{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:41dd5e25-81a9-5f2e-80be-a7d839aa6f96", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "version": "11.3.0.post10+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@11.3.0", "type": "library", "version": "11.3.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:2398c582-b9e0-5bd3-a4b0-f1bbdd037da6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112390 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:f0920743-d096-52cb-bbb3-c1e079dcc6be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:50a9f24a-e502-5700-bb35-b4409fd2ce0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112392 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:f7be8cea-e6c7-5fe8-929b-007286f56b5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112393 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:a22daaaf-2a36-5e10-98a9-30f41639959b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:94b6a986-066e-580d-970c-2cc9da4690b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112395 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112396", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:2cf3a0ae-c04b-5885-bb38-b9538c78a70f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112396 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:77a1cf96-bde8-51ce-9345-f7d282bfdfed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112397 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:2451795a-0e43-557a-8bfb-e2a66db42420", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:d3453fd7-f414-5933-b184-ba4edb685d04", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112399 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112400", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:a96534f0-f2ff-5f21-abd6-cf1fc86725d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112400 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:fbf2636f-bba6-53cc-aa35-df22420ead4e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:1a104e1b-b1b5-5c2e-bc03-417105dc9e8c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112402 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:25098887-c322-53f5-833a-1e4a6f749c89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112403 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:dd8d5393-ced4-5a6f-aebd-75760abd28e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112404 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:5e65fa9a-8d44-5d9d-8979-0d2d631ce3f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112406 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112891", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:46354671-a504-56d9-8b20-e6be4c1ba01f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112891 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:4372fc1d-c9cd-56de-87e4-cd5cc0e78fd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112892 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112893", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:fe362801-9de4-541c-938b-1efbd686b897", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112893 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:0c3bde6b-5b13-5570-9f70-b9d9ce1ead2c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112894 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:d52ccad9-9708-54ea-89ef-283cdcca546b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112895 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:241429e4-9022-5ef6-8aae-5c663d445736", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112896 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:9cb07fd2-ec06-5690-8a25-43dba3b393f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112897 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112898", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:7bcd2464-cd12-5d3a-86e0-6e860a91c5af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112898 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:127dbe63-3476-5733-8641-753c9571ddbf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112899 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:457194e6-eef9-532f-9be1-6a104bab4f4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112900 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:38279147-68e7-562b-a325-d074c7fcb57f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:fe4ec1b2-5e14-52c1-ba87-58c8837f31ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." } }, { "id": "CVE-2026-114501", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:cf688bca-5db7-5e44-ad07-edb083912ad8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114501 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." } }, { "id": "CVE-2026-25990", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:cb38a5e6-9c35-5dce-aea3-c20613c6ae8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25990 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-40192", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:7dea0740-84f4-59db-84de-c634230744c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40192 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:ba8ccbf4-f3ea-5628-a277-788ace616793", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42308 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-42309", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:f6d7f204-6179-58dc-8104-295cca3b7c80", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42309 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:f3f10cb2-0090-5d6c-8636-e00e1d07f5c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42310 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-42311", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:a1397660-4811-59ff-94ae-a2f306df4b25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42311 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:29f305f9-422b-5956-ab06-819228494cc4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:98aa1bb4-04c1-541d-9b3c-eb82da2d1520", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:6fa1cf5a-dd51-5c5f-b850-c71828780ef6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:1237ba97-6561-5f29-8738-a42964350c48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:52a8f186-a2a1-5607-b149-3edc65bc9a2c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55380 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:c40c64bc-acb9-577d-a756-3a92214d1d1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:712c573a-c76a-5b80-9861-0650b7f16b04", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59197 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:20ba07d6-c277-5d39-88c7-976c453aecc3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59198 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:b2b9ea83-e64a-5d7b-8b49-cf2e36ab0bc1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59199 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:3d4b8b2a-0bc7-5086-a7c0-ea43cc8adaae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59200 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:847867d0-31ad-5ae9-8562-76ab27e1a3d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59204 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:f45fdb64-97ac-5f61-b448-df0b2035b3d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59205 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:e0a53cf4-8cf6-58d3-9250-6e9e00cebbe1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:1b9ed90b-d51e-5c6b-88de-aec25cb8f1f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96637 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-96638", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:a26a2f23-af06-5f0c-926d-ac60440fa8d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96638 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." } }, { "id": "CVE-2026-96639", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:ed1a3a93-8766-5160-9fb6-5da847eeffca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96639 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:4f3a2fb4-9d84-5b4c-bfa7-ad05c4ae47b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96640 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:9b4b5e4b-aae6-5f8c-8249-339318baf195", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:7f3b3cc4-e46a-5e52-87a5-a840435988d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96642 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-96643", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:e8cd8032-de97-5104-99ca-d0bded00a107", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96643 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:0a000b6c-20b5-5dba-a3d1-b44fb6df1a88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96644 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-96778", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:2058efec-4d78-574f-adfa-fc8f78a62f87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96778 is fixed in version 11.3.0.post10+tuxcare of pillow." } }, { "id": "GHSA-78g4-xqwv-q3g8", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:bb577c32-ce11-55f0-9200-1a76feb30af9", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.3.0.post10+tuxcare of pillow. not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel...", "justification": "requires_dependency" } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } ] }