[dependabot]

Bumps pillow from 12.0.0 to 13.0.0.

Release notes

Sourced from pillow's releases.

13.0.0

https://pillow.readthedocs.io/en/stable/releasenotes/13.0.0.html

Removals

• Remove undocumented GifImagePlugin._save_netpbm #9901 [@​akx]
• Remove ExifTags.IFD.Makernote #9850 [@​radarhere]
• Drop support for Python 3.10 #9750 [@​hugovk]
• Remove deprecations for Pillow 13.0.0 #9751 [@​radarhere]

Deprecations

• Deprecate IM image format #9849 [@​radarhere]
• Deprecate ImageQt align8to32() in favour of raw encoder stride #9940 [@​akx]
• Deprecate JpegImageFile.load_djpeg #9924 [@​akx]

Documentation

• Update release notes for Pillow 13.0.0 #10223 [@​hugovk]
• Correct the ImageOps.fit centering corner documentation #10118 [@​FanWu-ai]
• Update Tidelift links #10102 [@​radarhere]
• Correct bullet point syntax in release notes #10069 [@​radarhere]
• Update ImageDraw signatures in docs #10065 [@​ZainnQureshii]
• Update macOS tested Pillow versions #10048 [@​hugovk]
• Add pillow-wmf and pillow-zx-spectrum to third-party plugins list #10037 [@​bitplane]
• Delete CLAUDE.md #10027 [@​hugovk]
• Add pillow-lunasvg to third-party plugins list #10016 [@​Maksim-Burtsev]
• Extend security policy #10018 [@​hugovk]
• Update Color3DLUT description #10004 [@​radarhere]
• Document the internal image distinctness constraints #9752 [@​akx]
• Update macOS tested Pillow versions #10000 [@​radarhere]
• Link security policy in project metadata #9980 [@​hugovk]
• Image.new(): correct docstring and comment about uninitialized memory #9960 [@​akx]
• Add AGENTS.md #9582 [@​aclark4life]
• Add release notes for #8811 #9937 [@​radarhere]
• Fixed typo #9923 [@​radarhere]
• Fixed typo #9922 [@​radarhere]
• C interface is internal #9879 [@​radarhere]
• Correct function references #9895 [@​radarhere]
• Revert move from python-pillow.org to python-pillow.github.io #9830 [@​aclark4life]
• Add additional CVE numbers to 12.3.0 release notes #9777 [@​radarhere]
• Remove remaining :rtype:s from docstrings #9742 [@​akx]
• Update macOS tested Pillow versions #9759 [@​radarhere]

Dependencies

• Update dependency cibuildwheel to v4.3.1 #10175 [@renovate[bot]]
• Update dependency cibuildwheel to v4.3.0 #10132 [@renovate[bot]]
• Update dependency harfbuzz to v14.5.0 #10108 [@renovate[bot]]
• Update github-actions #10111 [@renovate[bot]]

... (truncated)

Commits

• 293218a 13.0.0 version bump
• 262e8e4 Update release notes for Pillow 13.0.0 (#10223)
• af56ace Validate TIFF tag values against libtiff's own field definition before TIFFSe...
• 570df03 Validate TIFF tag values against libtiff's own field definition before TIFFSe...
• 53318b5 Take libtiff scanline geometry tags from the image, not tiffinfo/exif (#10226)
• 0a87417 Bound retained TIFF tag data by stream size (#10225)
• 11582e5 Fix heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO (#10224)
• 8501adc Fix test
• ec5f1cb Take libtiff scanline geometry tags from the image, not tiffinfo/exif
• 4b63dff Share TIFF tag data budget across frames
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

cc @digantdesai @freddan80 @per @zingo @oscarandersson8218 @mansnils @Sebastian-Larsson @robell @rascani

[pytorch-bot]

🔗 Helpful Links

🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/24032

• 📄 Preview Python docs built from this PR

Note: Links to docs will display an error until the docs builds have been completed.

❌ 1 New Failure, 1 Cancelled Job

As of commit 0fe81cf with merge base a4e65bf ():

NEW FAILURE - The following job has failed:

• pull / test-multimodal-linux (gemma3-4b) / linux-job (gh)
  RuntimeError: Command bash /__w/_temp/exec_script failed with exit code 2

CANCELLED JOB - The following job was cancelled. Please retry:

• pull / test-qnn-python-imports-linux / linux-job (gh)
  ##[error]received SIGINT

This comment was automatically generated by Dr. CI and updates every 15 minutes.

[github-actions]

This PR needs a release notes: label

If your change should be included in the release notes (i.e. would users of this library care about this change?), please use a label starting with release notes:. This helps us keep track and include your important work in the next release notes.

To add a label, you can comment to pytorchbot, for example
@pytorchbot label "release notes: none"

For more information, see
https://github.com/pytorch/pytorch/wiki/PyTorch-AutoLabel-Bot#why-categorize-for-release-notes-and-how-does-it-work.

[zingo]

@claude review, is there any risks with this?

[claude]

Claude finished @zingo's task in 1m 11s —— View job

---

This bump looks low-risk, but no CI job runs the Swin2SR example, so nothing in this PR's CI tells you whether it works with Pillow 13. Before merging, run backends/arm/test/test_arm_ootb.sh run_swin2sr_e2e_vgf once by hand.

Detailed review

PR Review: #24032

Summary

The PR raises the exact pin from Pillow == 12.0.0 to Pillow == 13.0.0 in examples/arm/super_resolution_example_vgf/requirements.txt. I found no blocking problems. The real gap is that nothing in CI tests this change.

For context, these are the things that are not a risk:

• Python 3.10 drop: ExecuTorch already requires >=3.11,<3.16 (pyproject.toml:60).
• Other Pillow pins in the repo: none conflict. backends/mediatek, extension/diffusers and person_detection_example_cortex_m all leave Pillow unpinned.
• Pillow APIs the example uses: Image.open, .convert("RGB"), .resize(..., Image.Resampling.BICUBIC), .save and Image.fromarray. None of these appear in the 13.0.0 removals listed in the PR body.

Infrastructure

• CI does not test this change. run_swin2sr_e2e_vgf (backends/arm/test/test_arm_ootb.sh:247) is the only thing that installs this requirements.txt. It runs only when test_arm_ootb.sh is called with no arguments. test_arm_backend.sh has wrappers for run_ootb_tests_*, run_deit_e2e_ethos_u and run_person_detection_e2e_cortex_m, but none for Swin2SR, and pull.yml and trunk.yml never call it. A green CI run therefore says nothing about Pillow 13 working here. The current failures are also unrelated: test-multimodal-linux (gemma3-4b) failed and test-qnn-python-imports-linux was cancelled. Running backends/arm/test/test_arm_ootb.sh run_swin2sr_e2e_vgf once locally would settle it. Separately, it may be worth adding a test_swin2sr_e2e_vgf wrapper next to the existing e2e wrappers so future dependabot bumps get tested.

Code Quality

• Image.fromarray(..., mode=...) (low confidence). runtime/run_super_resolution.py:102 and :104 pass mode="L" and mode="RGB". Pillow 11.3 deprecated the mode argument and scheduled it for removal in 13.0. My understanding is that Pillow 12 narrowed the deprecation so that a mode matching the array's dtype and shape stays allowed. That covers this code, since it passes uint8 HxW with "L" and uint8 HxWx3 with "RGB". I couldn't fetch the 13.0.0 release notes from this runner to confirm that "Remove deprecations for Pillow 13.0.0" (Improve ET_CHECK_OR_RETURN_FALSE error messages in kernels/portable #9751) leaves this alone. If it doesn't, writing the output image will fail with a TypeError. Dropping the argument makes the question moot, because Pillow infers the same modes from the array: Image.fromarray(image_np[..., 0]) / Image.fromarray(image_np). The local e2e run above would also catch it.

Recommendation

Approve after one manual run of run_swin2sr_e2e_vgf. Optionally remove the redundant mode= arguments in run_super_resolution.py so this doesn't depend on the details of Pillow's deprecation.