Pin build & runtime deps for reproducible, CVE-clean releases - #8
Merged
Conversation
Issue #5 shipped a broken Linux build because the unpinned PyInstaller version installed at release time did not bundle PIL._tkinter_finder. Pin the toolchain so a release can no longer silently regress on version drift, and lock runtime deps to audited, vulnerability-free versions. - pyinstaller==6.21.0 (CI build jobs + build_exe.bat) - pillow==12.2.0 (pillow<12.2.0 has 12 known CVEs, incl. ImageMath.eval RCE CVE-2023-50447 and libwebp heap overflow CVE-2023-4863) - python-dateutil==2.9.0.post0, ttkbootstrap==1.20.3 All verified clean with pip-audit (OSV / PyPI advisory DB).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Issue #5 shipped a broken Linux build purely because of version drift: CI ran unpinned
pip install pyinstaller, and the version it happened to grab at release time did not bundlePIL._tkinter_finder. Pinning the toolchain makes that class of "worked yesterday, broken today" failure impossible.CVE audit (pip-audit, OSV / PyPI advisory DB)
requirements.txtfloors were not:pillow>=9.0.0allows 12 known CVEs, including:CVE-2023-50447/CVE-2022-22817—ImageMath.evalarbitrary code executionCVE-2023-4863— libwebp heap buffer overflowCVE-2024-28219— buffer overflow in_imagingcmspython-dateutilandttkbootstrapfloors were clean (pinned for reproducibility only).Changes
pyinstaller==6.21.0— CI build jobs +build_exe.bat(the Binary does not run on Linux #5 root-cause guard).pillow==12.2.0— clears all 12 CVEs above.python-dateutil==2.9.0.post0,ttkbootstrap==1.20.3.These are the exact versions that built the verified-working v4.2 artifacts, so the build output is unchanged — this only locks it.
Follow-up suggestion
Enable Dependabot (pip + github-actions) so these pins get automated update PRs instead of silently aging.