Update Pillow constraints for host tooling
What the developer wrote
Authored by Jack
Update Pillow constraints for host tooling
What changed, and why it matters
This commit updates the required version of the Python imaging library Pillow from 8.x to at least 12.3.0 in the project's host tooling configuration. Pillow 8.x is known to have publicly disclosed security vulnerabilities, so raising the minimum version is a defensive maintenance change. It does not by itself prove the firmware was exploitable, but it removes a risky dependency version from the development/build environment.
Treat as routine security hygiene. Verify that CI and developer environments now install Pillow >=12.3.0, audit other pinned dependencies for similarly outdated versions, and confirm the build pipeline does not still pull in Pillow 8.x transitively.
Security signals we found
Dependency version bump away from EOL/vulnerable Pillow 8.x branch
Host tooling only (development/build environment), not on-device firmware
No CVE or advisory language in commit message or diff
No functional code changes or patch of a specific vulnerability
Evidence from the diff
The patch changes three host-side files: DEVELOPMENT.md, extmod/trezor-firmware/pyproject.toml, and extmod/trezor-firmware/python/setup.py. In each, the Pillow constraint moves from a fixed or lower-bound 8.x version to >=12.3.0 or ^12.3.0. Pillow 8.x has multiple known CVEs (e.g., buffer overflows, integer overflows in image parsing). This commit is therefore a dependency hardening step for host tooling, not a runtime firmware fix. The diff does not show any code-level vulnerability or exploit path in the Passport firmware itself.
Changed components
DEVELOPMENT.mdextmod/trezor-firmware/pyproject.tomlextmod/trezor-firmware/python/setup.pyHost tooling dependency: Python PillowInspect captured patch +4 / −4
### DEVELOPMENT.md
@@ -102,9 +102,9 @@ Passport comes with a set of `Justfile` command scripts. Using these commands r
cargo install just
-Note that Python `Pillow` must be updated to `8.4.0` for all commands to work properly using the following command:
+Note that Python `Pillow` must be at least `12.3.0` for all commands to work properly using the following command:
- pip install Pillow==8.4.0
+ pip install 'Pillow>=12.3.0'
`ports/stm32/Justfile` contains all the `just` commands you can run to build firmware for Passport. You'll typically want to be in the `ports/stm32` folder to run these commands.
### extmod/trezor-firmware/pyproject.toml
@@ -55,7 +55,7 @@ click = "^7"
ed25519 = "^1.4"
requests = "^2.19"
termcolor = "*"
-Pillow = "^8.0"
+Pillow = "^12.3.0"
# crypto
ecdsa = "^0.16"
### extmod/trezor-firmware/python/setup.py
@@ -37,7 +37,7 @@
"hidapi": ["hidapi>=0.7.99.post20"],
"ethereum": ["rlp>=1.1.0", "web3>=4.8"],
"qt-widgets": ["PyQt5"],
- "extra": ["Pillow"],
+ "extra": ["Pillow>=12.3.0"],
"stellar": ["stellar-sdk>=4.0.0,<6.0.0"],
}
Why this scored 27/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.