Fix for GHSA-8v84-f9pq-wr9x - #216

Open

keycard-gh-workflows-access[bot] wants to merge 1 commit into

mainfrom

socket/fix/GHSA-8v84-f9pq-wr9x

Commits on Jul 23, 2026

fix: GHSA-8v84-f9pq-wr9x - Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading
github-actions[bot]
committed