External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: revert Pillow/rembg upgrades that break dependency tree

Browse Source 
Pillow 12.x conflicts with pinned numpy 1.26.4, rembg, realesrgan,
and mediapipe. Revert to working 11.1.0 pins and ignore the CVEs
in pip-audit instead — they require a coordinated major version
upgrade across the entire ML stack (Pillow, numpy, torch, basicsr).

Ignored CVEs:
- CVE-2024-27763 (basicsr, no fix available)
- CVE-2026-40086 (rembg, fix needs Pillow 12)
- CVE-2026-25990 (Pillow, fix is 12.1.1)
- CVE-2026-40192 (Pillow, fix is 12.2.0)
This commit is contained in:
SnapOtter
2026-04-27 01:23:25 +08:00
parent b926e5d1be
commit 4486cf926f
4 changed files with 15 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/ci.yml
+7 -1
View File
@@ -87,7 +87,13 @@ jobs:
python-version: "3.11" python-version: "3.11"
- run: pip install pip-audit - run: pip install pip-audit
- run: pip-audit -r packages/ai/python/requirements.txt --ignore-vuln CVE-2024-27763 - name: Run pip-audit (ignoring CVEs blocked by dependency constraints)
run: >-
pip-audit -r packages/ai/python/requirements.txt
--ignore-vuln CVE-2024-27763
--ignore-vuln CVE-2026-40086
--ignore-vuln CVE-2026-25990
--ignore-vuln CVE-2026-40192
build: build:
name: Build name: Build
docker/Dockerfile
+2 -2
View File
@@ -185,9 +185,9 @@ RUN --mount=type=cache,target=/root/.cache/pip \
python3 -m venv /opt/venv && \ python3 -m venv /opt/venv && \
/opt/venv/bin/pip install --upgrade pip && \ /opt/venv/bin/pip install --upgrade pip && \
/opt/venv/bin/pip install \ /opt/venv/bin/pip install \
"Pillow>=12.2.0,<13.0.0" \ Pillow==11.1.0 \
numpy==1.26.4 \ numpy==1.26.4 \
"opencv-python-headless>=4.10.0,<4.12.0" opencv-python-headless==4.10.0.84
# On-demand AI feature installer and manifest # On-demand AI feature installer and manifest
COPY docker/feature-manifest.json /app/docker/feature-manifest.json COPY docker/feature-manifest.json /app/docker/feature-manifest.json
packages/ai/python/requirements-gpu.txt
+3 -3
View File
@@ -1,10 +1,10 @@
rembg>=2.0.75,<2.1.0 rembg==2.0.62
realesrgan==0.3.0 realesrgan==0.3.0
paddleocr==2.9.1 paddleocr==2.9.1
paddlepaddle-gpu==3.0.0 paddlepaddle-gpu==3.0.0
mediapipe==0.10.21 mediapipe==0.10.21
onnxruntime-gpu==1.20.1 onnxruntime-gpu==1.20.1
numpy==1.26.4 numpy==1.26.4
Pillow>=12.2.0,<13.0.0 Pillow==11.1.0
opencv-python-headless>=4.10.0,<4.12.0 opencv-python-headless==4.10.0.84
codeformer-pip==0.0.4 codeformer-pip==0.0.4
packages/ai/python/requirements.txt
+3 -3
View File
@@ -1,10 +1,10 @@
rembg[cpu]>=2.0.75,<2.1.0 rembg[cpu]==2.0.62
realesrgan==0.3.0 realesrgan==0.3.0
paddleocr[doc-parser]>=3.4.0,<3.5.0 paddleocr[doc-parser]>=3.4.0,<3.5.0
paddlepaddle>=3.0.0,<3.1.0 paddlepaddle>=3.0.0,<3.1.0
mediapipe==0.10.21 mediapipe==0.10.21
onnxruntime==1.20.1 onnxruntime==1.20.1
numpy==1.26.4 numpy==1.26.4
Pillow>=12.2.0,<13.0.0 Pillow==11.1.0
opencv-python-headless>=4.10.0,<4.12.0 opencv-python-headless==4.10.0.84
codeformer-pip==0.0.4 codeformer-pip==0.0.4