{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:081541c6-9230-5260-b0f3-e348fd3ffa2d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "version": "11.3.0.post7+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@11.3.0", "type": "library", "version": "11.3.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:f91173b7-cd14-5e5f-a285-490ef1ecbf43", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112390 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:c49fd637-a8c7-5596-aada-e5095764ad3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:45932378-9884-5273-b35c-d0b568deea75", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112392 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:f0fb1b17-2795-54b2-8320-f234834190a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112393 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:f06da9b8-82b4-5bda-b1df-253aceb27976", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:f982dc50-9e80-5bb4-b341-10c9054806b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112395 is fixed in version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112396", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:0ad0b2c7-b145-53a1-a745-f8f7b9761925", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112396 affects version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:5f332b16-b090-5da2-b8aa-354453a01b77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112397 is fixed in version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:ec1f7f74-596b-50c4-bc4c-74533ebbbf68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:25b85898-785d-5c7e-8f9b-d09234e3fe2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112399 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112400", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:9dd7f1ed-46ea-5c8d-b242-d3c521434625", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112400 is fixed in version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:c9052f8e-10fe-5f98-85c8-bb86f22c6a5a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:6860ab15-b4e4-540c-b08b-014ebce794f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112402 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:4dce31cd-4e0c-5a07-bc9e-db486f805e96", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112403 is fixed in version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:ce73afd4-eb08-520e-8fa7-cf412653156c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112404 is fixed in version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:313fd490-53f5-5d3c-aadf-6ce09a547342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112406 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112891", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:b4f989e6-8fea-5a93-8b9c-d44de53ab81a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112891 affects version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:2c009b55-33fc-5772-9356-6772079bd340", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112892 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112893", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:efda4328-3ac7-55dc-96ac-c6cc5c435d24", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112893 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:24f9cd9a-d07c-550a-b61e-adbee1d6f068", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112894 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:0e1f52da-ba91-54fc-9c4e-e7b6beeb6049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112895 is fixed in version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:49223bdd-2ebd-50a5-9334-158120f10695", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112896 is fixed in version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:80e2d4b0-0820-5d0b-ad02-e2c1dc3b1c57", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112897 is fixed in version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112898", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:bd4b5479-11eb-5cbe-ad6e-e8cae0035efe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112898 affects version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:e20398c9-16f7-55b5-90ba-8d86d39a71fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112899 is fixed in version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:f32ba76e-8fb4-5e44-8f0d-b904f0f5b77e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112900 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:d5f306cc-a913-5778-ac06-3a59b68beb87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:609a77cb-1bad-5583-88e1-0ccaa0e39cf7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-114501", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:9875c0ff-3196-50f2-a5bf-110852a6a976", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114501 affects version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-25990", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:25808fa1-89a0-5229-89bf-37e4a4f08dbb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25990 is fixed in version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-40192", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:fd28cdf5-4432-5b1e-a66c-82549c1d610a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40192 is fixed in version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:cb5a6988-1b66-5156-86c8-5989cd62aa00", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42308 is fixed in version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-42309", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:ef095206-f5f0-55c7-8cbe-f5df768fb02c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42309 is fixed in version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:29c76bf2-227d-5ae0-a458-75f5363dd759", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42310 is fixed in version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-42311", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:4fca6a22-ed5d-5ebe-9fc9-4ed151079549", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42311 is fixed in version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:efaba373-b0be-52a0-a3d8-465bdf571387", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:0c23851e-8516-5faa-babf-9b6535cee983", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:0c443682-baed-517b-aa34-b447b8a28180", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:1e151409-1154-55f0-aee1-90c591770e18", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:ee7026b8-82a3-5568-bcf7-ccd735d22d95", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55380 is fixed in version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:6c9d6c56-b43d-5280-8bf5-c3cca823e7d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:ce8e01e8-6bad-5e1d-8c39-b3f42648e2f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59197 is fixed in version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:2c6191b2-9513-57ad-a3c5-1878741169b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59198 is fixed in version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:49dc8079-d234-5a7c-a819-3e7815f14424", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59199 is fixed in version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:94490c38-5d64-52cd-a07c-146e1e560826", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59200 is fixed in version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:80d0ba42-ea68-5486-8750-05a5aba4945f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59204 is fixed in version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:409292e7-e847-5639-a473-5ff95ba23bf8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59205 is fixed in version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:d8b01cc0-969e-58c8-a0ba-ad868a149895", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:f6f4b725-8789-536e-a777-1da1a7a9822e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96637 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." } }, { "id": "CVE-2026-96638", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:5595f4e0-1416-51c5-8f90-531d10b26877", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96638 affects version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-96639", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:f6de9e1d-832b-5ab2-a8f3-77708f4e7588", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96639 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:2b8ed1ba-cf9f-5182-90f9-9ab755061c10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96640 is fixed in version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:0600564a-6f74-5ad4-8ff1-01d9e362afea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 11.3.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:087f6eea-75a9-55d8-a782-192555dde012", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96642 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." } }, { "id": "CVE-2026-96643", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:b8361d10-0d4c-5e6d-8ada-6ada66bf10c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96643 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:b4cfbdae-eb50-54fe-8788-841189041c19", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96644 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." } }, { "id": "CVE-2026-96778", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:b0572a18-2be8-58bf-8a5e-28c7445d5e54", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96778 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." } }, { "id": "GHSA-78g4-xqwv-q3g8", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:09ebdb52-b7d7-52b0-8d46-f82547583c50", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.3.0.post7+tuxcare of pillow. not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel...", "justification": "requires_dependency" } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } ] }