10.3.0 (2024-04-01)¶

Security¶

ImageMath eval()¶

Danger

ImageMath.eval() uses Python’seval() function to process the expressionstring, and carries the security risks of doing so. A direct replacement for this isthe newunsafe_eval(), but that carries the same risks. It isnot recommended to process expressions without considering this.lambda_eval() is a more secure alternative.

CVE 2024-28219: Fix buffer overflow in`_imagingcms.c`¶

In_imagingcms.c, twostrcpy calls were able to copy too much data into fixedlength strings. This has been fixed by usingstrncpy instead.

Deprecations¶

ImageCms constants and versions() function¶

A number of constants and a function inImageCms have been deprecated.This includes a table of flags based on LittleCMS version 1 which has been replacedwith a new classImageCms.Flags based on LittleCMS 2 flags.

Deprecated	Use instead
`ImageCms.DESCRIPTION`	No replacement
`ImageCms.VERSION`	`PIL.__version__`
`ImageCms.FLAGS["MATRIXINPUT"]`	`ImageCms.Flags.CLUT_POST_LINEARIZATION`
`ImageCms.FLAGS["MATRIXOUTPUT"]`	`ImageCms.Flags.FORCE_CLUT`
`ImageCms.FLAGS["MATRIXONLY"]`	No replacement
`ImageCms.FLAGS["NOWHITEONWHITEFIXUP"]`	`ImageCms.Flags.NOWHITEONWHITEFIXUP`
`ImageCms.FLAGS["NOPRELINEARIZATION"]`	`ImageCms.Flags.CLUT_PRE_LINEARIZATION`
`ImageCms.FLAGS["GUESSDEVICECLASS"]`	`ImageCms.Flags.GUESSDEVICECLASS`
`ImageCms.FLAGS["NOTCACHE"]`	`ImageCms.Flags.NOCACHE`
`ImageCms.FLAGS["NOTPRECALC"]`	`ImageCms.Flags.NOOPTIMIZE`
`ImageCms.FLAGS["NULLTRANSFORM"]`	`ImageCms.Flags.NULLTRANSFORM`
`ImageCms.FLAGS["HIGHRESPRECALC"]`	`ImageCms.Flags.HIGHRESPRECALC`
`ImageCms.FLAGS["LOWRESPRECALC"]`	`ImageCms.Flags.LOWRESPRECALC`
`ImageCms.FLAGS["GAMUTCHECK"]`	`ImageCms.Flags.GAMUTCHECK`
`ImageCms.FLAGS["WHITEBLACKCOMPENSATION"]`	`ImageCms.Flags.BLACKPOINTCOMPENSATION`
`ImageCms.FLAGS["BLACKPOINTCOMPENSATION"]`	`ImageCms.Flags.BLACKPOINTCOMPENSATION`
`ImageCms.FLAGS["SOFTPROOFING"]`	`ImageCms.Flags.SOFTPROOFING`
`ImageCms.FLAGS["PRESERVEBLACK"]`	`ImageCms.Flags.NONEGATIVES`
`ImageCms.FLAGS["NODEFAULTRESOURCEDEF"]`	`ImageCms.Flags.NODEFAULTRESOURCEDEF`
`ImageCms.FLAGS["GRIDPOINTS"]`	`ImageCms.Flags.GRIDPOINTS()`
`ImageCms.versions()`	`PIL.features.version_module()` with`feature="littlecms2"`,`sys.version` or`sys.version_info`, and`PIL.__version__`

ImageMath.eval()¶

ImageMath.eval() has been deprecated. Uselambda_eval() orunsafe_eval() instead. See earlier security notes for moreinformation.

API changes¶

Added alpha_quality argument when saving WebP images¶

When saving WebP images, analpha_quality argument can be passed to the encoder. Itis an integer value between 0 to 100, where values other than 100 will provide lossycompression.

Negative kmeans error¶

When callingquantize(), a negativekmeans will nowraise aValueError, unless a palette is supplied to make the value redundant.

Negative P1-P3 PPM value error¶

If a P1-P3 PPM image contains a negative value, aValueError will now beraised.

API additions¶

Added PerspectiveTransform¶

PerspectiveTransform has been added, meaningthat all of theTransform values now have a correspondingsubclass ofTransform.

Other changes¶

Portable FloatMap (PFM) images¶

Support has been added for reading and writing grayscale (Pf format)Portable FloatMap (PFM) files containingF data.

Release GIL when fetching WebP frames¶

Python’s Global Interpreter Lock is now released when fetching WebP frames fromthe libwebp decoder.

Type hints¶

Pillow now has type hints for a large part of its modules, and the packageincludes apy.typed file and theTyping::Typed Trove classifier.

On this page

10.3.0 (2024-04-01)

Movatterモバイル変換