Merge pull request #648 from Foundation-Devices/dependabot-host-tooling-hygiene
What the developer wrote
Authored by Jacksper13
Merge pull request #648 from Foundation-Devices/dependabot-host-tooling-hygiene
Update Pillow constraints for host tooling
What changed, and why it matters
This commit updates the Python Pillow image-processing library used in host-side developer tooling from version 8.x to 12.3.x and requires Python 3.10 or newer. Pillow 8.x is known to have many publicly disclosed security vulnerabilities, so the change likely removes exposure to those bugs during firmware build and test workflows. The change does not alter the firmware that runs on the Passport device itself, only the tools that run on a developer's computer.
Treat as a routine dependency hygiene update. Verify that CI and local developer builds still pass with Pillow 12.3.x on Python 3.10+. No urgent device-firmware action is needed because the change does not affect on-device code.
Security signals we found
Dependency version bump of a library with known historical vulnerabilities (Pillow 8.x)
Constraint now requires Python 3.10+ alongside the newer Pillow major version
Change is limited to host tooling files (pyproject.toml, setup.py, requirements-optional.txt, tox.ini, DEVELOPMENT.md)
No embedded firmware or runtime device code is modified
Evidence from the diff
The patch bumps Pillow constraints across four Trezor host-tooling files and DEVELOPMENT.md from ^8.0 / ==8.4.0 to ^12.3.0 (>=12.3.0,<13) and adds a Python >=3.10 requirement. It also adds py310 to the tox test matrix. The affected code is in extmod/trezor-firmware/python, which is host-side Python tooling (CLI, tests, optional extras), not the embedded firmware. Older Pillow versions have a long history of CVEs (e.g., buffer overflows, arbitrary code execution via malformed images), so the upgrade is a hygiene improvement, but the commit message frames it only as ‘host tooling hygiene’ and does not cite a specific vulnerability or advisory.
Changed components
extmod/trezor-firmware/pyproject.tomlextmod/trezor-firmware/python/requirements-optional.txtextmod/trezor-firmware/python/setup.pyextmod/trezor-firmware/python/tox.iniDEVELOPMENT.mdInspect captured patch +6 / −5
### DEVELOPMENT.md
@@ -102,9 +102,9 @@ Passport comes with a set of `Justfile` command scripts. Using these commands r
cargo install just
-Note that Python `Pillow` must be updated to `8.4.0` for all commands to work properly using the following command:
+The image tooling requires Python 3.10 or newer and `Pillow` 12.3.x:
- pip install Pillow==8.4.0
+ pip install 'Pillow>=12.3.0,<13'
`ports/stm32/Justfile` contains all the `just` commands you can run to build firmware for Passport. You'll typically want to be in the `ports/stm32` folder to run these commands.
### extmod/trezor-firmware/pyproject.toml
@@ -55,7 +55,7 @@ click = "^7"
ed25519 = "^1.4"
requests = "^2.19"
termcolor = "*"
-Pillow = "^8.0"
+Pillow = { version = "^12.3.0", python = ">=3.10" }
# crypto
ecdsa = "^0.16"
### extmod/trezor-firmware/python/requirements-optional.txt
@@ -1,6 +1,6 @@
hidapi >= 0.7.99.post20
rlp >= 1.1.0
web3 >= 4.8
-Pillow
+Pillow>=12.3.0,<13; python_version>='3.10'
stellar-sdk>=4.0.0,<6.0.0
types-click
### extmod/trezor-firmware/python/setup.py
@@ -37,7 +37,7 @@
"hidapi": ["hidapi>=0.7.99.post20"],
"ethereum": ["rlp>=1.1.0", "web3>=4.8"],
"qt-widgets": ["PyQt5"],
- "extra": ["Pillow"],
+ "extra": ["Pillow>=12.3.0,<13; python_version>='3.10'"],
"stellar": ["stellar-sdk>=4.0.0,<6.0.0"],
}
### extmod/trezor-firmware/python/tox.ini
@@ -4,6 +4,7 @@ envlist =
py37,
py38,
py39,
+ py310,
[testenv]
deps =Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.