Bump pillow from 10.3.0 to 12.1.1 in /misc/q1font
What the developer wrote
Authored by dependabot[bot]
Bump pillow from 10.3.0 to 12.1.1 in /misc/q1font
Bumps [pillow](https://github.com/python-pillow/Pillow) from 10.3.0 to 12.1.1.
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](https://github.com/python-pillow/Pillow/compare/10.3.0...12.1.1)
---
updated-dependencies:
- dependency-name: pillow
dependency-version: 12.1.1
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
What changed, and why it matters
This is a routine automated update by Dependabot that bumps the Python Pillow image-processing library from version 10.3.0 to 12.1.1 inside a small helper tool used to build fonts for the COLDCARD hardware wallet. The change itself is a single line in a requirements file. It is not a fix for a known, actively exploited vulnerability in the COLDCARD firmware, and the affected helper tool is not part of the wallet's runtime security boundary.
Review the Pillow 10.3.0 to 12.1.1 changelog for any high-severity image-parsing CVEs and confirm whether q1font processes untrusted image files. If it only processes project-owned font assets, no urgent action is needed beyond normal dependency hygiene. If it processes user-supplied images, validate inputs and consider sandboxing the build tool.
Security signals we found
Dependency version bump for a library with a history of image-parsing vulnerabilities
No specific CVE or security advisory referenced in the commit message
No code changes accompanying the version bump
Change is in a build-time font utility, not in firmware runtime code
Evidence from the diff
The commit updates the pinned version of Pillow in misc/q1font/requirements.txt from 10.3.0 to 12.1.1. The q1font directory appears to be an offline build-time utility for generating or converting fonts for the COLDCARD Q1 display. Pillow is a general-purpose image library; newer versions typically include bug fixes and security patches for image parsing (e.g., CVEs in libwebp, libtiff, PNG/JPEG decoders). However, the commit provides no specific CVE, no code changes, and no indication that the old version was reachable in an attacker-controlled way. The update is a generic dependency bump.
Changed components
misc/q1font/requirements.txtBuild-time font generation utility (q1font)Inspect captured patch +1 / −1
diff --git a/misc/q1font/requirements.txt b/misc/q1font/requirements.txt
index 1c9f6c1..b4d12b7 100644
--- a/misc/q1font/requirements.txt
+++ b/misc/q1font/requirements.txt
@@ -1,2 +1,2 @@
-Pillow==10.3.0
+Pillow==12.1.1
Why this scored 11/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.