{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:67cfd61f-b229-5637-9def-9d4edfea54a0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "version": "11.2.1.post9+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@11.2.1", "type": "library", "version": "11.2.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-48379", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:614d12f1-465a-5ac2-8c2a-2cd72570d96b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48379 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:d51425a7-25d0-579c-b419-9e8af7a7520d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112390 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:78e063b3-65a0-52b0-9fb6-be9c7fc7e837", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:af314c84-a4c1-5949-9c24-7970e3c8ce73", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112392 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:e2c95f43-e6a1-5394-820d-20ab2a0cde0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112393 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:9bdfaf9d-f410-54a4-9de4-d0232ffa7213", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:6851dfb9-a70a-57f1-97b8-e6e1c74412f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112395 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:e0bfb33d-230b-5830-918a-6031c5eb1453", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112397 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:69152859-026d-57d9-88a3-c439f1bdabec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:ce2e8d33-20a5-5ff8-9d18-618f2d440c90", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112399 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112400", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:19ef149d-06ba-5de3-bff7-ef0f3e567513", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112400 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:19add38e-bb1f-5e81-a1d1-43b96bf89e14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:a5483fd8-780b-5b77-8845-166c7f4ece79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112402 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:1c31d6bb-55e7-519d-a7e9-2a6685ac923c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112403 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:b639f99a-ea13-5c7b-a18d-37bda1040205", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112404 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:2800e485-1731-5632-8057-eadf46f5c984", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112406 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112891", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:56034109-402a-5f0e-81aa-37673d580eb1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112891 affects version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:5688761b-0b01-5156-a405-1617f7f77c65", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112892 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112893", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:a9aef697-9bb8-5cde-8645-306a93d43bd2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112893 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:007663a9-8743-5ace-8c57-edbc46446cc3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112894 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:8465db74-1526-549f-90af-067cdbef18ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112895 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:e4fd8016-a656-5e8d-b8cf-aafff23b1c83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112896 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:a1c990d7-934e-508b-9163-4b8850cbb17f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112897 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112898", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:7061e2e5-6270-53b1-8d2b-24a0bed9ea6a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112898 affects version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:bb8b0731-1db6-5819-a8bf-1df72f09e280", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112899 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:fdf9fd59-687b-5afb-ab0b-fd06f0918194", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112900 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:285813b7-270a-52b4-9727-7121b52b2361", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:deb06238-ced2-5e34-a4d5-e5c798705315", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-114501", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:bb92d3d5-e2cf-5e59-b8d7-82d716087752", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114501 affects version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-25990", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:05628983-a9a3-5dcd-96b4-b7776fa41c6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25990 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-40192", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:ab40f5c9-2d6f-5a8a-a84f-cdd1a5da8e3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40192 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:e49e1ff6-a0a8-5777-a44c-697f9fd9a2c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42308 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-42309", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:c28443ab-7573-589d-801e-4fd71ff7880f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42309 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:e78be9a2-2bcf-516f-b728-61ff5008e48d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42310 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-42311", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:c55f8d73-d6e0-5647-8ecc-35f4a603c82e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42311 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:86244e75-1343-5666-a1f0-451c6aa38148", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:4bd24deb-7648-5c95-9039-32306db3117f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:04137fb1-e35b-56fa-97a7-41bebfa18db5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:8570b677-94f3-583b-84cd-b4f21773607f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:587847b8-6e33-58f4-8cc4-337a7ff0ed97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55380 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:e4dde950-f39c-5f31-8ac0-da4742697fd0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:2b7726e9-6b05-5b28-bc73-0d1a7eadc38c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59197 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:d608bc0c-3d76-55f6-bf1b-e125f23a4de4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59198 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:43b87bf1-767e-56aa-982e-329c00f81610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59199 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:43f0c119-94a5-53d9-bdf4-e87ed002981b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59200 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:7d15686d-9927-5d17-8a7f-b485f7361fb4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59204 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:799f87f3-9884-5642-9dd6-e371f1dfe758", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59205 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:e3dd8a5e-c848-5847-8bdd-2e5f0cf8dcf3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:5336543d-4c28-517f-9ad3-acc283f9b91d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96637 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "CVE-2026-96638", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:30eb7e6d-9a5b-5c05-b901-4959396ea5cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96638 affects version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-96639", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:7e63b948-d269-5c94-a6ed-e2d4f4214b4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96639 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:4c23b172-0d0b-5892-a97e-672521d63536", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96640 is fixed in version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:00ee4b85-8bbe-5a36-a4c8-d1579a671bf2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 11.2.1.post9+tuxcare of pillow." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:b7b52140-bf57-56bf-8946-69edb62d85e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96642 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "CVE-2026-96643", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:fb874654-413b-58e4-b809-19d94231dc79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96643 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:e4b37ede-e8a7-53d0-8498-f82097abfbfe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96644 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "CVE-2026-96778", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:b67f1bdc-20be-55da-8c92-831b6c1ea596", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96778 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." } }, { "id": "GHSA-78g4-xqwv-q3g8", "affects": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ], "bom-ref": "urn:uuid:59d014e0-35b4-5215-8e2b-c1f3adecbaeb", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.2.1.post9+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository...", "justification": "requires_dependency" } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } ] }