Constrain Pillow tooling compatibility
What the developer wrote
Authored by Jack
Constrain Pillow tooling compatibility
What changed, and why it matters
This commit tightens the allowed versions of a Python image-processing library called Pillow used only in developer tooling. It caps Pillow below version 13 and requires Python 3.10 or newer. There is no indication this fixes a security flaw in the firmware itself; it appears to be a build/maintenance compatibility change.
No security action required. Treat as a routine dependency-range maintenance commit for developer tooling.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff changes dependency declarations for Pillow from an open-ended ‘>=12.3.0’ to ‘>=12.3.0,<13’ and adds a Python >=3.10 requirement in two Trezor firmware tooling files and the project development docs. No runtime firmware code is modified. No CVE, security advisory, or vulnerability description is present in the commit or supplied references.
Changed components
DEVELOPMENT.md documentationextmod/trezor-firmware/pyproject.tomlextmod/trezor-firmware/python/setup.pyInspect captured patch +4 / −4
### DEVELOPMENT.md
@@ -102,9 +102,9 @@ Passport comes with a set of `Justfile` command scripts. Using these commands r
cargo install just
-Note that Python `Pillow` must be at least `12.3.0` for all commands to work properly using the following command:
+The image tooling requires Python 3.10 or newer and `Pillow` 12.3.x:
- pip install 'Pillow>=12.3.0'
+ pip install 'Pillow>=12.3.0,<13'
`ports/stm32/Justfile` contains all the `just` commands you can run to build firmware for Passport. You'll typically want to be in the `ports/stm32` folder to run these commands.
### extmod/trezor-firmware/pyproject.toml
@@ -55,7 +55,7 @@ click = "^7"
ed25519 = "^1.4"
requests = "^2.19"
termcolor = "*"
-Pillow = "^12.3.0"
+Pillow = { version = "^12.3.0", python = ">=3.10" }
# crypto
ecdsa = "^0.16"
### extmod/trezor-firmware/python/setup.py
@@ -37,7 +37,7 @@
"hidapi": ["hidapi>=0.7.99.post20"],
"ethereum": ["rlp>=1.1.0", "web3>=4.8"],
"qt-widgets": ["PyQt5"],
- "extra": ["Pillow>=12.3.0"],
+ "extra": ["Pillow>=12.3.0,<13; python_version>='3.10'"],
"stellar": ["stellar-sdk>=4.0.0,<6.0.0"],
}
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.