Skip to content

fix: bump Pillow to 12.3.0 in osworld_agent - #2751

Merged
kajalj22 merged 3 commits into
mainfrom
kajalj/fix-pillow-cve-osworld-agent
Aug 25, 2026
Merged

fix: bump Pillow to 12.3.0 in osworld_agent#2751
kajalj22 merged 3 commits into
mainfrom
kajalj/fix-pillow-cve-osworld-agent

Conversation

@kajalj22

@kajalj22 kajalj22 commented Aug 25, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Bump Pillow from ~=11.0.0 to ==12.3.0 in responses_api_agents/osworld_agent/requirements.txt, matching the pin already used across every other agent/resource server in the repo.
  • osworld==0.1.0 transitively pins pillow>=11.0.0,<11.1.dev0, which made the plain version bump unresolvable. Added an overrides.txt entry to bypass that stale pin, following the same pattern used in stirrup_agent.

Test plan

  • uv pip install -r requirements.txt --override overrides.txt resolves cleanly and installs pillow==12.3.0 (verified locally)
  • uv lock --check passes (unaffected — this server sits outside the uv workspace)
  • CI passes

Pillow was pinned to ~=11.0.0 in osworld_agent while every other
agent/resource server in the repo already pins ==12.3.0.

Signed-off-by: Kajal Jain <kajalj@nvidia.com>
@copy-pr-bot

copy-pr-bot Bot commented Aug 25, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

osworld==0.1.0 pins pillow>=11.0.0,<11.1.dev0, making the plain
requirements.txt bump unsatisfiable. Add an overrides.txt entry to
bypass the stale transitive pin, matching the pattern used elsewhere
in the repo (e.g. stirrup_agent).

Signed-off-by: Kajal Jain <kajalj@nvidia.com>
@kajalj22

Copy link
Copy Markdown
Contributor Author

/ok to test e25f13e

@kajalj22

Copy link
Copy Markdown
Contributor Author

/ok to test 641136f

@kajalj22
kajalj22 merged commit 286ea94 into main Aug 25, 2026
30 checks passed
@kajalj22
kajalj22 deleted the kajalj/fix-pillow-cve-osworld-agent branch August 25, 2026 22:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants