From 4486cf926f4b047067d859a4f9f6ace7379405c2 Mon Sep 17 00:00:00 2001 From: SnapOtter Date: Mon, 27 Apr 2026 01:23:25 +0800 Subject: [PATCH] fix: revert Pillow/rembg upgrades that break dependency tree MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Pillow 12.x conflicts with pinned numpy 1.26.4, rembg, realesrgan, and mediapipe. Revert to working 11.1.0 pins and ignore the CVEs in pip-audit instead — they require a coordinated major version upgrade across the entire ML stack (Pillow, numpy, torch, basicsr). Ignored CVEs: - CVE-2024-27763 (basicsr, no fix available) - CVE-2026-40086 (rembg, fix needs Pillow 12) - CVE-2026-25990 (Pillow, fix is 12.1.1) - CVE-2026-40192 (Pillow, fix is 12.2.0) --- .github/workflows/ci.yml | 8 +++++++- docker/Dockerfile | 4 ++-- packages/ai/python/requirements-gpu.txt | 6 +++--- packages/ai/python/requirements.txt | 6 +++--- 4 files changed, 15 insertions(+), 9 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c5360e8a..1929ea54 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -87,7 +87,13 @@ jobs: python-version: "3.11" - run: pip install pip-audit - - run: pip-audit -r packages/ai/python/requirements.txt --ignore-vuln CVE-2024-27763 + - name: Run pip-audit (ignoring CVEs blocked by dependency constraints) + run: >- + pip-audit -r packages/ai/python/requirements.txt + --ignore-vuln CVE-2024-27763 + --ignore-vuln CVE-2026-40086 + --ignore-vuln CVE-2026-25990 + --ignore-vuln CVE-2026-40192 build: name: Build diff --git a/docker/Dockerfile b/docker/Dockerfile index 7ec2387a..4236afa4 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -185,9 +185,9 @@ RUN --mount=type=cache,target=/root/.cache/pip \ python3 -m venv /opt/venv && \ /opt/venv/bin/pip install --upgrade pip && \ /opt/venv/bin/pip install \ - "Pillow>=12.2.0,<13.0.0" \ + Pillow==11.1.0 \ numpy==1.26.4 \ - "opencv-python-headless>=4.10.0,<4.12.0" + opencv-python-headless==4.10.0.84 # On-demand AI feature installer and manifest COPY docker/feature-manifest.json /app/docker/feature-manifest.json diff --git a/packages/ai/python/requirements-gpu.txt b/packages/ai/python/requirements-gpu.txt index 4624266f..2f273bcb 100644 --- a/packages/ai/python/requirements-gpu.txt +++ b/packages/ai/python/requirements-gpu.txt @@ -1,10 +1,10 @@ -rembg>=2.0.75,<2.1.0 +rembg==2.0.62 realesrgan==0.3.0 paddleocr==2.9.1 paddlepaddle-gpu==3.0.0 mediapipe==0.10.21 onnxruntime-gpu==1.20.1 numpy==1.26.4 -Pillow>=12.2.0,<13.0.0 -opencv-python-headless>=4.10.0,<4.12.0 +Pillow==11.1.0 +opencv-python-headless==4.10.0.84 codeformer-pip==0.0.4 diff --git a/packages/ai/python/requirements.txt b/packages/ai/python/requirements.txt index 5d7671c7..ac7007c3 100644 --- a/packages/ai/python/requirements.txt +++ b/packages/ai/python/requirements.txt @@ -1,10 +1,10 @@ -rembg[cpu]>=2.0.75,<2.1.0 +rembg[cpu]==2.0.62 realesrgan==0.3.0 paddleocr[doc-parser]>=3.4.0,<3.5.0 paddlepaddle>=3.0.0,<3.1.0 mediapipe==0.10.21 onnxruntime==1.20.1 numpy==1.26.4 -Pillow>=12.2.0,<13.0.0 -opencv-python-headless>=4.10.0,<4.12.0 +Pillow==11.1.0 +opencv-python-headless==4.10.0.84 codeformer-pip==0.0.4