diff mbox series

[bug#61172] gnu: python-pillow: Update to 9.3.0 [fixes CVE-2022-45199].

Message ID 20230130134751.30647-1-ngraves@ngraves.fr
State New
Headers show
Series [bug#61172] gnu: python-pillow: Update to 9.3.0 [fixes CVE-2022-45199]. | expand

Commit Message

Nicolas Graves Jan. 30, 2023, 1:47 p.m. UTC 
* gnu/packages/python-xyz.scm (python-pillow): Update to 9.3.0.
---
 gnu/packages/python-xyz.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Lars-Dominik Braun Feb. 4, 2023, 3:57 p.m. UTC | #1 
Hi,

it’s nothing we can merge to master unfortunately, because it causes
quite a few number of rebuilds. Do you know whether Python packages
are graftable? I never tried that.

Lars
Leo Famulari Feb. 5, 2023, 11:53 a.m. UTC | #2 
On Sat, Feb 4, 2023, at 16:57, Lars-Dominik Braun wrote:
> Hi,
>
> it’s nothing we can merge to master unfortunately, because it causes
> quite a few number of rebuilds. Do you know whether Python packages
> are graftable? I never tried that.


Unless something has changed recently (possible, I haven't paid close attention), yes, it's possible to graft Python packages.

Additionally, we can attempt a rapid rebuilding of pillow's dependents, perhaps along with a few other "ungrafting" changes. We are aiming to do the graft->ungraft cycles more quickly than previously.
diff mbox series

Patch

diff --git a/gnu/packages/python-xyz.scm b/gnu/packages/python-xyz.scm
index b14c4ff0f3..9df636c7e0 100644
--- a/gnu/packages/python-xyz.scm
+++ b/gnu/packages/python-xyz.scm
@@ -7591,13 +7591,13 @@  (define-public python-pikepdf
 (define-public python-pillow
   (package
     (name "python-pillow")
-    (version "9.2.0")
+    (version "9.3.0")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri "Pillow" version))
               (sha256
                (base32
-                "011wgm1mssjchpva9wsi2a07im9czyjvik137xlp5f0g7vykdrkm"))
+                "03vn7s6rq943knjglm6w82clbmvd8bya1yc0sw402mksalma4df9"))
               (modules '((guix build utils)))
               (snippet '(begin
                           (delete-file-recursively "src/thirdparty")))))