Update dependency pillow to v12.2.0 [SECURITY] #249
+1
−1
Merged
Claude / Claude Code Review
completed
Apr 13, 2026 in 4m 20s
Code review found 1 important issue
Found 1 candidates, confirmed 1. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 1 |
| 🟡 Nit | 0 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🔴 Important | template/requirements.txt:9 |
Security fix incomplete: chart_data_extractor/poetry.lock still pins vulnerable Pillow 12.1.1 |
Annotations
Check failure on line 9 in template/requirements.txt
claude / Claude Code Review
Security fix incomplete: chart_data_extractor/poetry.lock still pins vulnerable Pillow 12.1.1
This PR fixes CVE-2026-40192 in `template/requirements.txt` by upgrading Pillow to 12.2.0, but `chart_data_extractor/poetry.lock` still pins Pillow at 12.1.1 (line 599), leaving that environment exposed to the same FITS decompression bomb vulnerability. Run `poetry update pillow` in `chart_data_extractor/` and commit the updated lock file to complete the fix.
Loading