i6eal.de
DEEN
Start a project
← Back to the AI Dependency AtlasExact package identity dossier

pillow

pypi:pillow
pypi

This dossier links the stable identity pypi:pillow to 8 exact observed versions across 13 public repositories.

pypipypi:pillowecosystem:name + exact version + evidence path

A package identity or provider interface in published code does not prove configuration, an account, procurement, data transfer or an API call.

ecosystem:name + exact version + evidence path
13repositories
15exact evidence rows
8exact versions
2reported license expressions
15OSV records returned
Exact published evidence

Observed exact versions and registry metadata

Publication age and licenses come from deps.dev metadata. They are context—not a maintenance, legal or portability verdict.

Exact version10.3.001 Apr 2024
Repositories
1
Occurrences
1
Reported licenses
HPND
no verified publish attestation reported12 OSV records
Open exact source ↗
Exact version10.4.001 Jul 2024
Repositories
1
Occurrences
1
Reported licenses
HPND
no verified publish attestation reported12 OSV records
Open exact source ↗
Exact version11.1.002 Jan 2025
Repositories
1
Occurrences
1
Reported licenses
MIT-CMU
verified publish attestation12 OSV records
Open exact source ↗
Exact version11.2.112 Apr 2025
Repositories
4
Occurrences
5
Reported licenses
MIT-CMU
verified publish attestation14 OSV records
Open exact source ↗
Exact version11.3.001 Jul 2025
Repositories
3
Occurrences
3
Reported licenses
MIT-CMU
verified publish attestation13 OSV records
Open exact source ↗
Exact version12.0.015 Oct 2025
Repositories
1
Occurrences
1
Reported licenses
MIT-CMU
verified publish attestation14 OSV records
Open exact source ↗
Exact version12.1.002 Jan 2026
Repositories
1
Occurrences
1
Reported licenses
MIT-CMU
verified publish attestation14 OSV records
Open exact source ↗
Exact version12.1.111 Feb 2026
Repositories
2
Occurrences
2
Reported licenses
MIT-CMU
verified publish attestation13 OSV records
Open exact source ↗
Observed relations

Repositories carrying this identity

SmartPlanAI Anwendungsh/digitalhub-sh/landesprogramm-offene-innovationen/ki-bauleitplaene/smartplanai-anwendung
11.3.0 · 12.1.12 Occurrences
→
strahlenexpositionuba-ki-lab/strahlenexposition
11.2.12 Occurrences
→
Energieautarkes Wohnquartier - Backendenergieautarkes-wohnquartier/backend
11.2.11 Occurrence
→
AIiqsh/collaboration-online-board/ai
10.3.01 Occurrence
→
Coding Agent Usage Simulationuba-ki-lab/coding-agent-usage-simulation
12.0.01 Occurrence
→
density-mapsuba-ki-lab/density-maps
12.1.11 Occurrence
→
GSA Extractionuba-ki-lab/gsa-extraction
11.3.01 Occurrence
→
LLM Questionnaire Benchmarking Frameworkuba-ki-lab/llm-questionnaire-benchmarking-framework
11.3.01 Occurrence
→
LLM Testframeworkuba-ki-lab/llm-testframework
11.2.11 Occurrence
→
Objection managementuba-ki-lab/objection-management
11.1.01 Occurrence
→
photovoltaic_systemsuba-ki-lab/photovoltaic_systems
11.2.11 Occurrence
→
Ressource Efficient Computer Visionuba-ki-lab/ressource-efficient-computer-vision
12.1.01 Occurrence
→
Retrieval Evaluationuba-ki-lab/retrieval-evaluation
10.4.01 Occurrence
→
Exact published evidence

exact evidence rows

AIiqsh/collaboration-online-board/ai
pypi:pillow@10.3.0SPDX_v2.0.0.yml
declaration relationship not reporteddevelopment scope not reported
Open exact source ↗
Coding Agent Usage Simulationuba-ki-lab/coding-agent-usage-simulation
pypi:pillow@12.0.0uv.lock
declaration relationship not reporteddevelopment scope not reported
Open exact source ↗
density-mapsuba-ki-lab/density-maps
pypi:pillow@12.1.1uv.lock
declaration relationship not reporteddevelopment scope not reported
Open exact source ↗
Energieautarkes Wohnquartier - Backendenergieautarkes-wohnquartier/backend
pypi:pillow@11.2.1poetry.lock
declaration relationship not reportednot marked as development-only
Open exact source ↗
GSA Extractionuba-ki-lab/gsa-extraction
pypi:pillow@11.3.0uv.lock
declaration relationship not reporteddevelopment scope not reported
Open exact source ↗
LLM Questionnaire Benchmarking Frameworkuba-ki-lab/llm-questionnaire-benchmarking-framework
pypi:pillow@11.3.0uv.lock
declaration relationship not reporteddevelopment scope not reported
Open exact source ↗
LLM Testframeworkuba-ki-lab/llm-testframework
pypi:pillow@11.2.1uv.lock
declaration relationship not reporteddevelopment scope not reported
Open exact source ↗
Objection managementuba-ki-lab/objection-management
pypi:pillow@11.1.0uv.lock
declaration relationship not reporteddevelopment scope not reported
Open exact source ↗
photovoltaic_systemsuba-ki-lab/photovoltaic_systems
pypi:pillow@11.2.1sbom.json
declaration relationship not reporteddevelopment scope not reported
Open exact source ↗
Ressource Efficient Computer Visionuba-ki-lab/ressource-efficient-computer-vision
pypi:pillow@12.1.0uv.lock
declaration relationship not reporteddevelopment scope not reported
Open exact source ↗
Retrieval Evaluationuba-ki-lab/retrieval-evaluation
pypi:pillow@10.4.0uv.lock
declaration relationship not reporteddevelopment scope not reported
Open exact source ↗
SmartPlanAI Anwendungsh/digitalhub-sh/landesprogramm-offene-innovationen/ki-bauleitplaene/smartplanai-anwendung
pypi:pillow@11.3.0blp_streamlit_pipeline/src/ext/streamlit-draw-image-mask/poetry.lock
declaration relationship not reportednot marked as development-only
Open exact source ↗
SmartPlanAI Anwendungsh/digitalhub-sh/landesprogramm-offene-innovationen/ki-bauleitplaene/smartplanai-anwendung
pypi:pillow@12.1.1poetry.lock
declaration relationship not reportednot marked as development-only
Open exact source ↗
strahlenexpositionuba-ki-lab/strahlenexposition
pypi:pillow@11.2.1poetry.lock
declaration relationship not reportednot marked as development-only
Open exact source ↗
strahlenexpositionuba-ki-lab/strahlenexposition
pypi:pillow@11.2.1sbom.json
declaration relationship not reporteddevelopment scope not reported
Open exact source ↗
OSV

Related OSV records

GHSA-5xmw-vc9v-4wf2

Pillow has a heap buffer overflow with nested list coordinates

10 repositories13 Jul 2026
GHSA-cfh3-3jmp-rvhc

Pillow affected by out-of-bounds write when loading PSD images

12 repositories13 Jul 2026
GHSA-pwv6-vv43-88gr

Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)

13 repositories13 Jul 2026
→
GHSA-r73j-pqj5-w3x7

Pillow has a PDF Parsing Trailer Infinite Loop (DoS)

13 repositories13 Jul 2026
→
GHSA-whj4-6x5x-4v2j

FITS GZIP decompression bomb in Pillow

13 repositories13 Jul 2026
→
GHSA-wjx4-4jcj-g98j

Pillow has an integer overflow when processing fonts

13 repositories09 Jun 2026
→
GHSA-xg8h-j46f-w952

Pillow vulnerability can cause write buffer overflow on BCn encoding

4 repositories04 Feb 2026
PYSEC-2026-2253

Not reported

13 repositories13 Jul 2026
→
PYSEC-2026-2254

Not reported

13 repositories13 Jul 2026
→
PYSEC-2026-2255

Not reported

13 repositories13 Jul 2026
→
PYSEC-2026-2256

Not reported

13 repositories13 Jul 2026
→
PYSEC-2026-2257

Not reported

13 repositories13 Jul 2026
→
PYSEC-2026-3451

Not reported

13 repositories15 Jul 2026
→
PYSEC-2026-3452

Not reported

4 repositories15 Jul 2026
PYSEC-2026-3453

Not reported

13 repositories15 Jul 2026
→
Interpretation boundary

Exact identities in, explicit limits out

Only exact npm and PyPI tuples are enriched. Reported SPDX expressions are metadata; no compatibility, obligation or legal conclusion is inferred.

Retrieval, parsing, matching and publishing use no generative AI model.

i6eal (2026): pillow — exact AI dependency evidence dossier, data state 19 Jul 2026. https://i6eal.de/en/tools/ki-abhaengigkeitsatlas/paket/pillow-834347dd/

Reading this dossier

Does package presence prove that a provider is used?
No. Even a direct interface declaration does not establish configuration, credentials, procurement, data transfer or an API call.
Why are exact versions required?
OSV and registry metadata can be linked reproducibly only to an observed package@version tuple. The collector never substitutes a newest release for a range.
Does a missing row mean the dependency is absent?
No. It means not observed within the bounded files and repository checkpoint. Incomplete trees and parser failures remain explicit.

Need a permanent dependency evidence trail for another public code cohort?

We build source-backed data products with stable identities, reproducible joins and boundaries that remain visible.

Discuss a data projectExplore all tools
Related tools

Useful next steps

These tools complement the current result.

View all tools
MonitorGerman public-sector AI Code RadarWhich AI building blocks does German public administration publish as open code? Exact packages, containers, commit SHAs and file paths from openCode, with permanent dossiers and no deployment claim.MonitorGerman public-sector AI registerWhere does German public administration already use AI? Search published system profiles from federal, state and municipal bodies, with lifecycle, governance fields, stable identifiers and original evidence.Provenance checkPublic-sector AI system passportSee which public records can be linked to each published government AI system through stable identifiers or exact source-declared repository URLs—with a source for every edge and visible evidence boundaries.