Bump pillow from 12.1.1 to 12.3.0 in /misc/q1font
What the developer wrote
Authored by dependabot[bot]
Bump pillow from 12.1.1 to 12.3.0 in /misc/q1font
Bumps [pillow](https://github.com/python-pillow/Pillow) from 12.1.1 to 12.3.0.
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](https://github.com/python-pillow/Pillow/compare/12.1.1...12.3.0)
---
updated-dependencies:
- dependency-name: pillow
dependency-version: 12.3.0
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
What changed, and why it matters
This is a routine automated update by Dependabot that bumps the Python Pillow image-processing library from version 12.1.1 to 12.3.0 inside a small helper tool used only for font generation. The commit itself does not describe any security problem, and the changed file is not part of the COLDCARD firmware that runs on the device. It is best treated as normal maintenance, though any dependency update can in principle include undisclosed fixes.
Review Pillow 12.3.0 release notes for any relevant security fixes, verify the q1font tool still produces identical font output, and merge as routine maintenance. No urgent security response is warranted based on the supplied materials.
Security signals we found
Dependency version bump of an image-processing library with a history of memory-safety bugs
No security claim, CVE reference, or advisory link supplied in commit or references
Changed component is an auxiliary build-time font tool, not device firmware
Evidence from the diff
The diff changes one line in misc/q1font/requirements.txt, pinning Pillow to 12.3.0 instead of 12.1.1. The q1font directory is a build-time/auxiliary font-rendering utility, not runtime firmware code. No CVE, advisory, or security discussion is present in the commit or supplied references. Pillow 12.3.0 does contain upstream security fixes relative to 12.1.1, but this commit does not identify or rely on any of them, and the component is low-exposure.
Changed components
misc/q1font/requirements.txtPillow Python package (build-time dependency only)Inspect captured patch +1 / −1
diff --git a/misc/q1font/requirements.txt b/misc/q1font/requirements.txt
index b4d12b7..d84d5dd 100644
--- a/misc/q1font/requirements.txt
+++ b/misc/q1font/requirements.txt
@@ -1,2 +1,2 @@
-Pillow==12.1.1
+Pillow==12.3.0
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.