• 9e9e840 2022.12.07
• b81bdb2 2022.09.24
• 939a28f 2022.09.14
• aca828a 2022.06.15.2
• de0eae1 Only use importlib.resources's new files() / Traversable API on Python ≥3.11 ...
• b8eb5e9 2022.06.15.1
• 47fb7ab Fix deprecation warning on Python 3.11 (#199)
• b0b48e0 fixes #198 -- update link in license
• 9d514b4 2022.06.15
• 4151e88 Add py.typed to MANIFEST.in to package in sdist (#196)
• Additional commits viewable in compare view

• d43c7c7 release 7.16.3
• 5fa1e40 Merge pull request from GHSA-pq7m-3gw7-gq5x
• 8df8971 back to dev
• 9f477b7 release 7.16.2
• 138f266 bring back release helper from master branch
• 5aa3634 Merge pull request #13341 from meeseeksmachine/auto-backport-of-pr-13335-on-7...
• bcae8e0 Backport PR #13335: What's new 7.16.2
• 8fcdcd3 Pin Jedi to <0.17.2.
• 2486838 release 7.16.1
• 20bdc6f fix conda build
• Additional commits viewable in compare view

Sourced from pillow's releases.

8.3.2

https://pillow.readthedocs.io/en/stable/releasenotes/8.3.2.html

Security

• CVE-2021-23437 Raise ValueError if color specifier is too long [hugovk, radarhere]

• Fix 6-byte OOB read in FliDecode [wiredfool]

Python 3.10 wheels

• Add support for Python 3.10 #5569, #5570 [hugovk, radarhere]

Fixed regressions

• Ensure TIFF RowsPerStrip is multiple of 8 for JPEG compression #5588 [kmilos, radarhere]

• Updates for ImagePalette channel order #5599 [radarhere]

• Hide FriBiDi shim symbols to avoid conflict with real FriBiDi library #5651 [nulano]

8.3.1

https://pillow.readthedocs.io/en/stable/releasenotes/8.3.1.html

Changes

• Catch OSError when checking if fp is sys.stdout #5585 [@​radarhere]
• Handle removing orientation from alternate types of EXIF data #5584 [@​radarhere]
• Make Image.array take optional dtype argument #5572 [@​t-vi]

8.3.0

https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html

Changes

• Use snprintf instead of sprintf #5567 [@​radarhere]
• Limit TIFF strip size when saving with LibTIFF #5514 [@​kmilos]
• Allow ICNS save on all operating systems #4526 [@​newpanjing]
• De-zigzag JPEG's DQT when loading; deprecate convert_dict_qtables #4989 [@​gofr]
• Do not use background or transparency index for new color #5564 [@​radarhere]
• Simplified code #5315 [@​radarhere]
• Replaced xml.etree.ElementTree #5565 [@​radarhere]

... (truncated)

Sourced from pillow's changelog.

8.3.2 (2021-09-02)

• CVE-2021-23437 Raise ValueError if color specifier is too long [hugovk, radarhere]

• Fix 6-byte OOB read in FliDecode [wiredfool]

• Add support for Python 3.10 #5569, #5570 [hugovk, radarhere]

• Ensure TIFF RowsPerStrip is multiple of 8 for JPEG compression #5588 [kmilos, radarhere]

• Updates for ImagePalette channel order #5599 [radarhere]

• Hide FriBiDi shim symbols to avoid conflict with real FriBiDi library #5651 [nulano]

8.3.1 (2021-07-06)

• Catch OSError when checking if fp is sys.stdout #5585 [radarhere]

• Handle removing orientation from alternate types of EXIF data #5584 [radarhere]

• Make Image.array take optional dtype argument #5572 [t-vi, radarhere]

8.3.0 (2021-07-01)

• Use snprintf instead of sprintf. CVE-2021-34552 #5567 [radarhere]

• Limit TIFF strip size when saving with LibTIFF #5514 [kmilos]

• Allow ICNS save on all operating systems #4526 [baletu, radarhere, newpanjing, hugovk]

• De-zigzag JPEG's DQT when loading; deprecate convert_dict_qtables #4989 [gofr, radarhere]

• Replaced xml.etree.ElementTree #5565 [radarhere]

... (truncated)

• 8013f13 8.3.2 version bump
• 23c7ca8 Update CHANGES.rst
• 8450366 Update release notes
• a0afe89 Update test case
• 9e08eb8 Raise ValueError if color specifier is too long
• bd5cf7d FLI tests for Oss-fuzz crash.
• 94a0cf1 Fix 6-byte OOB read in FliDecode
• cece64f Add 8.3.2 (2021-09-02) [CI skip]
• e422386 Add release notes for Pillow 8.3.2
• 08dcbb8 Pillow 8.3.2 supports Python 3.10 [ci skip]
• Additional commits viewable in compare view

• 2da029d [2.2.x] Bumped version for 2.2.24 release.
• f27c38a [2.2.x] Fixed CVE-2021-33571 -- Prevented leading zeros in IPv4 addresses.
• 053cc95 [2.2.x] Fixed CVE-2021-33203 -- Fixed potential path-traversal via admindocs'...
• 6229d87 [2.2.x] Confirmed release date for Django 2.2.24.
• f163ad5 [2.2.x] Added stub release notes and date for Django 2.2.24.
• bed1755 [2.2.x] Changed IRC references to Libera.Chat.
• 63f0d7a [2.2.x] Refs #32718 -- Fixed file_storage.test_generate_filename and model_fi...
• 5fe4970 [2.2.x] Post-release version bump.
• 61f814f [2.2.x] Bumped version for 2.2.23 release.
• b8ecb06 [2.2.x] Fixed #32718 -- Relaxed file name validation in FileField.
• Additional commits viewable in compare view

Sourced from urllib3's releases.

1.26.5

:warning: IMPORTANT: urllib3 v2.0 will drop support for Python 2: Read more in the v2.0 Roadmap

• Fixed deprecation warnings emitted in Python 3.10.
• Updated vendored six library to 1.16.0.
• Improved performance of URL parser when splitting the authority component.

If you or your organization rely on urllib3 consider supporting us via GitHub Sponsors

1.26.4

:warning: IMPORTANT: urllib3 v2.0 will drop support for Python 2: Read more in the v2.0 Roadmap

• Changed behavior of the default SSLContext when connecting to HTTPS proxy during HTTPS requests. The default SSLContext now sets check_hostname=True.

If you or your organization rely on urllib3 consider supporting us via GitHub Sponsors

1.26.3

:warning: IMPORTANT: urllib3 v2.0 will drop support for Python 2: Read more in the v2.0 Roadmap

• Fixed bytes and string comparison issue with headers (Pull #2141)

• Changed ProxySchemeUnknown error message to be more actionable if the user supplies a proxy URL without a scheme (Pull #2107)

If you or your organization rely on urllib3 consider supporting us via GitHub Sponsors

1.26.2

:warning: IMPORTANT: urllib3 v2.0 will drop support for Python 2: Read more in the v2.0 Roadmap

• Fixed an issue where wrap_socket and CERT_REQUIRED wouldn't be imported properly on Python 2.7.8 and earlier (Pull #2052)

1.26.1

:warning: IMPORTANT: urllib3 v2.0 will drop support for Python 2: Read more in the v2.0 Roadmap

• Fixed an issue where two User-Agent headers would be sent if a User-Agent header key is passed as bytes (Pull #2047)

1.26.0

:warning: IMPORTANT: urllib3 v2.0 will drop support for Python 2: Read more in the v2.0 Roadmap

• Added support for HTTPS proxies contacting HTTPS servers (Pull #1923, Pull #1806)

• Deprecated negotiating TLSv1 and TLSv1.1 by default. Users that still wish to use TLS earlier than 1.2 without a deprecation warning should opt-in explicitly by setting ssl_version=ssl.PROTOCOL_TLSv1_1 (Pull #2002) Starting in urllib3 v2.0: Connections that receive a DeprecationWarning will fail

• Deprecated Retry options Retry.DEFAULT_METHOD_WHITELIST, Retry.DEFAULT_REDIRECT_HEADERS_BLACKLIST and Retry(method_whitelist=...) in favor of Retry.DEFAULT_ALLOWED_METHODS, Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT, and Retry(allowed_methods=...) (Pull #2000) Starting in urllib3 v2.0: Deprecated options will be removed

... (truncated)

Sourced from urllib3's changelog.

1.26.5 (2021-05-26)

• Fixed deprecation warnings emitted in Python 3.10.
• Updated vendored six library to 1.16.0.
• Improved performance of URL parser when splitting the authority component.

1.26.4 (2021-03-15)

• Changed behavior of the default SSLContext when connecting to HTTPS proxy during HTTPS requests. The default SSLContext now sets check_hostname=True.

1.26.3 (2021-01-26)

• Fixed bytes and string comparison issue with headers (Pull #2141)

• Changed ProxySchemeUnknown error message to be more actionable if the user supplies a proxy URL without a scheme. (Pull #2107)

1.26.2 (2020-11-12)

• Fixed an issue where wrap_socket and CERT_REQUIRED wouldn't be imported properly on Python 2.7.8 and earlier (Pull #2052)

1.26.1 (2020-11-11)

• Fixed an issue where two User-Agent headers would be sent if a User-Agent header key is passed as bytes (Pull #2047)

1.26.0 (2020-11-10)

• NOTE: urllib3 v2.0 will drop support for Python 2. Read more in the v2.0 Roadmap <https://urllib3.readthedocs.io/en/latest/v2-roadmap.html>_.

• Added support for HTTPS proxies contacting HTTPS servers (Pull #1923, Pull #1806)

• Deprecated negotiating TLSv1 and TLSv1.1 by default. Users that still wish to use TLS earlier than 1.2 without a deprecation warning

... (truncated)

• d161647 Release 1.26.5
• 2d4a3fe Improve performance of sub-authority splitting in URL
• 2698537 Update vendored six to 1.16.0
• 07bed79 Fix deprecation warnings for Python 3.10 ssl module
• d725a9b Add Python 3.10 to GitHub Actions
• 339ad34 Use pytest==6.2.4 on Python 3.10+
• f271c9c Apply latest Black formatting
• 1884878 [1.26] Properly proxy EOF on the SSLTransport test suite
• a891304 Release 1.26.4
• 8d65ea1 Merge pull request from GHSA-5phf-pp7p-vc2r
• Additional commits viewable in compare view

Sourced from py's changelog.

1.10.0 (2020-12-12)

• Fix a regular expression DoS vulnerability in the py.path.svnwc SVN blame functionality (CVE-2020-29651)
• Update vendored apipkg: 1.4 => 1.5
• Update vendored iniconfig: 1.0.0 => 1.1.1

1.9.0 (2020-06-24)

• Add type annotation stubs for the following modules:

  • py.error
  • py.iniconfig
  • py.path (not including SVN paths)
  • py.io
  • py.xml

  There are no plans to type other modules at this time.

  The type annotations are provided in external .pyi files, not inline in the code, and may therefore contain small errors or omissions. If you use py in conjunction with a type checker, and encounter any type errors you believe should be accepted, please report it in an issue.

1.8.2 (2020-06-15)

• On Windows, py.path.locals which differ only in case now have the same Python hash value. Previously, such paths were considered equal but had different hashes, which is not allowed and breaks the assumptions made by dicts, sets and other users of hashes.

1.8.1 (2019-12-27)

• Handle FileNotFoundError when trying to import pathlib in path.common on Python 3.4 (#207).

• py.path.local.samefile now works correctly in Python 3 on Windows when dealing with symlinks.

• e5ff378 Update CHANGELOG for 1.10.0
• 94cf44f Update vendored libs
• 5e8ded5 testing: comment out an assert which fails on Python 3.9 for now
• afdffcc Rename HOWTORELEASE.rst to RELEASING.rst
• 2de53a6 Merge pull request #266 from nicoddemus/gh-actions
• fa1b32e Merge pull request #264 from hugovk/patch-2
• 887d6b8 Skip test_samefile_symlink on pypy3 on Windows
• e94e670 Fix test_comments() in test_source
• fef9a32 Adapt test
• 4a694b0 Add GitHub Actions badge to README
• Additional commits viewable in compare view