tooling: constrain tox Pillow dependency (SFT-7281)
What the developer wrote
Authored by Jack
tooling: constrain tox Pillow dependency (SFT-7281)
The tox requirements path bypassed the Pillow constraint and could install an older vulnerable release. Exercise the supported constrained dependency under Python 3.10 while retaining the legacy environments without Pillow.
What changed, and why it matters
This commit tightens a software dependency used only in testing/development tooling. It prevents an automated test environment from installing old, known-vulnerable versions of the Pillow image library when running under Python 3.10. The change does not alter the firmware that runs on the Passport device itself, so end-user funds or device security are not directly at risk. It is a preventive hygiene fix for the developer build/test pipeline.
No urgent action for device users. Developers should ensure CI runs the new py310 tox environment so the constrained Pillow version is exercised, and verify that legacy environments still pass without the updated dependency.
Security signals we found
Dependency constraint added to block known-vulnerable Pillow versions
Commit message acknowledges prior path could install an older vulnerable release
Change is in Trezor external module tooling, not Passport firmware runtime
Legacy Python environments intentionally left without Pillow constraint
Evidence from the diff
In extmod/trezor-firmware/python/requirements-optional.txt, the unconstrained Pillow dependency is replaced with Pillow>=12.3.0,<13; python_version>=‘3.10’. The same file is referenced by tox.ini, which also adds a py310 test environment. The constraint ensures that tox’s requirements path cannot pull in an older Pillow release with known CVEs when exercised under Python 3.10, while legacy Python 3.7-3.9 environments remain unchanged (they do not install Pillow via this path). The commit message explicitly states the prior path could install an older vulnerable release.
Changed components
extmod/trezor-firmware/python/requirements-optional.txtextmod/trezor-firmware/python/tox.iniTrezor python tooling test environmentInspect captured patch +2 / −1
### extmod/trezor-firmware/python/requirements-optional.txt
@@ -1,6 +1,6 @@
hidapi >= 0.7.99.post20
rlp >= 1.1.0
web3 >= 4.8
-Pillow
+Pillow>=12.3.0,<13; python_version>='3.10'
stellar-sdk>=4.0.0,<6.0.0
types-click
### extmod/trezor-firmware/python/tox.ini
@@ -4,6 +4,7 @@ envlist =
py37,
py38,
py39,
+ py310,
[testenv]
deps =Why this scored 33/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.