Repository navigation
security: resolve Pillow 12.3.0 advisories vs Python 3.10 support #2459
Description
Resolution — verified security merge
Resolved by PR #2456, merge e93fd0e975cda0f3a59cb7fa812c19c64f6b2a52, approved head 9a76e5d64bfa9d37e002dba12ac27eb8d4c5fa9b. Current execution receipt records the exact mutation, evidence, limitations and post-merge check state. The findings below are the original issue history; they do not describe current main.
Security blocker
PR #2456's dependency-review gate now passes the certifi finding but blocks on vulnerable Pillow==12.3.0. The gate reports multiple advisories, including three critical findings. Representative reviewed advisory:
- GHSA-8g5g-8vmr-9782
- Severity: critical, CVSS 9.2
- Affected: Pillow <= 12.3.0
- Patched: Pillow 13.0.0
- Release: https://pypi.org/project/pillow/13.0.0/
Compatibility conflict
Pillow 13.0.0 requires Python >=3.11 and explicitly drops Python 3.10. EventRelay currently declares requires-python = ">=3.10" and CI runs Python 3.10. A lock-only upgrade would therefore violate the supported runtime contract.
Decision required
Choose and implement one bounded path:
- Raise EventRelay's Python floor to 3.11 — update project metadata, CI matrix, docs, Pillow floor, and lock; run the full Python test matrix.
- Retain Python 3.10 — isolate or remove Pillow from the Python 3.10 runtime path, or adopt a maintainer-published 12.x security backport if one becomes available.
Do not allow-list these critical advisories merely to make the gate green.
Acceptance criteria
- No affected Pillow release resolves for any supported Python/runtime target.
- Dependency Review passes without allow-listing these findings.
- Full Python matrix and image-processing tests pass.
- Runtime-support decision is documented.
- No production deployment or merge without applicable authorization.
Current evidence
- PR fix(security): guard AI SDKs and move to patched Pillow #2456 exact head
562926da1b1baa41ad8ee8987f8769ba1e0de0a9 - certifi remediation is present and locally verified.
- Dependency Review remains failed on Pillow; PR remains draft and unmerged.
Activity
linear-code commentedon Oct 22, 2026
GRV-837
github-actions commentedon Oct 22, 2026
👋 Thanks for opening this issue! It has been automatically labeled for triage.
groupthinking commentedon Oct 22, 2026
Independent current-head verification — 2026-10-22
The authorized continuation implemented the Pillow/runtime fix in PR #2456, current head
9a76e5d64bfa9d37e002dba12ac27eb8d4c5fa9b. It remains open and unmerged. The older6deccdclicense failure is historical.Maintainer review scope: the latest commit adds
MIT-CMUandUnlicenseto the repository-wide allowed-license list, not a package-only exception. That policy expansion is reviewable in commit 9a76e5d . It is not active on main. No vulnerability/advisory exception was added by this Watch run, and no merge or deployment was performed.Next boundary: review/approve the exact PR/head (including that policy scope), then re-fetch all required checks/protection/reviews/threads and mergeability before an expected-head merge. The workflow-lock pilot is separately drafted as #2460 and currently based on this unmerged branch; retarget it to repaired main only after an approved security merge.
Canonical receipts: concept_tracker action144 with independent Watch review, review334; pilot action149. This is branch/CI evidence, not production acceptance or live-model performance.
Merge pull request #2456: patch dependency and Python support boundary
groupthinking commentedon Oct 23, 2026
Verified merge receipt — security dependency repair
expected_head_sha=9a76e5d64bfa9d37e002dba12ac27eb8d4c5fa9b, methodmerge.e93fd0e975cda0f3a59cb7fa812c19c64f6b2a52, parents560f07120dee5294da0af0f2aab8eec8b79de8b5and the approved head.08aca6db68446550ddd97987efb3f547e5603cf8equals the tested approved-head tree exactly.Closing keyword to open issue, also PASS. No unresolved threads, no REQUEST_CHANGES review, mergeability clean. CodeRabbit's exact-head comment explicitly skipped for repository configuration; this is not a human review approval.Closes #2459; Guard Anthropic SDK major before API 2026-10-21 migration #2457/security(deps): patch certifi GHSA-6q48-6c7w-9gw2 #2458 remain linked. New closer check 120160192030 passed before merge.e93fd0e975cda0f3a59cb7fa812c19c64f6b2a52: CI39875628067, Dependency Review39875628072, Security39875628007, Coverage39875628010, CodeQL39875628006, E2E39875628012, Secret Scan39875628005, Anthropic WIF39875628011 and iteration-loop39875628009. All returned push-triggered runs completed successfully. Fresh Python jobs120160408995/120160408875 each report 2,946 passed,9 deselected,5 XPASS,118 subtests plus38 MCP tests/20 subtests.5cd469aac4b1f7ad031d9afe54e4292dc18170f5with real Git-diff regressions. Pilot now has three changed files and all current-head checks pass; separate exact-PR/head approval is still required. Pilot receipt.Scope status: security merge and post-merge checks VERIFIED. Overall two-PR delivery NOT COMPLETE: pilot implementation/checks/review are verified, but its separate merge approval remains. The existing Vercel integration reports success on main, but its deployment environment/configuration could not be inspected; no production acceptance claim is made.