github/langchain
1
0
Fork 0
mirror of https://github.com/hwchase17/langchain.git synced 2026-06-09 10:17:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: bump pillow (#36027)

Browse Source
This commit is contained in:
John Kennedy
2026-03-17 11:27:50 -07:00
committed by GitHub
parent ceca192515
commit abcc7d68c1
2 changed files with 102 additions and 97 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
libs/partners/qdrant/pyproject.toml
View File

@@ -65,6 +65,12 @@ typing = [
"langchain-core"
]
# CVE-2026-25990: pillow < 12.1.1 is vulnerable to out-of-bounds write when loading PSD images.
# fastembed 0.7.x caps pillow<12.0. Override to pull in the fix for the lockfile.
# Remove this override once fastembed releases a version that allows pillow>=12.1.1.
[tool.uv]
override-dependencies = ["pillow>=12.1.1"]
[tool.uv.sources]
langchain-core = { path = "../../core", editable = true }
langchain-tests = { path = "../../standard-tests", editable = true }