Hide navigation sidebar
Hide table of contents sidebar
Skip to content
Back to top
View this page
Toggle table of contents sidebar

# 10.3.0

## Security

### ImageMath eval()

Danger

`ImageMath.eval()` uses Python’s `eval()` function to process the expression string, and carries the security risks of doing so. A direct replacement for this is the new `unsafe_eval()`, but that carries the same risks. It is not recommended to process expressions without considering this. `lambda_eval()` is a more secure alternative.

### CVE 2024-28219: Fix buffer overflow in `_imagingcms.c`

In `_imagingcms.c`, two `strcpy` calls were able to copy too much data into fixed length strings. This has been fixed by using `strncpy` instead.

## Deprecations

### ImageCms constants and versions() function

A number of constants and a function in `ImageCms` have been deprecated. This includes a table of flags based on LittleCMS version 1 which has been replaced with a new class `ImageCms.Flags` based on LittleCMS 2 flags.

Deprecated | Use instead
--- | ---
`ImageCms.DESCRIPTION` | No replacement
`ImageCms.VERSION` | `PIL.__version__`
`ImageCms.FLAGS["MATRIXINPUT"]` | `ImageCms.Flags.CLUT_POST_LINEARIZATION`
`ImageCms.FLAGS["MATRIXOUTPUT"]` | `ImageCms.Flags.FORCE_CLUT`
`ImageCms.FLAGS["MATRIXONLY"]` | No replacement
`ImageCms.FLAGS["NOWHITEONWHITEFIXUP"]` | `ImageCms.Flags.NOWHITEONWHITEFIXUP`
`ImageCms.FLAGS["NOPRELINEARIZATION"]` | `ImageCms.Flags.CLUT_PRE_LINEARIZATION`
`ImageCms.FLAGS["GUESSDEVICECLASS"]` | `ImageCms.Flags.GUESSDEVICECLASS`
`ImageCms.FLAGS["NOTCACHE"]` | `ImageCms.Flags.NOCACHE`
`ImageCms.FLAGS["NOTPRECALC"]` | `ImageCms.Flags.NOOPTIMIZE`
`ImageCms.FLAGS["NULLTRANSFORM"]` | `ImageCms.Flags.NULLTRANSFORM`
`ImageCms.FLAGS["HIGHRESPRECALC"]` | `ImageCms.Flags.HIGHRESPRECALC`
`ImageCms.FLAGS["LOWRESPRECALC"]` | `ImageCms.Flags.LOWRESPRECALC`
`ImageCms.FLAGS["GAMUTCHECK"]` | `ImageCms.Flags.GAMUTCHECK`
`ImageCms.FLAGS["WHITEBLACKCOMPENSATION"]` | `ImageCms.Flags.BLACKPOINTCOMPENSATION`
`ImageCms.FLAGS["BLACKPOINTCOMPENSATION"]` | `ImageCms.Flags.BLACKPOINTCOMPENSATION`
`ImageCms.FLAGS["SOFTPROOFING"]` | `ImageCms.Flags.SOFTPROOFING`
`ImageCms.FLAGS["PRESERVEBLACK"]` | `ImageCms.Flags.NONEGATIVES`
`ImageCms.FLAGS["NODEFAULTRESOURCEDEF"]` | `ImageCms.Flags.NODEFAULTRESOURCEDEF`
`ImageCms.FLAGS["GRIDPOINTS"]` | `ImageCms.Flags.GRIDPOINTS()`
`ImageCms.versions()` | `PIL.features.version_module()` with `feature="littlecms2"`, `sys.version` or `sys.version_info`, and `PIL.__version__`

### ImageMath.eval()

`ImageMath.eval()` has been deprecated. Use `lambda_eval()` or `unsafe_eval()` instead. See earlier security notes for more information.

## API changes

### Added alpha_quality argument when saving WebP images

When saving WebP images, an `alpha_quality` argument can be passed to the encoder. It is an integer value between 0 to 100, where values other than 100 will provide lossy compression.

### Negative kmeans error

When calling `quantize()`, a negative `kmeans` will now raise a `ValueError`, unless a palette is supplied to make the value redundant.

### Negative P1-P3 PPM value error

If a P1-P3 PPM image contains a negative value, a `ValueError` will now be raised.

## API additions

### Added PerspectiveTransform

`PerspectiveTransform` has been added, meaning that all of the `Transform` values now have a corresponding subclass of `Transform`.

## Other changes

### Portable FloatMap (PFM) images

Support has been added for reading and writing grayscale (Pf format) Portable FloatMap (PFM) files containing `F` data.

### Release GIL when fetching WebP frames

Python’s Global Interpreter Lock is now released when fetching WebP frames from the libwebp decoder.

### Type hints

Pillow now has type hints for a large part of its modules, and the package includes a `py.typed` file and the `Typing :: Typed` Trove classifier.