Merge remote-tracking branch 'origin/develop' into remove-git-sync

cvat-ai · Sep 28, 2023 · b2a7112 · b2a7112
2 parents 69debdf + 4a487c3
commit b2a7112
Show file tree

Hide file tree

Showing 9 changed files with 11 additions and 10 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -30,7 +30,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Security
 
-- TDB
+- Security upgrade Pillow from 9.3.0 to 10.0.1
+ (<https://github.com/opencv/cvat/pull/6907>)
 
 ## \[2.7.2\] - 2023-09-25
 

diff --git a/cvat-cli/requirements/base.txt b/cvat-cli/requirements/base.txt
@@ -1,3 +1,3 @@
 cvat-sdk~=2.8.0
-Pillow>=6.2.0
+Pillow>=10.0.1
 setuptools>=65.5.1 # not directly required, pinned by Snyk to avoid a vulnerability
diff --git a/cvat-sdk/requirements/base.txt b/cvat-sdk/requirements/base.txt
@@ -2,7 +2,7 @@
 
 attrs >= 21.4.0
 packaging >= 21.3
-Pillow >= 9.0.1
+Pillow >= 10.0.1
 platformdirs >= 2.1.0
 tqdm >= 4.64.0
 tuspy == 0.2.5 # have it pinned, because SDK has lots of patched TUS code

diff --git a/cvat/requirements/base.in b/cvat/requirements/base.in
@@ -40,7 +40,7 @@ opencv-python-headless==4.5.5.62
 patool==1.12
 
 pdf2image==1.14.0
-Pillow==9.3.0
+Pillow>=10.0.1
 psutil==5.9.4
 psycopg2-binary==2.9.5
 python-ldap==3.4.3

diff --git a/cvat/requirements/base.txt b/cvat/requirements/base.txt
@@ -1,4 +1,4 @@
-# SHA1:15954530c16b14300ed60ec6b63b240f620a19fc
+# SHA1:f4b1cfa1e64a1d036a99deca36db609d665a7bd8
 #
 # This file is autogenerated by pip-compile-multi
 # To update, run:

diff --git a/tests/python/requirements.txt b/tests/python/requirements.txt
@@ -5,6 +5,6 @@ pytest-cov==4.1.0
 requests==2.31.0
 deepdiff==5.6.0
 boto3==1.17.61
-Pillow==9.3.0
+Pillow==10.0.1
 pyyaml==6.0.0
 numpy==1.22.0
diff --git a/utils/dataset_manifest/requirements.in b/utils/dataset_manifest/requirements.in
@@ -1,5 +1,5 @@
 av==9.2.0 # Pinned for the whole CVAT
 natsort>=8.0.0
 opencv-python-headless>=4.4.0.42
-Pillow==9.3.0
+Pillow>=10.0.1
 tqdm>=4.58.0
diff --git a/utils/dataset_manifest/requirements.txt b/utils/dataset_manifest/requirements.txt
@@ -1,4 +1,4 @@
-# SHA1:28d323bec97cee6586d917faf4c7f58199475771
+# SHA1:2c4fe23872675e963864abe27e1644f42865f712
 #
 # This file is autogenerated by pip-compile-multi
 # To update, run:
@@ -13,7 +13,7 @@ numpy==1.22.4
  # via opencv-python-headless
 opencv-python-headless==4.5.5.62
  # via -r utils/dataset_manifest/requirements.in
-pillow==9.3.0
+pillow==10.0.1
  # via -r utils/dataset_manifest/requirements.in
 tqdm==4.66.1
  # via -r utils/dataset_manifest/requirements.in
diff --git a/utils/dicom_converter/requirements.txt b/utils/dicom_converter/requirements.txt
@@ -1,4 +1,4 @@
 numpy==1.22.0
-Pillow==9.4.0
+Pillow==10.0.1
 pydicom==2.1.2
 tqdm==4.60.0