chore(deps): bump pillow in /tools/automatic_battery_tester
What the developer wrote
Authored by dependabot[bot]
chore(deps): bump pillow in /tools/automatic_battery_tester
Bumps [pillow](https://github.com/python-pillow/Pillow) from 11.3.0 to 12.1.1.
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](https://github.com/python-pillow/Pillow/compare/11.3.0...12.1.1)
---
updated-dependencies:
- dependency-name: pillow
dependency-version: 12.1.1
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
What changed, and why it matters
This is a routine dependency update generated by Dependabot. It upgrades the Python imaging library Pillow from version 11.3.0 to 12.1.1 inside a small internal tool used for battery testing. The change is a single line in a requirements file. There is no direct evidence in the commit that this fixes a specific security vulnerability, and the tool is not part of the Trezor firmware that runs on the hardware wallet itself.
Treat as a normal dependency hygiene update. Review the Pillow 12.1.1 release notes for any CVEs that may affect the battery tester tool's image handling, but no urgent security response is warranted for Trezor firmware or wallet users.
Security signals we found
Dependency version bump for a library with a history of image-parsing vulnerabilities
No explicit security claim or CVE reference in the commit message
Change is in an internal tooling directory, not firmware or core wallet code
Evidence from the diff
The commit bumps the pinned Pillow version in tools/automatic_battery_tester/requirements.txt from 11.3.0 to 12.1.1. Pillow 12.1.1 is a known maintenance release that includes fixes for several CVEs affecting image parsing (for example, buffer overflows and other memory-safety issues in image decoders), but the commit message does not identify any specific CVE or security impact. The affected path is an internal testing utility, not the device firmware, bootloader, or host wallet software that handles secrets or user transactions.
Changed components
tools/automatic_battery_tester/requirements.txtInspect captured patch +1 / −1
diff --git a/tools/automatic_battery_tester/requirements.txt b/tools/automatic_battery_tester/requirements.txt
index 40a01c51..f7f8c105 100644
--- a/tools/automatic_battery_tester/requirements.txt
+++ b/tools/automatic_battery_tester/requirements.txt
@@ -14,7 +14,7 @@ numpy==2.3.1
packaging==25.0
pandas==2.3.0
pfzy==0.3.4
-pillow==11.3.0
+pillow==12.1.1
prompt_toolkit==3.0.51
psutil==7.0.0
pyparsing==3.2.3
Why this scored 13/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.