Update to 9.4.0 to fix security vulnerabilities

.appveyor.yml

@@ -10,9 +10,9 @@ environment:
   TEST_OPTIONS:
   DEPLOY: YES
   matrix:
-  - PYTHON: C:/Python310
+  - PYTHON: C:/Python311
     ARCHITECTURE: x86
-    APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2019
+    APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2022
   - PYTHON: C:/Python37-x64
     ARCHITECTURE: x64
     APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2017
@@ -25,8 +25,8 @@ install:
 - mv c:\pillow-depends-main c:\pillow-depends
 - xcopy /S /Y c:\pillow-depends\test_images\* c:\pillow\tests\images
 - 7z x ..\pillow-depends\nasm-2.15.05-win64.zip -oc:\
-- ..\pillow-depends\gs9550w32.exe /S
-- path c:\nasm-2.15.05;C:\Program Files (x86)\gs\gs9.55.0\bin;%PATH%
+- ..\pillow-depends\gs1000w32.exe /S
+- path c:\nasm-2.15.05;C:\Program Files (x86)\gs\gs10.0.0\bin;%PATH%
 - cd c:\pillow\winbuild\
 - ps: |
         c:\python37\python.exe c:\pillow\winbuild\build_prepare.py -v --depends=C:\pillow-depends\
@@ -43,7 +43,7 @@ build_script:
 
 test_script:
 - cd c:\pillow
-- '%PYTHON%\%EXECUTABLE% -m pip install pytest pytest-cov'
+- '%PYTHON%\%EXECUTABLE% -m pip install pytest pytest-cov pytest-timeout'
 - c:\"Program Files (x86)"\"Windows Kits"\10\Debuggers\x86\gflags.exe /p /enable %PYTHON%\%EXECUTABLE%
 - '%PYTHON%\%EXECUTABLE% -c "from PIL import Image"'
 - '%PYTHON%\%EXECUTABLE% -m pytest -vx --cov PIL --cov Tests --cov-report term --cov-report xml Tests'

.ci/after_success.sh

@@ -1,9 +1,9 @@
 #!/bin/bash
 
 # gather the coverage data
-pip3 install codecov
+python3 -m pip install codecov
 if [[ $MATRIX_DOCKER ]]; then
-  coverage xml --ignore-errors
+  python3 -m coverage xml --ignore-errors
 else
-  coverage xml
+  python3 -m coverage xml
 fi

.ci/build.sh

@@ -2,7 +2,7 @@
 
 set -e
 
-coverage erase
+python3 -m coverage erase
 if [ $(uname) == "Darwin" ]; then
     export CPPFLAGS="-I/usr/local/miniconda/include";
 fi

.ci/install.sh

@@ -13,13 +13,17 @@ aptget_update()
         return 1
     fi
 }
-aptget_update || aptget_update retry || aptget_update retry
+if [[ $(uname) != CYGWIN* ]]; then
+    aptget_update || aptget_update retry || aptget_update retry
+fi
 
 set -e
 
-sudo apt-get -qq install libfreetype6-dev liblcms2-dev python3-tk\
-                         ghostscript libffi-dev libjpeg-turbo-progs libopenjp2-7-dev\
-                         cmake imagemagick libharfbuzz-dev libfribidi-dev
+if [[ $(uname) != CYGWIN* ]]; then
+    sudo apt-get -qq install libfreetype6-dev liblcms2-dev python3-tk\
+                             ghostscript libffi-dev libjpeg-turbo-progs libopenjp2-7-dev\
+                             cmake meson imagemagick libharfbuzz-dev libfribidi-dev
+fi
 
 python3 -m pip install --upgrade pip
 python3 -m pip install --upgrade wheel
@@ -31,25 +35,27 @@ python3 -m pip install -U pytest
 python3 -m pip install -U pytest-cov
 python3 -m pip install -U pytest-timeout
 python3 -m pip install pyroma
-python3 -m pip install test-image-results
-python3 -m pip install numpy
-
-# PyQt5 doesn't support PyPy3
-if [[ $GHA_PYTHON_VERSION == 3.* ]]; then
-  # arm64, ppc64le, s390x CPUs:
-  # "ERROR: Could not find a version that satisfies the requirement pyqt5"
-    sudo apt-get -qq install libxcb-xinerama0 pyqt5-dev-tools
-    python3 -m pip install pyqt5
-fi
 
-# webp
-pushd depends && ./install_webp.sh && popd
+if [[ $(uname) != CYGWIN* ]]; then
+    python3 -m pip install numpy
 
-# libimagequant
-pushd depends && ./install_imagequant.sh && popd
+    # PyQt6 doesn't support PyPy3
+    if [[ $GHA_PYTHON_VERSION == 3.* ]]; then
+        sudo apt-get -qq install libegl1 libxcb-icccm4 libxcb-image0 libxcb-keysyms1 libxcb-randr0 libxcb-render-util0 libxcb-shape0 libxkbcommon-x11-0
+        python3 -m pip install pyqt6
+    fi
 
-# raqm
-pushd depends && ./install_raqm.sh && popd
+    # webp
+    pushd depends && ./install_webp.sh && popd
 
-# extra test images
-pushd depends && ./install_extra_test_images.sh && popd
+    # libimagequant
+    pushd depends && ./install_imagequant.sh && popd
+
+    # raqm
+    pushd depends && ./install_raqm.sh && popd
+
+    # extra test images
+    pushd depends && ./install_extra_test_images.sh && popd
+else
+    cd depends && ./install_extra_test_images.sh && cd ..
+fi

.editorconfig

@@ -13,10 +13,13 @@ indent_style = space
 
 trim_trailing_whitespace = true
 
+[*.rst]
+# Four-space indentation
+indent_size = 4
+
 [*.yml]
 # Two-space indentation
 indent_size = 2
-indent_style = space
 
 # Tab indentation (no size specified)
 [Makefile]

.github/CONTRIBUTING.md

@@ -4,7 +4,7 @@ Bug fixes, feature additions, tests, documentation and more can be contributed v
 
 ## Bug fixes, feature additions, etc.
 
-Please send a pull request to the `main` branch. Please include [documentation](https://pillow.readthedocs.io) and [tests](../Tests/README.rst) for new features. Tests or documentation without bug fixes or feature additions are welcome too. Feel free to ask questions [via issues](https://github.com/python-pillow/Pillow/issues/new), [Gitter](https://gitter.im/python-pillow/Pillow) or irc://irc.freenode.net#pil
+Please send a pull request to the `main` branch. Please include [documentation](https://pillow.readthedocs.io) and [tests](../Tests/README.rst) for new features. Tests or documentation without bug fixes or feature additions are welcome too. Feel free to ask questions [via issues](https://github.com/python-pillow/Pillow/issues/new), [discussions](https://github.com/python-pillow/Pillow/discussions/new), [Gitter](https://gitter.im/python-pillow/Pillow) or irc://irc.freenode.net#pil
 
 - Fork the Pillow repository.
 - Create a branch from `main`.

.github/mergify.yml

@@ -8,6 +8,7 @@ pull_request_rules:
       - status-success=Docker Test Successful
       - status-success=Windows Test Successful
       - status-success=MinGW Test Successful
+      - status-success=Cygwin Test Successful
       - status-success=continuous-integration/appveyor/pr
     actions:
       merge:

.github/renovate.json

@@ -0,0 +1,17 @@
+{
+    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+    "extends": [
+        "config:base"
+    ],
+    "labels": [
+        "Dependency"
+    ],
+    "packageRules": [
+        {
+            "groupName": "github-actions",
+            "matchManagers": ["github-actions"],
+            "separateMajorMinor": "false"
+        }
+    ],
+    "schedule": ["on the 3rd day of the month"]
+}

.github/workflows/cifuzz.yml

@@ -0,0 +1,56 @@
+name: CIFuzz
+
+on:
+  push:
+    paths:
+      - "**.c"
+      - "**.h"
+  pull_request:
+    paths:
+      - "**.c"
+      - "**.h"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency: 
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  Fuzzing:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Build Fuzzers
+      id: build
+      uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
+      with:
+        oss-fuzz-project-name: 'pillow'
+        language: python
+        dry-run: false
+    - name: Run Fuzzers
+      id: run
+      uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
+      with:
+        oss-fuzz-project-name: 'pillow'
+        fuzz-seconds: 600
+        language: python
+        dry-run: false
+    - name: Upload New Crash
+      uses: actions/upload-artifact@v3
+      if: failure() && steps.build.outcome == 'success'
+      with:
+        name: artifacts
+        path: ./out/artifacts
+    - name: Upload Legacy Crash
+      uses: actions/upload-artifact@v3
+      if: steps.run.outcome == 'success'
+      with:
+        name: crash
+        path: ./out/crash*
+    - name: Fail on legacy crash
+      if: success()
+      run: |
+        [ ! -e out/crash-* ]
+        echo No legacy crash detected

.github/workflows/lint.yml

@@ -2,6 +2,13 @@ name: Lint
 
 on: [push, pull_request, workflow_dispatch]
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
 
@@ -10,20 +17,20 @@ jobs:
     name: Lint
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
 
     - name: pre-commit cache
-      uses: actions/cache@v2
+      uses: actions/cache@v3
       with:
         path: ~/.cache/pre-commit
         key: lint-pre-commit-${{ hashFiles('**/.pre-commit-config.yaml') }}
         restore-keys: |
           lint-pre-commit-
 
     - name: Set up Python
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@v4
       with:
-        python-version: "3.10"
+        python-version: "3.x"
         cache: pip
         cache-dependency-path: "setup.py"
 

.github/workflows/macos-install.sh

@@ -2,7 +2,7 @@
 
 set -e
 
-brew install libtiff libjpeg openjpeg libimagequant webp little-cms2 freetype openblas libraqm
+brew install libtiff libjpeg openjpeg libimagequant webp little-cms2 freetype libraqm
 
 PYTHONOPTIMIZE=0 python3 -m pip install cffi
 python3 -m pip install coverage
@@ -12,9 +12,7 @@ python3 -m pip install -U pytest
 python3 -m pip install -U pytest-cov
 python3 -m pip install -U pytest-timeout
 python3 -m pip install pyroma
-python3 -m pip install test-image-results
 
-echo -e "[openblas]\nlibraries = openblas\nlibrary_dirs = /usr/local/opt/openblas/lib" >> ~/.numpy-site.cfg
 python3 -m pip install numpy
 
 # extra test images

.github/workflows/release-drafter.yml

@@ -7,8 +7,18 @@ on:
       - main
   workflow_dispatch:
 
+permissions:
+  contents: read
+
+concurrency: 
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   update_release_draft:
+    permissions:
+      contents: write  # for release-drafter/release-drafter to create a github release
+      pull-requests: write  # for release-drafter/release-drafter to add label to PR
     if: github.repository == 'python-pillow/Pillow'
     runs-on: ubuntu-latest
     steps:

.github/workflows/stale.yml

@@ -0,0 +1,31 @@
+name: Close stale issues
+
+on:
+  schedule:
+  - cron: "10 0 * * *"
+  workflow_dispatch:
+
+permissions:
+  issues: write
+
+concurrency: 
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  stale:
+    if: github.repository_owner == 'python-pillow'
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: "Check issues"
+      uses: actions/stale@v7
+      with:
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        only-labels: "Awaiting OP Action"
+        close-issue-message: "Closing this issue as no feedback has been received."
+        days-before-stale: 7
+        days-before-issue-close: 0
+        days-before-pr-close: -1
+        labels-to-remove-when-unstale: "Awaiting OP Action"