bodnuti: [layerindex-web][PATCH 1/3] requirements.txt: fix djangorestframework and GitPython vulnerabilities base: 172552843211 fixes FIXED trivy requirements.txt GitPython 3.1.62: GitPython: GitPython: arbitrary code execution via improper submodule path validation (fixed in 3.2.1) (CVE-2026-114145) FIXED trivy requirements.txt Pillow 12.3.0: Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow ha ... (fixed in 13.0.0) (CVE-2026-112393) FIXED trivy requirements.txt Pillow 12.3.0: Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix ... (fixed in 13.0.0) (CVE-2026-112398) FIXED trivy requirements.txt Pillow 12.3.0: Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG dec ... (fixed in 13.0.0) (CVE-2026-112403) FIXED trivy requirements.txt Pillow 12.3.0: Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is ... (fixed in 13.0.0) (CVE-2026-112900) FIXED trivy requirements.txt Pillow 12.3.0: Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-fr ... (fixed in 13.0.0) (CVE-2026-96639) FIXED trivy requirements.txt Pillow 12.3.0: pillow: Pillow: Denial of Service via infinite loop during crafted MIC image parsing (fixed in 13.0.0) (CVE-2026-112390) FIXED trivy requirements.txt Pillow 12.3.0: pillow: pillow: Denial of Service via zero-size images in rank filters (fixed in 13.0.0) (CVE-2026-112392) FIXED trivy requirements.txt Pillow 12.3.0: pillow: pillow: Denial of Service via out-of-bounds memory access on zero-width images (fixed in 13.0.0) (CVE-2026-112397) FIXED trivy requirements.txt Pillow 12.3.0: pillow: pillow: Denial of service via crafted APNG image (fixed in 13.0.0) (CVE-2026-112399) FIXED trivy requirements.txt Pillow 12.3.0: pillow: pillow: Denial of Service via memory exhaustion from crafted GIF image (fixed in 13.0.0) (CVE-2026-112400) FIXED trivy requirements.txt Pillow 12.3.0: pillow: pillow: Denial of service via double free during image transformation (fixed in 13.0.0) (CVE-2026-112402) FIXED trivy requirements.txt Pillow 12.3.0: pillow: Pillow: Denial of Service via out-of-bounds read in TIFF decoding (fixed in 13.0.0) (CVE-2026-112404) FIXED trivy requirements.txt Pillow 12.3.0: pillow: Pillow: Denial of Service via null pointer dereference in Image.merge() (fixed in 13.0.0) (CVE-2026-112405) FIXED trivy requirements.txt Pillow 12.3.0: pillow: pillow: Denial of Service via infinite loop during PDF page rewriting (fixed in 13.0.0) (CVE-2026-112406) FIXED trivy requirements.txt Pillow 12.3.0: pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder (fixed in 13.0.0) (CVE-2026-112892) FIXED trivy requirements.txt Pillow 12.3.0: pillow: Pillow: Denial of Service via invalid pointer free during font rendering (fixed in 13.0.0) (CVE-2026-112893) FIXED trivy requirements.txt Pillow 12.3.0: pillow: pillow: Denial of Service via crafted multi-frame image conversion (fixed in 13.0.0) (CVE-2026-112894) FIXED trivy requirements.txt Pillow 12.3.0: pillow: pillow: Denial of service via crafted PDF during append operations (fixed in 13.0.0) (CVE-2026-112895) FIXED trivy requirements.txt Pillow 12.3.0: pillow: Pillow: Denial of Service via out-of-bounds read in TIFF encoder (fixed in 13.0.0) (CVE-2026-112896) FIXED trivy requirements.txt Pillow 12.3.0: pillow: pillow: Information disclosure via uninitialized buffer in TIFF decoding (fixed in 13.0.0) (CVE-2026-112897) FIXED trivy requirements.txt Pillow 12.3.0: Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags (fixed in 13.0.0) (CVE-2026-112902) FIXED trivy requirements.txt Pillow 12.3.0: pillow: pillow: Denial of Service via decompression bomb bypass in SPIDER images (fixed in 13.0.0) (CVE-2026-96637) FIXED trivy requirements.txt Pillow 12.3.0: pillow: pillow: Denial of Service via duplicate page references in PDF files (fixed in 13.0.0) (CVE-2026-96640) FIXED trivy requirements.txt Pillow 12.3.0: pillow: Pillow: Denial of Service via negative archive member size in TarIO (fixed in 13.0.0) (CVE-2026-96642) FIXED trivy requirements.txt Pillow 12.3.0: pillow: pillow: Denial of Service via repeated EXIF headers (fixed in 13.0.0) (CVE-2026-96643) FIXED trivy requirements.txt Pillow 12.3.0: pillow: Pillow: Denial of Service via out-of-bounds read in metafile parser (fixed in 13.0.0) (CVE-2026-96644) FIXED trivy requirements.txt Pillow 12.3.0: pillow: pillow: Arbitrary code execution via JPEG encoder buffer overflow (fixed in 13.0.0) (CVE-2026-96778) FIXED trivy requirements.txt Pillow 12.3.0: Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load() (fixed in 13.0.0) (GHSA-78g4-xqwv-q3g8) FIXED trivy requirements.txt Pillow 12.3.0: pillow: Pillow: Denial of Service via unbounded recursion in PDF parser (fixed in 13.0.0) (CVE-2026-112391) FIXED trivy requirements.txt Pillow 12.3.0: pillow: pillow: Information disclosure via out-of-bounds read in raw decoders (fixed in 13.0.0) (CVE-2026-112394) FIXED trivy requirements.txt Pillow 12.3.0: pillow: pillow: Information disclosure via crafted tiled TIFF image (fixed in 13.0.0) (CVE-2026-112395) FIXED trivy requirements.txt Pillow 12.3.0: pillow: pillow: arbitrary code execution via heap use-after-free during TIFF encoding (fixed in 13.0.0) (CVE-2026-112396) FIXED trivy requirements.txt Pillow 12.3.0: pillow: pillow: Denial of Service via crafted GIF comments (fixed in 13.0.0) (CVE-2026-112401) FIXED trivy requirements.txt Pillow 12.3.0: pillow: pillow: Denial of Service via large GIF comments (fixed in 13.0.0) (CVE-2026-112891) FIXED trivy requirements.txt Pillow 12.3.0: pillow: Pillow: Information disclosure via empty palette quantization (fixed in 13.0.0) (CVE-2026-112898) FIXED trivy requirements.txt Pillow 12.3.0: Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit (fixed in 13.0.0) (CVE-2026-112899) FIXED trivy requirements.txt Pillow 12.3.0: pillow: Pillow: Denial of Service via crafted XBM image header (fixed in 13.0.0) (CVE-2026-112901) FIXED trivy requirements.txt Pillow 12.3.0: pillow: Pillow: Information disclosure via improper memory alignment during Arrow export (fixed in 13.0.0) (CVE-2026-114501) FIXED trivy requirements.txt Pillow 12.3.0: pillow: pillow: Denial of Service via decompression bomb check bypass in multi-frame images (fixed in 13.0.0) (CVE-2026-96636) FIXED trivy requirements.txt Pillow 12.3.0: pillow: pillow: Denial of Service via crafted RLE BMP image (fixed in 13.0.0) (CVE-2026-96638) FIXED trivy requirements.txt Pillow 12.3.0: pillow: pillow: Denial of Service via integer overflow in text-width calculation (fixed in 13.0.0) (CVE-2026-96641) FIXED trivy requirements.txt djangorestframework 3.18.0: djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser (fixed in 3.18.2) (CVE-2026-114136) FIXED trivy requirements.txt djangorestframework 3.18.0: djangorestframework: djangorestframework: Unauthorized access via improper token revocation in TokenProxy (fixed in 3.18.2) (CVE-2026-114137) FIXED trivy requirements.txt djangorestframework 3.18.0: djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing (fixed in 3.18.2) (CVE-2026-114138) patchtest: 30 pass, 0 fail, 6 skip 0 findings: 0 errors, 0 warnings, 0 info