinite loop. Pillow now tracks previously processed trailer offsets and raises an
error if a cycle is detected.

Workarounds

Use any version but the affected versions: >= 4.2.0, < 12.2.0

Resources

• Fix: https://github.com/python-pillow/Pillow/pull/9519

Severity

• CVSS Score: 5.1 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/python-pillow/Pillow/security/advisories/GHSA-r73j-pqj5-w3x7
• https://nvd.nist.gov/vuln/detail/CVE-2026-42310
• https://github.com/python-pillow/Pillow/pull/9519
• https://github.com/python-pillow/Pillow/commit/3bf614e4b8615d0ce1d5039efaf6db447fe7c468
• https://github.com/python-pillow/Pillow
• https://github.com/python-pillow/Pillow/releases/tag/12.2.0

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Pillow has an integer overflow when processing fonts

BIT-pillow-2026-42308 / CVE-2026-42308 / GHSA-wjx4-4jcj-g98j

More information

Details

If a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This has been fixed.

Severity

• CVSS Score: 5.1 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/python-pillow/Pillow/security/advisories/GHSA-wjx4-4jcj-g98j
• https://nvd.nist.gov/vuln/detail/CVE-2026-42308
• https://github.com/python-pillow/Pillow
• https://github.com/python-pillow/Pillow/releases/tag/12.2.0

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

python-pillow/Pillow (Pillow)

v10.4.0

Compare Source

• Raise FileNotFoundError if show_file() path does not exist #​8178
  [radarhere]

• Improved reading 16-bit TGA images with colour #​7965
  [Yay295, radarhere]

• Deprecate non-image ImageCms modes #​8031
  [radarhere]

• Fixed processing multiple JPEG EXIF markers #​8127
  [radarhere]

• Do not preserve EXIFIFD tag by default when saving TIFF images #​8110
  [radarhere]

• Added ImageFont.load_default_imagefont() #​8086
  [radarhere]

• Added Image.WARN_POSSIBLE_FORMATS #​8063
  [radarhere]

• Remove zero-byte end padding when parsing any XMP data #​8171
  [radarhere]

• Do not detect Ultra HDR images as MPO #​8056
  [radarhere]

• Raise SyntaxError specific to JP2 #​8146
  [Yay295, radarhere]

• Do not use first frame duration for other frames when saving APNG images #​8104
  [radarhere]

• Consider I;16 pixel size when using a 1 mode mask #​8112
  [radarhere]

• When saving multiple PNG frames, convert to mode rather than raw mode #​8087
  [radarhere]

• Added byte support to FreeTypeFont #​8141
  [radarhere]

• Allow float center for rotate operations #​8114
  [radarhere]

• Do not read layers immediately when opening PSD images #​8039
  [radarhere]

• Restore original thread state #​8065
  [radarhere]

• Read IM and TIFF images as RGB, rather than RGBX #​7997
  [radarhere]

• Only preserve TIFF IPTC_NAA_CHUNK tag if type is BYTE or UNDEFINED #​7948
  [radarhere]

• Clarify ImageDraw2 error message when size is missing #​8165
  [radarhere]

• Support unpacking more rawmodes to RGBA palettes #​7966
  [radarhere]

• Removed support for Qt 5 #​8159
  [radarhere]

• Improve ImageFont.freetype support for XDG directories on Linux #​8135
  [mamg22, radarhere]

• Improved consistency of XMP handling #​8069
  [radarhere]

• Use pkg-config to help find libwebp and raqm #​8142
  [radarhere]

• Accept 't' suffix for libtiff version #​8126, #​8129
  [radarhere]

• Deprecate ImageDraw.getdraw hints parameter #​8124
  [radarhere, hugovk]

• Added ImageDraw circle() #​8085
  [void4, hugovk, radarhere]

• Add mypy target to Makefile #​8077
  [Yay295]

• Added more modes to Image.MODES #​7984
  [radarhere]

• Deprecate BGR;15, BGR;16 and BGR;24 modes #​7978
  [radarhere, hugovk]

• Fix ImagingAccess for I;16N on big-endian #​7921
  [Yay295, radarhere]

• Support reading P mode TIFF images with padding #​7996
  [radarhere]

• Deprecate support for libtiff < 4 #​7998
  [radarhere, hugovk]

• Corrected ImageShow UnixViewer command #​7987
  [radarhere]

• Use functools.cached_property in ImageStat #​7952
  [nulano, hugovk, radarhere]

• Add support for reading BITMAPV2INFOHEADER and BITMAPV3INFOHEADER #​7956
  [Cirras, radarhere]

• Support reading CMYK JPEG2000 images #​7947
  [radarhere]

v10.3.0

Compare Source

• CVE-2024-28219: Use strncpy to avoid buffer overflow #​7928
  [radarhere, hugovk]

• Deprecate eval(), replacing it with lambda_eval() and unsafe_eval() #​7927
  [radarhere, hugovk]

• Raise ValueError if seeking to greater than offset-sized integer in TIFF #​7883
  [radarhere]

• Add --report argument to __main__.py to omit supported formats #​7818
  [nulano, radarhere, hugovk]

• Added RGB to I;16, I;16L, I;16B and I;16N conversion #​7918, #​7920
  [radarhere]

• Fix editable installation with custom build backend and configuration options #​7658
  [nulano, radarhere]

• Fix putdata() for I;16N on big-endian #​7209
  [Yay295, hugovk, radarhere]

• Determine MPO size from markers, not EXIF data #​7884
  [radarhere]

• Improved conversion from RGB to RGBa, LA and La #​7888
  [radarhere]

• Support FITS images with GZIP_1 compression #​7894
  [radarhere]

• Use I;16 mode for 9-bit JPEG 2000 images #​7900
  [scaramallion, radarhere]

• Raise ValueError if kmeans is negative #​7891
  [radarhere]

• Remove TIFF tag OSUBFILETYPE when saving using libtiff #​7893
  [radarhere]

• Raise ValueError for negative values when loading P1-P3 PPM images #​7882
  [radarhere]

• Added reading of JPEG2000 palettes #​7870
  [radarhere]

• Added alpha_quality argument when saving WebP images #​7872
  [radarhere]

• Fixed joined corners for ImageDraw rounded_rectangle() non-integer dimensions #​7881
  [radarhere]

• Stop reading EPS image at EOF marker #​7753
  [radarhere]

• PSD layer co-ordinates may be negative #​7706
  [radarhere]

• Use subprocess with CREATE_NO_WINDOW flag in ImageShow WindowsViewer #​7791
  [radarhere]

• When saving GIF frame that restores to background color, do not fill identical pixels #​7788
  [radarhere]

• Fixed reading PNG iCCP compression method #​7823
  [radarhere]

• Allow writing IFDRational to UNDEFINED tag #​7840
  [radarhere]

• Fix logged tag name when loading Exif data #​7842
  [radarhere]

• Use maximum frame size in IHDR chunk when saving APNG images #​7821
  [radarhere]

• Prevent opening P TGA images without a palette #​7797
  [radarhere]

• Use palette when loading ICO images #​7798
  [radarhere]

• Use consistent arguments for load_read and load_seek #​7713
  [radarhere]

• Turn off nullability warnings for macOS SDK #​7827
  [radarhere]

• Fix shift-sign issue in Convert.c #​7838
  [r-barnes, radarhere]

• Open 16-bit grayscale PNGs as I;16 #​7849
  [radarhere]

• Handle truncated chunks at the end of PNG images #​7709
  [lajiyuan, radarhere]

• Match mask size to pasted image size in GifImagePlugin #​7779
  [radarhere]

• Release GIL while calling WebPAnimDecoderGetNext #​7782
  [evanmiller, radarhere]

• Fixed reading FLI/FLC images with a prefix chunk #​7804
  [twolife]

• Update wl-paste handling and return None for some errors in grabclipboard() on Linux #​7745
  [nik012003, radarhere]

• Remove execute bit from setup.py #​7760
  [hugovk]

• Do not support using test-image-results to upload images after test failures #​7739
  [radarhere]

• Changed ImageMath.ops to be static #​7721
  [radarhere]

• Fix APNG info after seeking backwards more than twice #​7701
  [esoma, radarhere]

• Deprecate ImageCms constants and versions() function #​7702
  [nulano, radarhere]

• Added PerspectiveTransform #​7699
  [radarhere]

• Add support for reading and writing grayscale PFM images #​7696
  [nulano, hugovk]

• Add LCMS2 flags to ImageCms #​7676
  [nulano, radarhere, hugovk]

• Rename x64 to AMD64 in winbuild #​7693
  [nulano]

v10.2.0

Compare Source

• Add keep_rgb option when saving JPEG to prevent conversion of RGB colorspace #​7553
  [bgilbert, radarhere]

• Trim glyph size in ImageFont.getmask() #​7669, #​7672
  [radarhere, nulano]

• Deprecate IptcImagePlugin helpers #​7664
  [nulano, hugovk, radarhere]

• Allow uncompressed TIFF images to be saved in chunks #​7650
  [radarhere]

• Concatenate multiple JPEG EXIF markers #​7496
  [radarhere]

• Changed IPTC tile tuple to match other plugins #​7661
  [radarhere]

• Do not assign new fp attribute when exiting context manager #​7566
  [radarhere]

• Support arbitrary masks for uncompressed RGB DDS images #​7589
  [radarhere, akx]

• Support setting ROWSPERSTRIP tag #​7654
  [radarhere]

• Apply ImageFont.MAX_STRING_LENGTH to ImageFont.getmask() #​7662
  [radarhere]

• Optimise ImageColor using functools.lru_cache #​7657
  [hugovk]

• Restricted environment keys for ImageMath.eval() #​7655
  [wiredfool, radarhere]

• Optimise ImageMode.getmode using functools.lru_cache #​7641
  [hugovk, radarhere]

• Fix incorrect color blending for overlapping glyphs #​7497
  [ZachNagengast, nulano, radarhere]

• Attempt memory mapping when tile args is a string #​7565
  [radarhere]

• Fill identical pixels with transparency in subsequent frames when saving GIF #​7568
  [radarhere]

• Corrected duration when combining multiple GIF frames into single frame #​7521
  [radarhere]

• Handle disposing GIF background from outside palette #​7515
  [radarhere]

• Seek past the data when skipping a PSD layer #​7483
  [radarhere]

• Import plugins relative to the module #​7576
  [deliangyang, jaxx0n]

• Translate encoder error codes to strings; deprecate ImageFile.raise_oserror() #​7609
  [bgilbert, radarhere]

• Support reading BC4U and DX10 BC1 images #​6486
  [REDxEYE, radarhere, hugovk]

• Optimize ImageStat.Stat.extrema #​7593
  [florath, radarhere]

• Handle pathlib.Path in FreeTypeFont #​7578
  [radarhere, hugovk, nulano]

• Added support for reading DX10 BC4 DDS images #​7603
  [sambvfx, radarhere]

• Optimized ImageStat.Stat.count #​7599
  [florath]

• Correct PDF palette size when saving #​7555
  [radarhere]

• Fixed closing file pointer with olefile 0.47 #​7594
  [radarhere]

• Raise ValueError when TrueType font size is not greater than zero #​7584, #​7587
  [akx, radarhere]

• If absent, do not try to close fp when closing image #​7557
  [RaphaelVRossi, radarhere]

• Allow configuring JPEG restart marker interval on save #​7488
  [bgilbert, radarhere]

• Decrement reference count for PyObject #​7549
  [radarhere]

• Implement streamtype=1 option for tables-only JPEG encoding #​7491
  [bgilbert, radarhere]

• If save_all PNG only has one frame, do not create animated image #​7522
  [radarhere]

• Fixed frombytes() for images with a zero dimension #​7493
  [radarhere]

v10.1.0

Compare Source

• Added TrueType default font to allow for different sizes #​7354
  [radarhere]

• Fixed invalid argument warning #​7442
  [radarhere]

• Added ImageOps cover method #​7412
  [radarhere, hugovk]

• Catch struct.error from truncated EXIF when reading JPEG DPI #​7458
  [radarhere]

• Consider default image when selecting mode for PNG save_all #​7437
  [radarhere]

• Support BGR;15, BGR;16 and BGR;24 access, unpacking and putdata #​7303
  [radarhere]

• Added CMYK to RGB unpacker #​7310
  [radarhere]

• Improved flexibility of XMP parsing #​7274
  [radarhere]

• Support reading 8-bit YCbCr TIFF images #​7415
  [radarhere]

• Allow saving I;16B images as PNG #​7302
  [radarhere]

• Corrected drawing I;16 points and writing I;16 text #​7257
  [radarhere]

• Set blue channel to 128 for BC5S #​7413
  [radarhere]

• Increase flexibility when reading IPTC fields #​7319
  [radarhere]

• Set C palette to be empty by default #​7289
  [radarhere]

• Added gs_binary to control Ghostscript use on all platforms #​7392
  [radarhere]

• Read bounding box information from the trailer of EPS files if specified #​7382
  [nopperl, radarhere]

• Added reading 8-bit color DDS images #​7426
  [radarhere]

• Added has_transparency_data #​7420
  [radarhere, hugovk]

• Fixed bug when reading BC5S DDS images #​7401
  [radarhere]

• Prevent TIFF orientation from being applied more than once #​7383
  [radarhere]

• Use previous pixel alpha for QOI_OP_RGB #​7357
  [radarhere]

• Added BC5U reading #​7358
  [radarhere]

• Allow getpixel() to accept a list #​7355
  [radarhere, homm]

• Allow GaussianBlur and BoxBlur to accept a sequence of x and y radii #​7336
  [radarhere]

• Expand JPEG buffer size when saving optimized or progressive #​7345
  [radarhere]

• Added session type check for Linux in ImageGrab.grabclipboard() #​7332
  [TheNooB2706, radarhere, hugovk]

• Allow "loop=None" when saving GIF images #​7329
  [radarhere]

• Fixed transparency when saving P mode images to PDF #​7323
  [radarhere]

• Added saving LA images as PDFs #​7299
  [radarhere]

• Set SMaskInData to 1 for PDFs with alpha #​7316, #​7317
  [radarhere]

• Changed Image mode property to be read-only by default #​7307
  [radarhere]

• Silence exceptions in repr_jpeg and repr_png #​7266
  [mtreinish, radarhere]

• Do not use transparency when saving GIF if it has been removed when normalizing mode #​7284
  [radarhere]

• Fix missing symbols when libtiff depends on libjpeg #​7270
  [heitbaum]

v10.0.1

Compare Source

• Updated libwebp to 1.3.2 #​7395
  [radarhere]

• Updated zlib to 1.3 #​7344
  [radarhere]

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.