pillow (10.2.0-1ubuntu1.2) noble-security; urgency=medium

  * SECURITY UPDATE: integer overflow via large font advances
    - debian/patches/CVE-2026-42308.patch: Use long for glyph position in
      src/_imagingft.c.
    - CVE-2026-42308
  * SECURITY UPDATE: DoS via malicious PDF
    - debian/patches/CVE-2026-42310.patch: Raise an error if the trailer chain
      loops back on itself in src/PIL/PdfParser.py.
    - CVE-2026-42310

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 04 Jun 2026 13:41:17 -0400

pillow (10.2.0-1ubuntu1.1) noble; urgency=medium

  [ Graham Inggs ]
  * debian/rules: Set DPKG_EXPORT_BUILDFLAGS = 1 and include
    /usr/share/dpkg/buildflags.mk to pick up the correct compiler flags
    (LP #2077744) (LP: #2084457)

 -- Mate Kukri <mate.kukri@canonical.com>  Mon, 14 Oct 2024 14:36:34 +0100

pillow (10.2.0-1ubuntu1) noble; urgency=medium

  * SECURITY UPDATE: Buffer overflow in imagingcms.c
    - debian/patches/CVE-2024-28219.patch: Use strncpy
    to avoid buffer overflow
    - CVE-2024-28219

 -- Nick Galanis <nick.galanis@canonical.com>  Mon, 15 Apr 2024 15:10:42 +0100

pillow (10.2.0-1build1) noble; urgency=high

  * No change rebuild for 64-bit time_t and frame pointers.

 -- Julian Andres Klode <juliank@ubuntu.com>  Mon, 08 Apr 2024 18:15:35 +0200

pillow (10.2.0-1) unstable; urgency=medium

  * New upstream version. Addresses CVE-2023-50447. Closes: #1061172.

 -- Matthias Klose <doko@debian.org>  Sat, 20 Jan 2024 10:47:10 +0100

pillow (10.1.0-1) unstable; urgency=medium

  * New upstream version.
  * Depend on media-types instead of mime-support. Closes: #987500.

 -- Matthias Klose <doko@debian.org>  Tue, 31 Oct 2023 13:24:15 +0100

pillow (10.0.0-1) unstable; urgency=medium

  * New upstream version.

 -- Matthias Klose <doko@debian.org>  Wed, 05 Jul 2023 18:58:54 +0200

pillow (9.5.0-1) unstable; urgency=medium

  * New upstream version.
  * Bump standards version.
  * debian/patches/pkg-config-multiarch.diff: Remove, applied upstream.

 -- Matthias Klose <doko@debian.org>  Mon, 12 Jun 2023 09:30:20 +0200

pillow (9.4.0-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Handle more than one directory returned by pkg-config (Closes: #1028904).

 -- Bastian Germann <bage@debian.org>  Mon, 16 Jan 2023 16:29:25 +0100

pillow (9.4.0-1) unstable; urgency=medium

  * New upstream version.

 -- Matthias Klose <doko@debian.org>  Tue, 03 Jan 2023 10:06:46 +0100

pillow (9.3.0-1) unstable; urgency=medium

  * New upstream version.
  * Bump standards version.

 -- Matthias Klose <doko@debian.org>  Mon, 26 Dec 2022 12:37:12 +0100

pillow (9.2.0-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Add patch to fix FTBFS (Closes: #1020043)

 -- Nilesh Patra <nilesh@debian.org>  Fri, 21 Oct 2022 15:53:14 +0000

pillow (9.2.0-1) unstable; urgency=medium

  * New upstream version.

 -- Matthias Klose <doko@debian.org>  Sun, 17 Jul 2022 13:57:17 +0200

pillow (9.1.1-1) unstable; urgency=medium

  * New upstream version.
    - CVE-2022-30595: When reading past the end of a TGA scan line,
      reduce bytes left.
    - Do not open images with zero or negative height (#6269).

 -- Matthias Klose <doko@debian.org>  Fri, 27 May 2022 11:56:13 +0200

pillow (9.1.0-1) unstable; urgency=medium

  * New upstream version.

 -- Matthias Klose <doko@debian.org>  Mon, 04 Apr 2022 13:08:08 +0200

pillow (9.0.1-1) unstable; urgency=medium

  * New upstream version.
  * Fix documentation build error with Python 3.10 (Heinrich Schuchardt).

 -- Matthias Klose <doko@debian.org>  Fri, 18 Feb 2022 01:07:13 +0100

pillow (9.0.0-1) unstable; urgency=medium

  * New upstream version.

 -- Matthias Klose <doko@debian.org>  Mon, 10 Jan 2022 10:52:08 +0100

pillow (8.4.0-1) unstable; urgency=medium

  * New upstream version.

 -- Matthias Klose <doko@debian.org>  Thu, 25 Nov 2021 13:17:45 +0100

pillow (8.3.2-1) unstable; urgency=medium

  * New upstream version.
  * Bump standards version.

 -- Matthias Klose <doko@debian.org>  Mon, 11 Oct 2021 15:35:03 +0200

pillow (8.2.0-1) experimental; urgency=medium

  * New upstream version.
  * Build-depend on libopenjp2-7-dev. Closes: #904478.

 -- Matthias Klose <doko@debian.org>  Thu, 15 Apr 2021 11:37:53 +0200

pillow (8.1.2+dfsg-1) unstable; urgency=medium

  * Stop building the python3-*-dbg packages. Closes: #994317.

 -- Matthias Klose <doko@debian.org>  Wed, 15 Sep 2021 14:16:02 +0200

pillow (8.1.2+dfsg-0.3) unstable; urgency=high

  * Non-maintainer upload by the Security Team.
  * Fix "CVE-2021-34552 - buffer overflow in Convert.c. Replace sprintf with
    snprintf. Backport upstream change from 8.3 to 8.1. (Closes: #991293)

 -- Neil Williams <codehelp@debian.org>  Tue, 20 Jul 2021 06:42:31 +0100

pillow (8.1.2+dfsg-0.2) unstable; urgency=medium

  * Non-maintainer upload.
  * Cherrypick security fixes from 8.2:
    - CVE-2021-25287 / CVE-2021-25288 / CVE-2021-28675 / CVE-2021-28676
      CVE-2021-28677 / CVE-2021-28678 (Closes: #989062)

 -- Moritz Muehlenhoff <jmm@debian.org>  Sun, 13 Jun 2021 18:11:04 +0200

pillow (8.1.2+dfsg-0.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Repack for DFSG compliance and update d/copyright. Closes: #952899.
  * Update d/watch for +dfsg repack.

 -- Romain Porte <debian@microjoe.org>  Sat, 24 Apr 2021 15:51:24 +0200

pillow (8.1.2-1) unstable; urgency=high

  * New upstream version.
    - Fix Memory DOS in BLP (CVE-2021-27921), ICNS (CVE-2021-27922)
      and ICO (CVE-2021-27923) Image Plugins.

 -- Matthias Klose <doko@debian.org>  Tue, 09 Mar 2021 08:12:51 +0100

pillow (8.1.1-1) unstable; urgency=high

  * New upstream version.
    - Use more specific regex chars to prevent ReDoS. CVE-2021-25292.
    - Fix OOB Read in TiffDecode.c, and check the tile validity before reading.
      CVE-2021-25291.
    - Fix negative size read in TiffDecode.c. CVE-2021-25290.
    - Fix OOB read in SgiRleDecode.c. CVE-2021-25293.
    - Incorrect error code checking in TiffDecode.c. CVE-2021-25289.

 -- Matthias Klose <doko@debian.org>  Thu, 04 Mar 2021 07:13:48 +0100

pillow (8.1.0-1) unstable; urgency=medium

  * New upstream version.
  * Bump standards and debhelper versions.

 -- Matthias Klose <doko@debian.org>  Wed, 06 Jan 2021 13:18:02 +0100

pillow (8.0.1-1) unstable; urgency=medium

  * New upstream version.

 -- Matthias Klose <doko@debian.org>  Thu, 29 Oct 2020 20:02:10 +0100

pillow (8.0.0-1) experimental; urgency=medium

  * New upstream version.

 -- Matthias Klose <doko@debian.org>  Sat, 17 Oct 2020 12:09:16 +0200

pillow (7.2.0-1) unstable; urgency=medium

  * New upstream version.
  * Update debian/copyright, partially addresses #952899.
    - Mention contributors.
    - Add copyright information for fonts.
  * Bump debhelper version.

 -- Matthias Klose <doko@debian.org>  Thu, 16 Jul 2020 13:42:51 +0200

pillow (7.0.0-4) unstable; urgency=medium

  * Don't rely on python2's python.mk in the build.
  * Bump standards version.

 -- Matthias Klose <doko@debian.org>  Wed, 29 Jan 2020 08:33:20 +0100

pillow (7.0.0-3) unstable; urgency=medium

  * Drop the Python2 autopkg tests.

 -- Matthias Klose <doko@debian.org>  Sun, 12 Jan 2020 09:54:31 +0100

pillow (7.0.0-2) unstable; urgency=medium

  * Build-depend on python2 for the use of python.mk.

 -- Matthias Klose <doko@debian.org>  Mon, 06 Jan 2020 16:19:39 +0100

pillow (7.0.0-1) unstable; urgency=medium

  * New upstream version.
    - Drops Python2 support.
  * Stop building the Python2 packages, now built from the pillow-python2
    source.

 -- Matthias Klose <doko@debian.org>  Mon, 06 Jan 2020 13:38:42 +0100

pillow (6.2.1-2) unstable; urgency=medium

  * Call python2 in the autopkg python2 tests.

 -- Matthias Klose <doko@debian.org>  Mon, 04 Nov 2019 08:41:21 +0100

pillow (6.2.1-1) unstable; urgency=medium

  * New upstream version, "last Pillow release to support Python 2.7".
  * Replaces python-dbg debpendencies with python2-dbg.
  * Remove Python2 suggests.

 -- Matthias Klose <doko@debian.org>  Sat, 26 Oct 2019 16:49:09 +0200

pillow (6.2.0-1) unstable; urgency=medium

  * New upstream version, last version supporting Python2.
  * Bump standards version.

 -- Matthias Klose <doko@debian.org>  Wed, 16 Oct 2019 15:47:42 +0200

pillow (6.1.0-1) unstable; urgency=medium

  * New upstream version.

 -- Matthias Klose <doko@debian.org>  Sun, 07 Jul 2019 14:36:49 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog python-pil-doc`.
