• Raise FileNotFoundError if show_file() path does not exist #8178 [radarhere]

• Improved reading 16-bit TGA images with colour #7965 [Yay295, radarhere]

• Deprecate non-image ImageCms modes #8031 [radarhere]

• Fixed processing multiple JPEG EXIF markers #8127 [radarhere]

• Do not preserve EXIFIFD tag by default when saving TIFF images #8110 [radarhere]

• Added ImageFont.load_default_imagefont() #8086 [radarhere]

• Added Image.WARN_POSSIBLE_FORMATS #8063 [radarhere]

• Remove zero-byte end padding when parsing any XMP data #8171 [radarhere]

• Do not detect Ultra HDR images as MPO #8056 [radarhere]

• Raise SyntaxError specific to JP2 #8146 [Yay295, radarhere]

• Do not use first frame duration for other frames when saving APNG images #8104 [radarhere]

• Consider I;16 pixel size when using a 1 mode mask #8112 [radarhere]

• When saving multiple PNG frames, convert to mode rather than raw mode #8087 [radarhere]

• Added byte support to FreeTypeFont #8141 [radarhere]

• Allow float center for rotate operations #8114 [radarhere]

• Do not read layers immediately when opening PSD images #8039 [radarhere]

• Restore original thread state #8065 [radarhere]

• Read IM and TIFF images as RGB, rather than RGBX #7997 [radarhere]

• Only preserve TIFF IPTC_NAA_CHUNK tag if type is BYTE or UNDEFINED #7948 [radarhere]

• Clarify ImageDraw2 error message when size is missing #8165 [radarhere]

• Support unpacking more rawmodes to RGBA palettes #7966 [radarhere]

• Removed support for Qt 5 #8159 [radarhere]

• Improve ImageFont.freetype support for XDG directories on Linux #8135 [mamg22, radarhere]

• Improved consistency of XMP handling #8069 [radarhere]

• Use pkg-config to help find libwebp and raqm #8142 [radarhere]

• Accept 't' suffix for libtiff version #8126, #8129 [radarhere]

• Deprecate ImageDraw.getdraw hints parameter #8124 [radarhere, hugovk]

• Added ImageDraw circle() #8085 [void4, hugovk, radarhere]

• Add mypy target to Makefile #8077 [Yay295]

• Added more modes to Image.MODES #7984 [radarhere]

• Deprecate BGR;15, BGR;16 and BGR;24 modes #7978 [radarhere, hugovk]

• Fix ImagingAccess for I;16N on big-endian #7921 [Yay295, radarhere]

• Support reading P mode TIFF images with padding #7996 [radarhere]

• Deprecate support for libtiff < 4 #7998 [radarhere, hugovk]

• Corrected ImageShow UnixViewer command #7987 [radarhere]

• Use functools.cached_property in ImageStat #7952 [nulano, hugovk, radarhere]

• Add support for reading BITMAPV2INFOHEADER and BITMAPV3INFOHEADER #7956 [Cirras, radarhere]

• Support reading CMYK JPEG2000 images #7947 [radarhere]

10.4.0

Compare

Choose a tag to compare

10.4.0

Security

ImageShow.WindowsViewer.show_file

If an attacker has control over the path passed to ImageShow.WindowsViewer.show_file(), they may be able to execute arbitrary shell commands.

To prevent this, a FileNotFoundError will be raised if the path does not exist as a file. To provide a consistent experience, the error has been added to all ~PIL.ImageShow viewers.

Deprecations

BGR;15, BGR;16 and BGR;24

The experimental BGR;15, BGR;16 and BGR;24 modes have been deprecated.

Non-image modes in ImageCms

The use in .ImageCms of input modes and output modes that are not Pillow image modes has been deprecated. Defaulting to "L" or "1" if the mode cannot be mapped is also deprecated.

Support for LibTIFF earlier than 4

Support for LibTIFF earlier than version 4 has been deprecated. Upgrade to a newer version of LibTIFF instead.

ImageDraw.getdraw hints parameter

The hints parameter in ~PIL.ImageDraw.getdraw() has been deprecated.

API additions

ImageDraw.circle

Added ~PIL.ImageDraw.ImageDraw.circle. It provides the same functionality as ~PIL.ImageDraw.ImageDraw.ellipse, but instead of taking a bounding box, it takes a center point and radius.

Other changes

Python 3.13 beta

To help others prepare for Python 3.13, wheels have been built against the 3.13 beta as a preview. This is not official support for Python 3.13, but simply an opportunity for users to test how Pillow works with the beta and report any problems.

• CVE-2024-28219: Use strncpy to avoid buffer overflow #7928 [radarhere, hugovk]

• Deprecate eval(), replacing it with lambda_eval() and unsafe_eval() #7927 [radarhere, hugovk]

• Raise ValueError if seeking to greater than offset-sized integer in TIFF #7883 [radarhere]

• Add --report argument to __main__.py to omit supported formats #7818 [nulano, radarhere, hugovk]

• Added RGB to I;16, I;16L, I;16B and I;16N conversion #7918, #7920 [radarhere]

• Fix editable installation with custom build backend and configuration options #7658 [nulano, radarhere]

• Fix putdata() for I;16N on big-endian #7209 [Yay295, hugovk, radarhere]

• Determine MPO size from markers, not EXIF data #7884 [radarhere]

• Improved conversion from RGB to RGBa, LA and La #7888 [radarhere]

• Support FITS images with GZIP_1 compression #7894 [radarhere]

• Use I;16 mode for 9-bit JPEG 2000 images #7900 [scaramallion, radarhere]

• Raise ValueError if kmeans is negative #7891 [radarhere]

• Remove TIFF tag OSUBFILETYPE when saving using libtiff #7893 [radarhere]

• Raise ValueError for negative values when loading P1-P3 PPM images #7882 [radarhere]

• Added reading of JPEG2000 palettes #7870 [radarhere]

• Added alpha_quality argument when saving WebP images #7872 [radarhere]

• Fixed joined corners for ImageDraw rounded_rectangle() non-integer dimensions #7881 [radarhere]

• Stop reading EPS image at EOF marker #7753 [radarhere]

• PSD layer co-ordinates may be negative #7706 [radarhere]

• Use subprocess with CREATE_NO_WINDOW flag in ImageShow WindowsViewer #7791 [radarhere]

• When saving GIF frame that restores to background color, do not fill identical pixels #7788 [radarhere]

• Fixed reading PNG iCCP compression method #7823 [radarhere]

• Allow writing IFDRational to UNDEFINED tag #7840 [radarhere]

• Fix logged tag name when loading Exif data #7842 [radarhere]

• Use maximum frame size in IHDR chunk when saving APNG images #7821 [radarhere]

• Prevent opening P TGA images without a palette #7797 [radarhere]

• Use palette when loading ICO images #7798 [radarhere]

• Use consistent arguments for load_read and load_seek #7713 [radarhere]

• Turn off nullability warnings for macOS SDK #7827 [radarhere]

• Fix shift-sign issue in Convert.c #7838 [r-barnes, radarhere]

• Open 16-bit grayscale PNGs as I;16 #7849 [radarhere]

• Handle truncated chunks at the end of PNG images #7709 [lajiyuan, radarhere]

• Match mask size to pasted image size in GifImagePlugin #7779 [radarhere]

• Release GIL while calling WebPAnimDecoderGetNext #7782 [evanmiller, radarhere]

• Fixed reading FLI/FLC images with a prefix chunk #7804 [twolife]

• Update wl-paste handling and return None for some errors in grabclipboard() on Linux #7745 [nik012003, radarhere]

• Remove execute bit from setup.py #7760 [hugovk]

• Do not support using test-image-results to upload images after test failures #7739 [radarhere]

• Changed ImageMath.ops to be static #7721 [radarhere]

• Fix APNG info after seeking backwards more than twice #7701 [esoma, radarhere]

• Deprecate ImageCms constants and versions() function #7702 [nulano, radarhere]

• Added PerspectiveTransform #7699 [radarhere]

• Add support for reading and writing grayscale PFM images #7696 [nulano, hugovk]

• Add LCMS2 flags to ImageCms #7676 [nulano, radarhere, hugovk]

• Rename x64 to AMD64 in winbuild #7693 [nulano]

10.3.0

Security

ImageMath eval()

!DANGER!

ImageMath.eval() uses Python's eval() function to process the expression string, and carries the security risks of doing so. A direct replacement for this is the new ~PIL.ImageMath.unsafe_eval, but that carries the same risks. It is not recommended to process expressions without considering this. ~PIL.ImageMath.lambda_eval is a more secure alternative.

2024-28219: Fix buffer overflow in _imagingcms.c

In _imagingcms.c, two strcpy calls were able to copy too much data into fixed length strings. This has been fixed by using strncpy instead.

Deprecations

ImageCms constants and versions() function

A number of constants and a function in .ImageCms have been deprecated. This includes a table of flags based on LittleCMS version 1 which has been replaced with a new class .ImageCms.Flags based on LittleCMS 2 flags.

Deprecated	Use instead
ImageCms.DESCRIPTION	No replacement
ImageCms.VERSION	PIL.__version__
ImageCms.FLAGS["MATRIXINPUT"]	.ImageCms.Flags.CLUT_POST_LINEARIZATION
ImageCms.FLAGS["MATRIXOUTPUT"]	.ImageCms.Flags.FORCE_CLUT
ImageCms.FLAGS["MATRIXONLY"]	No replacement
ImageCms.FLAGS["NOWHITEONWHITEFIXUP"]	.ImageCms.Flags.NOWHITEONWHITEFIXUP
ImageCms.FLAGS["NOPRELINEARIZATION"]	.ImageCms.Flags.CLUT_PRE_LINEARIZATION
ImageCms.FLAGS["GUESSDEVICECLASS"]	.ImageCms.Flags.GUESSDEVICECLASS
ImageCms.FLAGS["NOTCACHE"]	.ImageCms.Flags.NOCACHE
ImageCms.FLAGS["NOTPRECALC"]	.ImageCms.Flags.NOOPTIMIZE
ImageCms.FLAGS["NULLTRANSFORM"]	.ImageCms.Flags.NULLTRANSFORM
ImageCms.FLAGS["HIGHRESPRECALC"]	.ImageCms.Flags.HIGHRESPRECALC
ImageCms.FLAGS["LOWRESPRECALC"]	.ImageCms.Flags.LOWRESPRECALC
ImageCms.FLAGS["GAMUTCHECK"]	.ImageCms.Flags.GAMUTCHECK
ImageCms.FLAGS["WHITEBLACKCOMPENSATION"]	.ImageCms.Flags.BLACKPOINTCOMPENSATION
ImageCms.FLAGS["BLACKPOINTCOMPENSATION"]	.ImageCms.Flags.BLACKPOINTCOMPENSATION
ImageCms.FLAGS["SOFTPROOFING"]	.ImageCms.Flags.SOFTPROOFING
ImageCms.FLAGS["PRESERVEBLACK"]	.ImageCms.Flags.NONEGATIVES
ImageCms.FLAGS["NODEFAULTRESOURCEDEF"]	.ImageCms.Flags.NODEFAULTRESOURCEDEF
ImageCms.FLAGS["GRIDPOINTS"]	.ImageCms.Flags.GRIDPOINTS()
ImageCms.versions()	PIL.features.version_module with feature="littlecms2", sys.version or sys.version_info, and PIL.__version__

ImageMath.eval()

ImageMath.eval() has been deprecated. Use ~PIL.ImageMath.lambda_eval or ~PIL.ImageMath.unsafe_eval instead. See earlier security notes for more information.

API changes

Added alpha_quality argument when saving WebP images

When saving WebP images, an alpha_quality argument can be passed to the encoder. It is an integer value between 0 to 100, where values other than 100 will provide lossy compression.

Negative kmeans error

When calling ~PIL.Image.Image.quantize, a negative kmeans will now raise a ValueError, unless a palette is supplied to make the value redundant.

Negative P1-P3 PPM value error

If a P1-P3 PPM image contains a negative value, a ValueError will now be raised.

API additions

Added PerspectiveTransform

~PIL.ImageTransform.PerspectiveTransform has been added, meaning that all of the ~PIL.Image.Transform values now have a corresponding subclass of ~PIL.ImageTransform.Transform.

Other changes

Portable FloatMap (PFM) images

Support has been added for reading and writing grayscale (Pf format) Portable FloatMap (PFM) files containing F data.

Release GIL when fetching WebP frames

Python's Global Interpreter Lock is now released when fetching WebP frames from the libwebp decoder.

Type hints

Pillow now has type hints for a large part of its modules, and the package includes a py.typed file and the Typing :: Typed Trove classifier.

• Add keep_rgb option when saving JPEG to prevent conversion of RGB colorspace #7553 [bgilbert, radarhere]

• Trim glyph size in ImageFont.getmask() #7669, #7672 [radarhere, nulano]

• Deprecate IptcImagePlugin helpers #7664 [nulano, hugovk, radarhere]

• Allow uncompressed TIFF images to be saved in chunks #7650 [radarhere]

• Concatenate multiple JPEG EXIF markers #7496 [radarhere]

• Changed IPTC tile tuple to match other plugins #7661 [radarhere]

• Do not assign new fp attribute when exiting context manager #7566 [radarhere]

• Support arbitrary masks for uncompressed RGB DDS images #7589 [radarhere, akx]

• Support setting ROWSPERSTRIP tag #7654 [radarhere]

• Apply ImageFont.MAX_STRING_LENGTH to ImageFont.getmask() #7662 [radarhere]

• Optimise ImageColor using functools.lru_cache #7657 [hugovk]

• Restricted environment keys for ImageMath.eval() #7655 [wiredfool, radarhere]

• Optimise ImageMode.getmode using functools.lru_cache #7641 [hugovk, radarhere]

• Fix incorrect color blending for overlapping glyphs #7497 [ZachNagengast, nulano, radarhere]

• Attempt memory mapping when tile args is a string #7565 [radarhere]

• Fill identical pixels with transparency in subsequent frames when saving GIF #7568 [radarhere]

• Corrected duration when combining multiple GIF frames into single frame #7521 [radarhere]

• Handle disposing GIF background from outside palette #7515 [radarhere]

• Seek past the data when skipping a PSD layer #7483 [radarhere]

• Import plugins relative to the module #7576 [deliangyang, jaxx0n]

• Translate encoder error codes to strings; deprecate ImageFile.raise_oserror() #7609 [bgilbert, radarhere]

• Support reading BC4U and DX10 BC1 images #6486 [REDxEYE, radarhere, hugovk]

• Optimize ImageStat.Stat.extrema #7593 [florath, radarhere]

• Handle pathlib.Path in FreeTypeFont #7578 [radarhere, hugovk, nulano]

• Added support for reading DX10 BC4 DDS images #7603 [sambvfx, radarhere]

• Optimized ImageStat.Stat.count #7599 [florath]

• Correct PDF palette size when saving #7555 [radarhere]

• Fixed closing file pointer with olefile 0.47 #7594 [radarhere]

• Raise ValueError when TrueType font size is not greater than zero #7584, #7587 [akx, radarhere]

• If absent, do not try to close fp when closing image #7557 [RaphaelVRossi, radarhere]

• Allow configuring JPEG restart marker interval on save #7488 [bgilbert, radarhere]

• Decrement reference count for PyObject #7549 [radarhere]

• Implement streamtype=1 option for tables-only JPEG encoding #7491 [bgilbert, radarhere]

• If save_all PNG only has one frame, do not create animated image #7522 [radarhere]

• Fixed frombytes() for images with a zero dimension #7493 [radarhere]

10.2.0

Security

ImageFont.getmask: Applied ImageFont.MAX_STRING_LENGTH

To protect against potential DOS attacks when using arbitrary strings as text input, Pillow will now raise a ValueError if the number of characters passed into PIL.ImageFont.ImageFont.getmask is over a certain limit, PIL.ImageFont.MAX_STRING_LENGTH.

This threshold can be changed by setting PIL.ImageFont.MAX_STRING_LENGTH. It can be disabled by setting ImageFont.MAX_STRING_LENGTH = None.

A decompression bomb check has also been added to PIL.ImageFont.ImageFont.getmask.

ImageFont.getmask: Trim glyph size

To protect against potential DOS attacks when using PIL fonts, PIL.ImageFont.ImageFont now trims the size of individual glyphs so that they do not extend beyond the bitmap image.

2023-50447: ImageMath.eval: Restricted environment keys

If an attacker has control over the keys passed to the environment argument of !PIL.ImageMath.eval, they may be able to execute arbitrary code. To prevent this, keys matching the names of builtins and keys containing double underscores will now raise a ValueError.

Deprecations

ImageFile.raise_oserror

ImageFile.raise_oserror() has been deprecated and will be removed in Pillow 12.0.0 (2025-10-15). The function is undocumented and is only useful for translating error codes returned by a codec's decode() method, which ImageFile already does automatically.

IptcImageFile helper functions

The functions IptcImageFile.dump and IptcImageFile.i, and the constant IptcImageFile.PAD have been deprecated and will be removed in Pillow 12.0.0 (2025-10-15). These are undocumented helper functions intended for internal use, so there is no replacement. They can each be replaced by a single line of code using builtin functions in Python.

API changes

Zero or negative font size error

When creating a ~PIL.ImageFont.FreeTypeFont instance, either directly or through ~PIL.ImageFont.truetype, if the font size is zero or less, a ValueError will now be raised.

API additions

Added DdsImagePlugin enums

~PIL.DdsImagePlugin.DDSD, ~PIL.DdsImagePlugin.DDSCAPS, ~PIL.DdsImagePlugin.DDSCAPS2, ~PIL.DdsImagePlugin.DDPF, ~PIL.DdsImagePlugin.DXGI_FORMAT and ~PIL.DdsImagePlugin.D3DFMT enums have been added to PIL.DdsImagePlugin.

JPEG RGB color space

When saving JPEG files, keep_rgb can now be set to True. This will store RGB images in the RGB color space instead of being converted to YCbCr automatically by libjpeg. When this option is enabled, attempting to chroma-subsample RGB images with the subsampling option will raise an OSError.

JPEG restart marker interval

When saving JPEG files, restart_marker_blocks and restart_marker_rows can now be used to emit restart markers whenever the specified number of MCU blocks or rows have been produced.

JPEG tables-only streamtype

When saving JPEG files, streamtype can now be set to 1, for tables-only. This will output only the quantization and Huffman tables for the image.

Other changes

Added DDS BC4U and DX10 BC1 and BC4 reading

Support has been added to read the BC4U format of DDS images.

Support has also been added to read DX10 BC1 and BC4, whether UNORM or TYPELESS.

Support arbitrary masks for uncompressed RGB DDS images

All masks are now supported when reading DDS images with uncompressed RGB data, allowing for bit counts other than 24 and 32.

Saving TIFF tag RowsPerStrip

When saving TIFF images, the TIFF tag RowsPerStrip can now be one of the tags set by the user, rather than always being calculated by Pillow.

Optimized ImageColor.getrgb and getcolor

The color calculations of ~PIL.ImageColor.getrgb and ~PIL.ImageColor.getcolor are now cached using functools.lru_cache. Cached calls of getrgb are 3.1 - 91.4 times as fast and getcolor are 5.1 - 19.6 times as fast.

Optimized ImageMode.getmode

The lookups made by ~PIL.ImageMode.getmode are now cached using functools.lru_cache instead of a custom cache. Cached calls are 1.2 times as fast.

Optimized ImageStat.Stat count and extrema

Calculating the ~PIL.ImageStat.Stat.count and ~PIL.ImageStat.Stat.extrema statistics is now faster. After the histogram is created in st = ImageStat.Stat(im), st.count is 3 times as fast on average and st.extrema is 12 times as fast on average.

Encoder errors now report error detail as string

OSError exceptions from image encoders now include a textual description of the error instead of a numeric error code.

Type hints

Work has begun to add type annotations to Pillow, including:

• ~PIL.ContainerIO

• ~PIL.FontFile, ~PIL.BdfFontFile and ~PIL.PcfFontFile

• ~PIL.ImageChops

• ~PIL.ImageMode

• ~PIL.ImageSequence

• ~PIL.ImageTransform

• ~PIL.TarIO

• Added TrueType default font to allow for different sizes #7354 [radarhere]

• Fixed invalid argument warning #7442 [radarhere]

• Added ImageOps cover method #7412 [radarhere, hugovk]

• Catch struct.error from truncated EXIF when reading JPEG DPI #7458 [radarhere]

• Consider default image when selecting mode for PNG save_all #7437 [radarhere]

• Support BGR;15, BGR;16 and BGR;24 access, unpacking and putdata #7303 [radarhere]

• Added CMYK to RGB unpacker #7310 [radarhere]

• Improved flexibility of XMP parsing #7274 [radarhere]

• Support reading 8-bit YCbCr TIFF images #7415 [radarhere]

• Allow saving I;16B images as PNG #7302 [radarhere]

• Corrected drawing I;16 points and writing I;16 text #7257 [radarhere]

• Set blue channel to 128 for BC5S #7413 [radarhere]

• Increase flexibility when reading IPTC fields #7319 [radarhere]

• Set C palette to be empty by default #7289 [radarhere]

• Added gs_binary to control Ghostscript use on all platforms #7392 [radarhere]

• Read bounding box information from the trailer of EPS files if specified #7382 [nopperl, radarhere]

• Added reading 8-bit color DDS images #7426 [radarhere]

• Added has_transparency_data #7420 [radarhere, hugovk]

• Fixed bug when reading BC5S DDS images #7401 [radarhere]

• Prevent TIFF orientation from being applied more than once #7383 [radarhere]

• Use previous pixel alpha for QOI_OP_RGB #7357 [radarhere]

• Added BC5U reading #7358 [radarhere]

• Allow getpixel() to accept a list #7355 [radarhere, homm]

• Allow GaussianBlur and BoxBlur to accept a sequence of x and y radii #7336 [radarhere]

• Expand JPEG buffer size when saving optimized or progressive #7345 [radarhere]

• Added session type check for Linux in ImageGrab.grabclipboard() #7332 [TheNooB2706, radarhere, hugovk]

• Allow "loop=None" when saving GIF images #7329 [radarhere]

• Fixed transparency when saving P mode images to PDF #7323 [radarhere]

• Added saving LA images as PDFs #7299 [radarhere]

• Set SMaskInData to 1 for PDFs with alpha #7316, #7317 [radarhere]

• Changed Image mode property to be read-only by default #7307 [radarhere]

• Silence exceptions in _repr_jpeg_ and _repr_png_ #7266 [mtreinish, radarhere]

• Do not use transparency when saving GIF if it has been removed when normalizing mode #7284 [radarhere]

• Fix missing symbols when libtiff depends on libjpeg #7270 [heitbaum]

10.1.0

API changes

Setting image mode

If you attempt to set the mode of an image directly, e.g. im.mode = "RGBA", you will now receive an AttributeError. This is not about removing existing functionality, but instead about raising an explicit error to prevent later consequences. The convert method is the correct way to change an image's mode.

Accept a list in getpixel()

~PIL.Image.Image.getpixel now accepts a list of coordinates, as well as a tuple.

from PIL import Image
im = Image.new("RGB", (1, 1))
im.getpixel((0, 0))
im.getpixel([0, 0])

BoxBlur and GaussianBlur allow for different x and y radii

~PIL.ImageFilter.BoxBlur and ~PIL.ImageFilter.GaussianBlur now allow a sequence of x and y radii to be specified, rather than a single number for both dimensions.

from PIL import ImageFilter
ImageFilter.BoxBlur((2, 5))
ImageFilter.GaussianBlur((2, 5))

API additions

EpsImagePlugin.gs_binary

EpsImagePlugin.gs_windows_binary stores the name of the Ghostscript executable on Windows. EpsImagePlugin.gs_binary has now been added for all platforms, and can be used to customise the name of the executable, or disable use entirely through EpsImagePlugin.gs_binary = False.

has_transparency_data

Images now have ~PIL.Image.Image.has_transparency_data to indicate whether the image has transparency data, whether in the form of an alpha channel, a palette with an alpha channel, or a "transparency" key in the ~PIL.Image.Image.info dictionary.

Even if this attribute is true, the image might still appear solid, if all of the values shown within are opaque.

ImageOps.cover

Returns a resized version of the image, so that the requested size is covered, while maintaining the original aspect ratio.

See relative-resize for a comparison between this and similar ImageOps methods.

size and font_size arguments when using default font

Pillow has had a "better than nothing" default font, which can only be drawn at one font size. Now, if FreeType support is available, a version of Aileron Regular is loaded, which can be drawn at chosen font sizes.

The following size and font_size arguments can now be used to specify a font size for this new builtin font:

ImageFont.load_default(size=24)
draw.text((0, 0), "test", font_size=24)
draw.textlength((0, 0), "test", font_size=24)
draw.textbbox((0, 0), "test", font_size=24)
draw.multiline_text((0, 0), "test", font_size=24)
draw.multiline_textbbox((0, 0), "test", font_size=24)

Other changes

Python 3.12

Pillow 10.0.0 had wheels built against Python 3.12 beta, available as a preview to help others prepare for 3.12, and to ensure Pillow could be used immediately at the release of 3.12.0 final (2023-10-02, 693).

Pillow 10.1.0 now officially supports Python 3.12.

Added support for DDS BC5U and 8-bit color indexed images

Support has been added to read BC5U DDS files as RGB images, and PALETTEINDEXED8 DDS files as P mode images.

Support reading signed 8-bit YCbCr TIFF images

TIFF images with unsigned integer data, 8 bits per sample and a photometric interpretation of YCbCr can now be read.

• Updated libwebp to 1.3.2 #7395 [radarhere]

• Updated zlib to 1.3 #7344 [radarhere]

10.0.1

Security

2023-4863: Updated install script and updated wheels

This release provides an updated install script and updated wheels to include libwebp 1.3.2, preventing a potential heap buffer overflow in WebP.

Other changes

Updated tests to pass with latest zlib version

The release of zlib 1.3 caused one of the tests in the Pillow test suite to fail.

• Fixed deallocating mask images #7246 [radarhere]

• Added ImageFont.MAX_STRING_LENGTH #7244 [radarhere, hugovk]

• Fix Windows build with pyproject.toml #7230 [hugovk, nulano, radarhere]

• Do not close provided file handles with libtiff #7199 [radarhere]

• Convert to HSV if mode is HSV in getcolor() #7226 [radarhere]

• Added alpha_only argument to getbbox() #7123 [radarhere. hugovk]

• Prioritise speed in _repr_png_ #7242 [radarhere]

• Do not use CFFI access by default on PyPy #7236 [radarhere]

• Limit size even if one dimension is zero in decompression bomb check #7235 [radarhere]

• Use --config-settings instead of deprecated --global-option #7171 [radarhere]

• Better C integer definitions #6645 [Yay295, hugovk]

• Fixed finding dependencies on Cygwin #7175 [radarhere]

• Changed grabclipboard() to use PNG instead of JPG compression on macOS #7219 [abey79, radarhere]

• Added in_place argument to ImageOps.exif_transpose() #7092 [radarhere]

• Fixed calling putpalette() on L and LA images before load() #7187 [radarhere]

• Fixed saving TIFF multiframe images with LONG8 tag types #7078 [radarhere]

• Fixed combining single duration across duplicate APNG frames #7146 [radarhere]

• Remove temporary file when error is raised #7148 [radarhere]

• Do not use temporary file when grabbing clipboard on Linux #7200 [radarhere]

• If the clipboard fails to open on Windows, wait and try again #7141 [radarhere]

• Fixed saving multiple 1 mode frames to GIF #7181 [radarhere]

• Replaced absolute PIL import with relative import #7173 [radarhere]

• Replaced deprecated Py_FileSystemDefaultEncoding for Python >= 3.12 #7192 [radarhere]

• Improved wl-paste mimetype handling in ImageGrab #7094 [rrcgat, radarhere]

• Added _repr_jpeg_() for IPython display_jpeg #7135 [n3011, radarhere, nulano]

• Use "/sbin/ldconfig" if ldconfig is not found #7068 [radarhere]

• Prefer screenshots using XCB over gnome-screenshot #7143 [nulano, radarhere]

• Fixed joined corners for ImageDraw rounded_rectangle() odd dimensions #7151 [radarhere]

• Support reading signed 8-bit TIFF images #7111 [radarhere]

• Added width argument to ImageDraw regular_polygon #7132 [radarhere]

• Support I mode for ImageFilter.BuiltinFilter #7108 [radarhere]

• Raise error from stderr of Linux ImageGrab.grabclipboard() command #7112 [radarhere]

• Added unpacker from I;16B to I;16 #7125 [radarhere]

• Support float font sizes #7107 [radarhere]

• Use later value for duplicate xref entries in PdfParser #7102 [radarhere]

• Load before getting size in __getstate__ #7105 [bigcat88, radarhere]

• Fixed type handling for include and lib directories #7069 [adisbladis, radarhere]

• Remove deprecations for Pillow 10.0.0 #7059, #7080 [hugovk, radarhere]

• Drop support for soon-EOL Python 3.7 #7058 [hugovk, radarhere]

10.0.0

Security

Limit size even if one dimension is zero

When performing decompression bomb checks, Pillow did not reject images with excessive width and zero height, or zero width and excessive height. That has now been fixed.

This effectively dates to the PIL fork, since problem images would still have been processed before Pillow started checking for decompression bombs.

2023-44271: Added ImageFont.MAX_STRING_LENGTH

To protect against potential DOS attacks when using arbitrary strings as text input, Pillow will now raise a ValueError if the number of characters passed into ImageFont methods is over a certain limit, PIL.ImageFont.MAX_STRING_LENGTH.

This threshold can be changed by setting PIL.ImageFont.MAX_STRING_LENGTH. It can be disabled by setting ImageFont.MAX_STRING_LENGTH = None.

Backwards incompatible changes

Categories

im.category has been removed, along with the related Image.NORMAL, Image.SEQUENCE and Image.CONTAINER attributes.

To determine if an image has multiple frames or not, getattr(im, "is_animated", False) can be used instead.

Tk/Tcl 8.4

Support for Tk/Tcl 8.4 has been removed.

JpegImagePlugin.convert_dict_qtables

Since deprecation in Pillow 8.3.0, the convert_dict_qtables method no longer performed any operations on the data given to it, and has been removed.

ImagePalette size parameter

Before Pillow 8.3.0, ImagePalette required palette data of particular lengths by default, and the size parameter could be used to override that. Pillow 8.3.0 removed the default required length, also removing the need for the size parameter.

ImageShow.Viewer.show_file file argument

The file argument in ~PIL.ImageShow.Viewer.show_file() has been removed and replaced by path.

In effect, viewer.show_file("test.jpg") will continue to work unchanged.

Constants

A number of constants have been removed. Instead, enum.IntEnum classes have been added.

Removed	Use instead
Image.LINEAR	Image.BILINEAR or Image.Resampling.BILINEAR
Image.CUBIC	Image.BICUBIC or Image.Resampling.BICUBIC
Image.ANTIALIAS	Image.LANCZOS or Image.Resampling.LANCZOS
ImageCms.INTENT_PERCEPTUAL	ImageCms.Intent.PERCEPTUAL
ImageCms.INTENT_RELATIVE_COLORMETRIC	ImageCms.Intent.RELATIVE_COLORMETRIC
ImageCms.INTENT_SATURATION	ImageCms.Intent.SATURATION
ImageCms.INTENT_ABSOLUTE_COLORIMETRIC	ImageCms.Intent.ABSOLUTE_COLORIMETRIC
ImageCms.DIRECTION_INPUT	ImageCms.Direction.INPUT
ImageCms.DIRECTION_OUTPUT	ImageCms.Direction.OUTPUT
ImageCms.DIRECTION_PROOF	ImageCms.Direction.PROOF
ImageFont.LAYOUT_BASIC	ImageFont.Layout.BASIC
ImageFont.LAYOUT_RAQM	ImageFont.Layout.RAQM
BlpImagePlugin.BLP_FORMAT_JPEG	BlpImagePlugin.Format.JPEG
BlpImagePlugin.BLP_ENCODING_UNCOMPRESSED	BlpImagePlugin.Encoding.UNCOMPRESSED
BlpImagePlugin.BLP_ENCODING_DXT	BlpImagePlugin.Encoding.DXT
BlpImagePlugin.BLP_ENCODING_UNCOMPRESSED_RAW_RGBA	BlpImagePlugin.Encoding.UNCOMPRESSED_RAW_RGBA
BlpImagePlugin.BLP_ALPHA_ENCODING_DXT1	BlpImagePlugin.AlphaEncoding.DXT1
BlpImagePlugin.BLP_ALPHA_ENCODING_DXT3	BlpImagePlugin.AlphaEncoding.DXT3
BlpImagePlugin.BLP_ALPHA_ENCODING_DXT5	BlpImagePlugin.AlphaEncoding.DXT5
FtexImagePlugin.FORMAT_DXT1	FtexImagePlugin.Format.DXT1
FtexImagePlugin.FORMAT_UNCOMPRESSED	FtexImagePlugin.Format.UNCOMPRESSED
PngImagePlugin.APNG_DISPOSE_OP_NONE	PngImagePlugin.Disposal.OP_NONE
PngImagePlugin.APNG_DISPOSE_OP_BACKGROUND	PngImagePlugin.Disposal.OP_BACKGROUND
PngImagePlugin.APNG_DISPOSE_OP_PREVIOUS	PngImagePlugin.Disposal.OP_PREVIOUS
PngImagePlugin.APNG_BLEND_OP_SOURCE	PngImagePlugin.Blend.OP_SOURCE
PngImagePlugin.APNG_BLEND_OP_OVER	PngImagePlugin.Blend.OP_OVER

FitsStubImagePlugin

The stub image plugin FitsStubImagePlugin has been removed. FITS images can be read without a handler through ~PIL.FitsImagePlugin instead.

Font size and offset methods

Several functions for computing the size and offset of rendered text have been removed:

Removed	Use instead
FreeTypeFont.getsize() and FreeTypeFont.getoffset()	.FreeTypeFont.getbbox and .FreeTypeFont.getlength
FreeTypeFont.getsize_multiline()	.ImageDraw.multiline_textbbox
ImageFont.getsize()	.ImageFont.getbbox and .ImageFont.getlength
TransposedFont.getsize()	.TransposedFont.getbbox and .TransposedFont.getlength
ImageDraw.textsize() and ImageDraw.multiline_textsize()	.ImageDraw.textbbox, .ImageDraw.textlength and .ImageDraw.multiline_textbbox
ImageDraw2.Draw.textsize()	.ImageDraw2.Draw.textbbox and .ImageDraw2.Draw.textlength

FreeTypeFont.getmask2 fill parameter

The undocumented fill parameter of .FreeTypeFont.getmask2 has been removed.

PhotoImage.paste box parameter

The box parameter was unused and has been removed.

PyQt5 and PySide2

Qt 5 reached end-of-life on 2020-12-08 for open-source users (and will reach EOL on 2023-12-08 for commercial licence holders).

Support for PyQt5 and PySide2 has been removed from ImageQt. Upgrade to PyQt6 or PySide6 instead.

Image.coerce_e

This undocumented method has been removed.

Deprecations

PyAccess and Image.USE_CFFI_ACCESS

Since Pillow's C API is now faster than PyAccess on PyPy, !PyAccess has been deprecated and will be removed in Pillow 11.0.0 (2024-10-15). Pillow's C API will now be used by default on PyPy instead.

Image.USE_CFFI_ACCESS, for switching from the C API to PyAccess, is similarly deprecated.

API changes

Added line width parameter to ImageDraw regular_polygon

An optional line width parameter has been added to ImageDraw.Draw.regular_polygon.

API additions

Added alpha_only argument to getbbox()

~PIL.Image.Image.getbbox now accepts a keyword argument of alpha_only. This is an optional flag, defaulting to True. If True and the image has an alpha channel, trim transparent pixels. Otherwise, trim pixels when all channels are zero.

Other changes

32-bit wheels

32-bit wheels are no longer provided.

Support display_jpeg() in IPython

In addition to display() and display_png, display_jpeg() can now also be used to display images in IPython:

from PIL import Image
from IPython.display import display_jpeg

im = Image.new("RGB", (100, 100), (255, 0, 0))
display_jpeg(im)

Support reading signed 8-bit TIFF images

TIFF images with signed integer data, 8 bits per sample and a photometric interpretation of BlackIsZero can now be read.

• Added ImageSourceData to TAGS_V2 #7053 [radarhere]

• Clear PPM half token after use #7052 [radarhere]

• Removed absolute path to ldconfig #7044 [radarhere]

• Support custom comments and PLT markers when saving JPEG2000 images #6903 [joshware, radarhere, hugovk]

• Load before getting size in __array_interface__ #7034 [radarhere]

• Support creating BGR;15, BGR;16 and BGR;24 images, but drop support for BGR;32 #7010 [radarhere]

• Consider transparency when applying APNG blend mask #7018 [radarhere]

• Round duration when saving animated WebP images #6996 [radarhere]

• Added reading of JPEG2000 comments #6909 [radarhere]

• Decrement reference count #7003 [radarhere, nulano]

• Allow libtiff_support_custom_tags to be missing #7020 [radarhere]

• Improved I;16N support #6834 [radarhere]

• Added QOI reading #6852 [radarhere, hugovk]

• Added saving RGBA images as PDFs #6925 [radarhere]

• Do not raise an error if os.environ does not contain PATH #6935 [radarhere, hugovk]

• Close OleFileIO instance when closing or exiting FPX or MIC #7005 [radarhere]

• Added __int__ to IFDRational for Python >= 3.11 #6998 [radarhere]

• Added memoryview support to Dib.frombytes() #6988 [radarhere, nulano]

• Close file pointer copy in the libtiff encoder if still open #6986 [fcarron, radarhere]

• Raise an error if ImageDraw co-ordinates are incorrectly ordered #6978 [radarhere]

• Added "corners" argument to ImageDraw rounded_rectangle() #6954 [radarhere]

• Added memoryview support to frombytes() #6974 [radarhere]

• Allow comments in FITS images #6973 [radarhere]

• Support saving PDF with different X and Y resolutions #6961 [jvanderneutstulen, radarhere, hugovk]

• Fixed writing int as UNDEFINED tag #6950 [radarhere]

• Raise an error if EXIF data is too long when saving JPEG #6939 [radarhere]

• Handle more than one directory returned by pkg-config #6896 [sebastic, radarhere]

• Do not retry past formats when loading all formats for the first time #6902 [radarhere]

• Do not retry specified formats if they failed when opening #6893 [radarhere]

• Do not unintentionally load TIFF format at first #6892 [radarhere]

• Stop reading when EPS line becomes too long #6897 [radarhere]

• Allow writing IFDRational to BYTE tag #6890 [radarhere]

• Raise ValueError for BoxBlur filter with negative radius #6874 [hugovk, radarhere]

• Support arbitrary number of loaded modules on Windows #6761 [javidcf, radarhere, nulano]

9.5.0

Security

Clear PPM half token after use

Image files that are small on disk are often prevented from expanding to be big images consuming a large amount of resources simply because they lack the data to populate those resources.

PpmImagePlugin might hold onto the last data read for a pixel value in case the pixel value has not been finished yet. However, that data was not being cleared afterwards, meaning that infinite data could be available to fill any image size. This has been present since Pillow 9.2.0.

That data is now cleared after use.

Saving TIFF tag ImageSourceData

If Pillow incorrectly saved the TIFF tag ImageSourceData as ASCII instead of UNDEFINED, a segmentation fault was triggered.

The correct tag type will now be used by default instead.

Deprecations

PSFile

The !PSFile class has been deprecated and will be removed in Pillow 11 (2024-10-15). This class was only made as a helper to be used internally, so there is no replacement. If you need this functionality though, it is a very short class that can easily be recreated in your own code.

API additions

QOI file format

Pillow can now read images in Quite OK Image format.

Added dpi argument when saving PDFs

When saving a PDF, resolution could already be specified using the resolution argument. Now, a tuple of (x_resolution, y_resolution) can be provided as dpi. If both are provided, dpi will override resolution.

Added corners argument to ImageDraw.rounded_rectangle()

.ImageDraw.rounded_rectangle now accepts a keyword argument of corners. This a tuple of Booleans, specifying whether to round each corner, (top_left, top_right, bottom_right, bottom_left).

JPEG2000 comments and PLT marker

When opening a JPEG2000 image, the comment may now be read into ~PIL.Image.Image.info. The comment keyword argument can be used to save it back again.

If OpenJPEG 2.4.0 or later is available and the plt keyword argument is present and true when saving JPEG2000 images, tell the encoder to generate PLT markers.

Other changes

Added support for saving PDFs in RGBA mode

Using the JPXDecode filter, PDFs can now be saved in RGBA mode.

Improved I;16N support

Support has been added for I;16N access, packing and unpacking. Conversion to and from L mode has also been added.

BGR;* modes

It is now possible to create new BGR;15, BGR;16 and BGR;24 images. Conversely, BGR;32 has been removed from ImageMode and its associated methods, dropping the little support Pillow had for the mode.

With that, all modes listed under concept-modes can now be used to create a new image.

• Fixed null pointer dereference crash with malformed font #6846 [wiredfool, radarhere]

• Return from ImagingFill early if image has a zero dimension #6842 [radarhere]

• Reversed deprecations for Image constants, except for duplicate Resampling attributes #6830 [radarhere]

• Improve exception traceback readability #6836 [hugovk, radarhere]

• Do not attempt to read IFD1 if absent #6840 [radarhere]

• Fixed writing int as ASCII tag #6800 [radarhere]

• If available, use wl-paste or xclip for grabclipboard() on Linux #6783 [radarhere]

• Added signed option when saving JPEG2000 images #6709 [radarhere]

• Patch OpenJPEG to include ARM64 fix #6718 [radarhere]

• Added support for I;16 modes in putdata() #6825 [radarhere]

• Added conversion from RGBa to RGB #6708 [radarhere]

• Added DDS support for uncompressed L and LA images #6820 [radarhere, REDxEYE]

• Added LightSource tag values to ExifTags #6749 [radarhere]

• Fixed PyAccess after changing ICO size #6821 [radarhere]

• Do not use EXIF from info when saving PNG images #6819 [radarhere]

• Fixed saving EXIF data to MPO #6817 [radarhere]

• Added Exif hide_offsets() #6762 [radarhere]

• Only compare to previous frame when checking for duplicate GIF frames while saving #6787 [radarhere]

• Always initialize all plugins in registered_extensions() #6811 [radarhere]

• Ignore non-opaque WebP background when saving as GIF #6792 [radarhere]

• Only set tile in ImageFile __setstate__ #6793 [radarhere]

• When reading BLP, do not trust JPEG decoder to determine image is CMYK #6767 [radarhere]

• Added IFD enum to ExifTags #6748 [radarhere]

• Fixed bug combining GIF frame durations #6779 [radarhere]

• Support saving JPEG comments #6774 [smason, radarhere]

• Added getxmp() to WebPImagePlugin #6758 [radarhere]

• Added "exact" option when saving WebP #6747 [ashafaei, radarhere]

• Use fractional coordinates when drawing text #6722 [radarhere]

• Fixed writing int as BYTE tag #6740 [radarhere]

• Added MP Format Version when saving MPO #6735 [radarhere]

• Added Interop to ExifTags #6724 [radarhere]

• CVE-2007-4559 patch when building on Windows #6704 [TrellixVulnTeam, nulano, radarhere]

• Fix compiler warning: accessing 64 bytes in a region of size 48 #6714 [wiredfool]

• Use verbose flag for pip install #6713 [wiredfool, radarhere]

9.4.0

Security

Fix memory DOS in ImageFont

A corrupt or specially crafted TTF font could have font metrics that lead to unreasonably large sizes when rendering text in font. ImageFont.py did not check the image size before allocating memory for it. This dates to the PIL fork. Pillow 8.2.0 added a check for large sizes, but did not consider the case where one dimension is zero.

Null pointer dereference crash in ImageFont

Pillow attempted to dereference a null pointer in ImageFont, leading to a crash. An error is now raised instead. This has been present since Pillow 8.0.0.

API additions

Added start position for getmask and getmask2

Text may render differently when starting at fractional coordinates, so .FreeTypeFont.getmask and .FreeTypeFont.getmask2 now support a start argument. This tuple of horizontal and vertical offset will be used internally by .ImageDraw.text to more accurately place text at the xy coordinates.

Added the exact encoding option for WebP

The exact encoding option for WebP is now supported. The WebP encoder removes the hidden RGB values for better compression by default in libwebp 0.5 or later. By setting this option to True, the encoder will keep the hidden RGB values.

Added signed option when saving JPEG2000

If the signed keyword argument is present and true when saving JPEG2000 images, then tell the encoder to save the image as signed.

Added IFD, Interop and LightSource ExifTags enums

~PIL.ExifTags.IFD has been added, allowing enums to be used with ~PIL.Image.Exif.get_ifd:

from PIL import Image, ExifTags
im = Image.open("Tests/images/flower.jpg")
print(im.getexif().get_ifd(ExifTags.IFD.Exif))

IFD1 can also be used with ~PIL.Image.Exif.get_ifd, but it should not be used in other contexts, as the enum value is only internally meaningful.

~PIL.ExifTags.Interop has been added for tags within the Interop IFD:

from PIL import Image, ExifTags
im = Image.open("Tests/images/flower.jpg")
interop_ifd = im.getexif().get_ifd(ExifTags.IFD.Interop)
print(interop_ifd.get(ExifTags.Interop.InteropIndex))  # R98

~PIL.ExifTags.LightSource has been added for values within the LightSource tag:

from PIL import Image, ExifTags
im = Image.open("Tests/images/iptc.jpg")
exif_ifd = im.getexif().get_ifd(ExifTags.IFD.Exif)
print(ExifTags.LightSource(exif_ifd[0x9208]))  # LightSource.Unknown

getxmp()

XMP data can now be decoded for WEBP images through getxmp().

Writing JPEG comments

When saving a JPEG image, a comment can now be written from ~PIL.Image.Image.info, or by using an argument when saving:

im.save(out, comment="Test comment")

Other changes

Added support for DDS L and LA images

Support has been added to read and write L and LA DDS images in the uncompressed format, known as "luminance" textures.

Constants

In Pillow 9.1.0, the following constants were deprecated. That has been reversed and these constants will now remain available.

• Image.NONE

• Image.NEAREST

• Image.ORDERED

• Image.RASTERIZE

• Image.FLOYDSTEINBERG

• Image.WEB

• Image.ADAPTIVE

• Image.AFFINE

• Image.EXTENT

• Image.PERSPECTIVE

• Image.QUAD

• Image.MESH

• Image.FLIP_LEFT_RIGHT

• Image.FLIP_TOP_BOTTOM

• Image.ROTATE_90

• Image.ROTATE_180

• Image.ROTATE_270

• Image.TRANSPOSE

• Image.TRANSVERSE

• Image.BOX

• Image.BILINEAR

• Image.HAMMING

• Image.BICUBIC

• Image.LANCZOS

• Image.MEDIANCUT

• Image.MAXCOVERAGE

• Image.FASTOCTREE

• Image.LIBIMAGEQUANT

• Limit SAMPLESPERPIXEL to avoid runtime DOS #6700 [wiredfool]

• Initialize libtiff buffer when saving #6699 [radarhere]

• Inline fname2char to fix memory leak #6329 [nulano]

• Fix memory leaks related to text features #6330 [nulano]

• Use double quotes for version check on old CPython on Windows #6695 [hugovk]

• Remove backup implementation of Round for Windows platforms #6693 [cgohlke]

• Fixed set_variation_by_name offset #6445 [radarhere]

• Fix malloc in _imagingft.c:font_setvaraxes #6690 [cgohlke]

• Release Python GIL when converting images using matrix operations #6418 [hmaarrfk]

• Added ExifTags enums #6630 [radarhere]

• Do not modify previous frame when calculating delta in PNG #6683 [radarhere]

• Added support for reading BMP images with RLE4 compression #6674 [npjg, radarhere]

• Decode JPEG compressed BLP1 data in original mode #6678 [radarhere]

• Added GPS TIFF tag info #6661 [radarhere]

• Added conversion between RGB/RGBA/RGBX and LAB #6647 [radarhere]

• Do not attempt normalization if mode is already normal #6644 [radarhere]

• Fixed seeking to an L frame in a GIF #6576 [radarhere]

• Consider all frames when selecting mode for PNG save_all #6610 [radarhere]

• Don't reassign crc on ChunkStream close #6627 [wiredfool, radarhere]

• Raise a warning if NumPy failed to raise an error during conversion #6594 [radarhere]

• Show all frames in ImageShow #6611 [radarhere]

• Allow FLI palette chunk to not be first #6626 [radarhere]

• If first GIF frame has transparency for RGB_ALWAYS loading strategy, use RGBA mode #6592 [radarhere]

• Round box position to integer when pasting embedded color #6517 [radarhere, nulano]

• Removed EXIF prefix when saving WebP #6582 [radarhere]

• Pad IM palette to 768 bytes when saving #6579 [radarhere]

• Added DDS BC6H reading #6449 [ShadelessFox, REDxEYE, radarhere]

• Added support for opening WhiteIsZero 16-bit integer TIFF images #6642 [JayWiz, radarhere]

• Raise an error when allocating translucent color to RGB palette #6654 [jsbueno, radarhere]

• Added reading of TIFF child images #6569 [radarhere]

• Improved ImageOps palette handling #6596 [PososikTeam, radarhere]

• Defer parsing of palette into colors #6567 [radarhere]

• Apply transparency to P images in ImageTk.PhotoImage #6559 [radarhere]

• Use rounding in ImageOps contain() and pad() #6522 [bibinhashley, radarhere]

• Fixed GIF remapping to palette with duplicate entries #6548 [radarhere]

• Allow remap_palette() to return an image with less than 256 palette entries #6543 [radarhere]

• Corrected BMP and TGA palette size when saving #6500 [radarhere]

• Do not call load() before draft() in Image.thumbnail #6539 [radarhere]

• Copy palette when converting from P to PA #6497 [radarhere]

• Allow RGB and RGBA values for PA image putpixel #6504 [radarhere]

• Removed support for tkinter in PyPy before Python 3.6 #6551 [nulano]

• Do not use CCITTFaxDecode filter if libtiff is not available #6518 [radarhere]

• Fallback to not using mmap if buffer is not large enough #6510 [radarhere]

• Fixed writing bytes as ASCII tag #6493 [radarhere]

• Open 1 bit EPS in mode 1 #6499 [radarhere]

• Removed support for tkinter before Python 1.5.2 #6549 [radarhere]

• Allow default ImageDraw font to be set #6484 [radarhere, hugovk]

• Save 1 mode PDF using CCITTFaxDecode filter #6470 [radarhere]

• Added support for RGBA PSD images #6481 [radarhere]

• Parse orientation from XMP tag contents #6463 [bigcat88, radarhere]

• Added support for reading ATI1/ATI2 (BC4/BC5) DDS images #6457 [REDxEYE, radarhere]

• Do not clear GIF tile when checking number of frames #6455 [radarhere]

• Support saving multiple MPO frames #6444 [radarhere]

• Do not double quote Pillow version for setuptools >= 60 #6450 [radarhere]

• Added ABGR BMP mask mode #6436 [radarhere]

• Fixed PSDraw rectangle #6429 [radarhere]

• Raise ValueError if PNG sRGB chunk is truncated #6431 [radarhere]

• Handle missing Python executable in ImageShow on macOS #6416 [bryant1410, radarhere]

9.3.0

Security

Initialize libtiff buffer when saving

When saving a TIFF image to a file object using libtiff, the buffer was not initialized. This behaviour introduced in Pillow 2.0.0, and has now been fixed.

Decode JPEG compressed BLP1 data in original mode

Within the BLP image format, BLP1 data may use JPEG compression. Instead of telling the JPEG library that this data is in BGRX mode, Pillow will now decode the data in its natural CMYK mode, then convert it to RGB and rearrange the channels afterwards. Trying to load the data in an incorrect mode could result in a segmentation fault. This issue was introduced in Pillow 9.1.0.

Limit SAMPLESPERPIXEL to avoid runtime DOS

A large value in the SAMPLESPERPIXEL tag could lead to a memory and runtime DOS in TiffImagePlugin.py when setting up the context for image decoding. This was introduced in Pillow 9.2.0, found with OSS-Fuzz and fixed by limiting SAMPLESPERPIXEL to the number of planes that we can decode.

API additions

Allow default ImageDraw font to be set

Rather than specifying a font when calling text-related ImageDraw methods, or setting a font on each ImageDraw instance, the default font can now be set for all future ImageDraw operations:

from PIL import ImageDraw, ImageFont
ImageDraw.ImageDraw.font = ImageFont.truetype("Tests/fonts/FreeMono.ttf")

Saving multiple MPO frames

Multiple MPO frames can now be saved. Using the save_all argument, all of an image's frames will be saved to file:

from PIL import Image
im = Image.open("frozenpond.mpo")
im.save(out, save_all=True)

Additional images can also be appended when saving, by combining the save_all argument with the append_images argument:

im.save(out, save_all=True, append_images=[im1, im2, ...])

Added ExifTags enums

The data from ~PIL.ExifTags.TAGS and ~PIL.ExifTags.GPSTAGS is now also exposed as enum.IntEnum classes: ~PIL.ExifTags.Base and ~PIL.ExifTags.GPS.

Other changes

Python 3.11 wheels

Pillow 9.2.0 had wheels built against Python 3.11 beta, available as a preview to help others prepare for 3.11, and ensure Pillow can be used immediately on release day of 3.11.0 final (2022-10-24, 664).

Pillow 9.3.0 now officially includes binary wheels for Python 3.11 final.

Windows wheels

This release contains wheels for Windows built using GitHub Actions.

Previously they were built by Christoph Gohlke.

A huge thanks to Christoph for building Windows binaries for us for around a decade, plus testing, and fixing over a hundred bug fixes along the way, in addition to building and hosting unofficial Windows binaries for hundreds of Python projects!

Added DDS ATI1, ATI2 and BC6H reading

Support has been added to read the ATI1, ATI2 and BC6H formats of DDS images.

Release GIL when converting images using matrix operations

Python's Global Interpreter Lock is now released when converting images using matrix operations.

Show all frames with ImageShow

When calling ~PIL.Image.Image.show or using ~PIL.ImageShow, all frames will now be shown.

• Deprecate ImageFont.getsize and related functions #6381 [nulano, radarhere]

• Fixed null check for fribidi_version_info in FriBiDi shim #6376 [nulano]

• Added GIF decompression bomb check #6402 [radarhere]

• Handle PCF fonts files with less than 256 characters #6386 [dawidcrivelli, radarhere]

• Improved GIF optimize condition #6378 [raygard, radarhere]

• Reverted to __array_interface__ with the release of NumPy 1.23 #6394 [radarhere]

• Pad PCX palette to 768 bytes when saving #6391 [radarhere]

• Fixed bug with rounding pixels to palette colors #6377 [btrekkie, radarhere]

• Use gnome-screenshot on Linux if available #6361 [radarhere, nulano]

• Fixed loading L mode BMP RLE8 images #6384 [radarhere]

• Fixed incorrect operator in ImageCms error #6370 [LostBenjamin, hugovk, radarhere]

• Limit FPX tile size to avoid extending outside image #6368 [radarhere]

• Added support for decoding plain PPM formats #5242 [Piolie, radarhere]

• Added apply_transparency() #6352 [radarhere]

• Fixed behaviour change from endian fix #6197 [radarhere]

• Allow remapping P images with RGBA palettes #6350 [radarhere]

• Fixed drawing translucent 1px high polygons #6278 [radarhere]

• Pad COLORMAP to 768 items when saving TIFF #6232 [radarhere]

• Fix P -> PA conversion #6337 [RedShy, radarhere]

• Once exif data is parsed, do not reload unless it changes #6335 [radarhere]

• Only try to connect discontiguous corners at the end of edges #6303 [radarhere]

• Improve transparency handling when saving GIF images #6176 [radarhere]

• Do not update GIF frame position until local image is found #6219 [radarhere]

• Netscape GIF extension belongs after the global color table #6211 [radarhere]

• Only write GIF comments at the beginning of the file #6300 [raygard, radarhere]

• Separate multiple GIF comment blocks with newlines #6294 [raygard, radarhere]

• Always use GIF89a for comments #6292 [raygard, radarhere]

• Ignore compression value from BMP info dictionary when saving as TIFF #6231 [radarhere]

• If font is file-like object, do not re-read from object to get variant #6234 [radarhere]

• Raise ValueError when trying to access internal fp after close #6213 [radarhere]

• Support more affine expression forms in im.point() #6254 [benrg, radarhere]

• Populate Python palette in fromarray() #6283 [radarhere]

• Raise ValueError if PNG chunks are truncated #6253 [radarhere]

• Use durations from each frame by default when saving GIFs #6265 [radarhere]

• Adjust BITSPERSAMPLE to match SAMPLESPERPIXEL when opening TIFFs #6270 [radarhere]

• Search pkgconf system libs/cflags #6138 [jameshilliard, radarhere]

• Raise ValueError for invalid PPM maxval #6242 [radarhere]

• Corrected screencapture argument in ImageGrab.grab() #6244 [axt-one]

• Deprecate support for Qt 5 (PyQt5 and PySide2) #6237 [hugovk, radarhere]

• Increase wait time of temporary file deletion on Windows #6224 [AlexTedeschi]

• Deprecate FreeTypeFont.getmask2 fill parameter #6220 [nulano, radarhere, hugovk]

• Round lut values where necessary #6188 [radarhere]

• Load before getting size in resize() #6190 [radarhere]

• Load image before performing size calculations in thumbnail() #6186 [radarhere]

• Deprecated PhotoImage.paste() box parameter #6178 [radarhere]

9.2.0

Security

An additional decompression bomb check has been added for the GIF format.

Deprecations

PyQt5 and PySide2

Qt 5 reached end-of-life on 2020-12-08 for open-source users (and will reach EOL on 2023-12-08 for commercial licence holders).

Support for PyQt5 and PySide2 has been deprecated from ImageQt and will be removed in Pillow 10 (2023-07-01). Upgrade to PyQt6 or PySide6 instead.

FreeTypeFont.getmask2 fill parameter

The undocumented fill parameter of .FreeTypeFont.getmask2 has been deprecated and will be removed in Pillow 10 (2023-07-01).

PhotoImage.paste box parameter

The box parameter is unused. It will be removed in Pillow 10.0.0 (2023-07-01).

Image.coerce_e

This undocumented method has been deprecated and will be removed in Pillow 10 (2023-07-01).

Font size and offset methods

Several functions for computing the size and offset of rendered text have been deprecated and will be removed in Pillow 10 (2023-07-01):

Deprecated	Use instead
FreeTypeFont.getsize() and FreeTypeFont.getoffset()	.FreeTypeFont.getbbox and .FreeTypeFont.getlength
FreeTypeFont.getsize_multiline()	.ImageDraw.multiline_textbbox
ImageFont.getsize()	.ImageFont.getbbox and .ImageFont.getlength
TransposedFont.getsize()	.TransposedFont.getbbox and .TransposedFont.getlength
ImageDraw.textsize() and ImageDraw.multiline_textsize()	.ImageDraw.textbbox, .ImageDraw.textlength and .ImageDraw.multiline_textbbox
ImageDraw2.Draw.textsize()	.ImageDraw2.Draw.textbbox and .ImageDraw2.Draw.textlength

Previous code:

from PIL import Image, ImageDraw, ImageFont

font = ImageFont.truetype("Tests/fonts/FreeMono.ttf")
width, height = font.getsize("Hello world")
left, top = font.getoffset("Hello world")

im = Image.new("RGB", (100, 100))
draw = ImageDraw.Draw(im)
width, height = draw.textsize("Hello world", font)

width, height = font.getsize_multiline("Hello\nworld")
width, height = draw.multiline_textsize("Hello\nworld", font)

Use instead:

from PIL import Image, ImageDraw, ImageFont

font = ImageFont.truetype("Tests/fonts/FreeMono.ttf")
left, top, right, bottom = font.getbbox("Hello world")
width, height = right - left, bottom - top

im = Image.new("RGB", (100, 100))
draw = ImageDraw.Draw(im)
width = draw.textlength("Hello world", font)

left, top, right, bottom = draw.multiline_textbbox((0, 0), "Hello\nworld", font)
width, height = right - left, bottom - top

Previously, the size methods returned a height that included the vertical offset of the text, while the new bbox methods distinguish this as a top offset.

If you are using these methods for aligning text, consider using text-anchors instead which avoid issues that can occur with non-English text or unusual fonts. For example, instead of the following code:

from PIL import Image, ImageDraw, ImageFont

font = ImageFont.truetype("Tests/fonts/FreeMono.ttf")

im = Image.new("RGB", (100, 100))
draw = ImageDraw.Draw(im)
width, height = draw.textsize("Hello world", font)
x, y = (100 - width) / 2, (100 - height) / 2
draw.text((x, y), "Hello world", font=font)

Use instead:

from PIL import Image, ImageDraw, ImageFont

font = ImageFont.truetype("Tests/fonts/FreeMono.ttf")

im = Image.new("RGB", (100, 100))
draw = ImageDraw.Draw(im)
draw.text((100 / 2, 100 / 2), "Hello world", font=font, anchor="mm")

API additions

Image.apply_transparency

Added ~PIL.Image.Image.apply_transparency, a method to take a P mode image with "transparency" in im.info, and apply the transparency to the palette instead. The image's palette mode will become "RGBA", and "transparency" will be removed from im.info.

Other changes

Using gnome-screenshot on Linux

In ~PIL.ImageGrab.grab on Linux, if xdisplay is None then gnome-screenshot will be used to capture the display if it is installed. To capture the default X11 display instead, pass xdisplay="".

• When reading past the end of a TGA scan line, reduce bytes left. CVE-2022-30595 [radarhere]

• Do not open images with zero or negative height #6269 [radarhere]

9.1.1

Security

This release addresses several security issues.

2022-30595: Heap buffer overflow

When reading a TGA file with RLE packets that cross scan lines, Pillow reads the information past the end of the first line without deducting that from the length of the remaining file data. This vulnerability was introduced in Pillow 9.1.0, and can cause a heap buffer overflow.

Decompression bomb check fix

Opening an image with a zero or negative height has been found to bypass a decompression bomb check. This will now raise a SyntaxError instead, in turn raising a PIL.UnidentifiedImageError.

• Add support for multiple component transformation to JPEG2000 #5500 [scaramallion, radarhere, hugovk]

• Fix loading FriBiDi on Alpine #6165 [nulano]

• Added setting for converting GIF P frames to RGB #6150 [radarhere]

• Allow 1 mode images to be inverted #6034 [radarhere]

• Raise ValueError when trying to save empty JPEG #6159 [radarhere]

• Always save TIFF with contiguous planar configuration #5973 [radarhere]

• Connected discontiguous polygon corners #5980 [radarhere]

• Ensure Tkinter hook is activated for getimage() #6032 [radarhere]

• Use screencapture arguments to crop on macOS #6152 [radarhere]

• Do not mark L mode JPEG as 1 bit in PDF #6151 [radarhere]

• Added support for reading I;16R TIFF images #6132 [radarhere]

• If an error occurs after creating a file, remove the file #6134 [radarhere]

• Fixed calling DisplayViewer or XVViewer without a title #6136 [radarhere]

• Retain RGBA transparency when saving multiple GIF frames #6128 [radarhere]

• Save additional ICO frames with other bit depths if supplied #6122 [radarhere]

• Handle EXIF data truncated to just the header #6124 [radarhere]

• Added support for reading BMP images with RLE8 compression #6102 [radarhere]

• Support Python distributions where _tkinter is compiled in #6006 [lukegb]

• Added support for PPM arbitrary maxval #6119 [radarhere]

• Added BigTIFF reading #6097 [radarhere]

• When converting, clip I;16 to be unsigned, not signed #6112 [radarhere]

• Fixed loading L mode GIF with transparency #6086 [radarhere]

• Improved handling of PPM header #5121 [Piolie, radarhere]

• Reset size when seeking away from "Large Thumbnail" MPO frame #6101 [radarhere]

• Replace requirements.txt with extras #6072 [hugovk, radarhere]

• Added PyEncoder and support BLP saving #6069 [radarhere]

• Handle TGA images with packets that cross scan lines #6087 [radarhere]

• Added FITS reading #6056 [radarhere, hugovk]

• Added rawmode argument to Image.getpalette() #6061 [radarhere]

• Fixed BUFR, GRIB and HDF5 stub saving #6071 [radarhere]

• Do not automatically remove temporary ImageShow files on Unix #6045 [radarhere]

• Correctly read JPEG compressed BLP images #4685 [Meithal, radarhere]

• Merged _MODE_CONV typ into ImageMode as typestr #6057 [radarhere]

• Consider palette size when converting and in getpalette() #6060 [radarhere]

• Added enums #5954 [radarhere]

• Ensure image is opaque after converting P to PA with RGB palette #6052 [radarhere]

• Attach RGBA palettes from putpalette() when suitable #6054 [radarhere]

• Added get_photoshop_blocks() to parse Photoshop TIFF tag #6030 [radarhere]

• Drop excess values in BITSPERSAMPLE #6041 [mikhail-iurkov]

• Added unpacker from RGBA;15 to RGB #6031 [radarhere]

• Enable arm64 for MSVC on Windows #5811 [gaborkertesz-linaro, gaborkertesz]

• Keep IPython/Jupyter text/plain output stable #5891 [shamrin, radarhere]

• Raise an error when performing a negative crop #5972 [radarhere, hugovk]

• Deprecated show_file "file" argument in favour of "path" #5959 [radarhere]

• Fixed SPIDER images for use with Bio-formats library #5956 [radarhere]

• Ensure duplicated file pointer is closed #5946 [radarhere]

• Added specific error if path coordinate type is incorrect #5942 [radarhere]

• Return an empty bytestring from tobytes() for an empty image #5938 [radarhere]

• Remove readonly from Image.__eq__ #5930 [hugovk]

9.1.0

Deprecations

Constants

A number of constants have been deprecated and will be removed in Pillow 10.0.0 (2023-07-01). Instead, enum.IntEnum classes have been added.

Note

Some of these deprecations were restored in Pillow 9.4.0. See restored-image-constants

Deprecated	Use instead
Image.NONE	Either Image.Dither.NONE or Image.Resampling.NEAREST
Image.NEAREST	Either Image.Dither.NONE or Image.Resampling.NEAREST
Image.ORDERED	Image.Dither.ORDERED
Image.RASTERIZE	Image.Dither.RASTERIZE
Image.FLOYDSTEINBERG	Image.Dither.FLOYDSTEINBERG
Image.WEB	Image.Palette.WEB
Image.ADAPTIVE	Image.Palette.ADAPTIVE
Image.AFFINE	Image.Transform.AFFINE
Image.EXTENT	Image.Transform.EXTENT
Image.PERSPECTIVE	Image.Transform.PERSPECTIVE
Image.QUAD	Image.Transform.QUAD
Image.MESH	Image.Transform.MESH
Image.FLIP_LEFT_RIGHT	Image.Transpose.FLIP_LEFT_RIGHT
Image.FLIP_TOP_BOTTOM	Image.Transpose.FLIP_TOP_BOTTOM
Image.ROTATE_90	Image.Transpose.ROTATE_90
Image.ROTATE_180	Image.Transpose.ROTATE_180
Image.ROTATE_270	Image.Transpose.ROTATE_270
Image.TRANSPOSE	Image.Transpose.TRANSPOSE
Image.TRANSVERSE	Image.Transpose.TRANSVERSE
Image.BOX	Image.Resampling.BOX
Image.BILINEAR	Image.Resampling.BILINEAR
Image.LINEAR	Image.Resampling.BILINEAR
Image.HAMMING	Image.Resampling.HAMMING
Image.BICUBIC	Image.Resampling.BICUBIC
Image.CUBIC	Image.Resampling.BICUBIC
Image.LANCZOS	Image.Resampling.LANCZOS
Image.ANTIALIAS	Image.Resampling.LANCZOS
Image.MEDIANCUT	Image.Quantize.MEDIANCUT
Image.MAXCOVERAGE	Image.Quantize.MAXCOVERAGE
Image.FASTOCTREE	Image.Quantize.FASTOCTREE
Image.LIBIMAGEQUANT	Image.Quantize.LIBIMAGEQUANT
ImageCms.INTENT_PERCEPTUAL	ImageCms.Intent.PERCEPTUAL
ImageCms.INTENT_RELATIVE_COLORMETRIC	ImageCms.Intent.RELATIVE_COLORMETRIC
ImageCms.INTENT_SATURATION	ImageCms.Intent.SATURATION
ImageCms.INTENT_ABSOLUTE_COLORIMETRIC	ImageCms.Intent.ABSOLUTE_COLORIMETRIC
ImageCms.DIRECTION_INPUT	ImageCms.Direction.INPUT
ImageCms.DIRECTION_OUTPUT	ImageCms.Direction.OUTPUT
ImageCms.DIRECTION_PROOF	ImageCms.Direction.PROOF
ImageFont.LAYOUT_BASIC	ImageFont.Layout.BASIC
ImageFont.LAYOUT_RAQM	ImageFont.Layout.RAQM
BlpImagePlugin.BLP_FORMAT_JPEG	BlpImagePlugin.Format.JPEG
BlpImagePlugin.BLP_ENCODING_UNCOMPRESSED	BlpImagePlugin.Encoding.UNCOMPRESSED
BlpImagePlugin.BLP_ENCODING_DXT	BlpImagePlugin.Encoding.DXT
BlpImagePlugin.BLP_ENCODING_UNCOMPRESSED_RAW_RGBA	BlpImagePlugin.Encoding.UNCOMPRESSED_RAW_RGBA
BlpImagePlugin.BLP_ALPHA_ENCODING_DXT1	BlpImagePlugin.AlphaEncoding.DXT1
BlpImagePlugin.BLP_ALPHA_ENCODING_DXT3	BlpImagePlugin.AlphaEncoding.DXT3
BlpImagePlugin.BLP_ALPHA_ENCODING_DXT5	BlpImagePlugin.AlphaEncoding.DXT5
FtexImagePlugin.FORMAT_DXT1	FtexImagePlugin.Format.DXT1
FtexImagePlugin.FORMAT_UNCOMPRESSED	FtexImagePlugin.Format.UNCOMPRESSED
PngImagePlugin.APNG_DISPOSE_OP_NONE	PngImagePlugin.Disposal.OP_NONE
PngImagePlugin.APNG_DISPOSE_OP_BACKGROUND	PngImagePlugin.Disposal.OP_BACKGROUND
PngImagePlugin.APNG_DISPOSE_OP_PREVIOUS	PngImagePlugin.Disposal.OP_PREVIOUS
PngImagePlugin.APNG_BLEND_OP_SOURCE	PngImagePlugin.Blend.OP_SOURCE
PngImagePlugin.APNG_BLEND_OP_OVER	PngImagePlugin.Blend.OP_OVER

ImageShow.Viewer.show_file file argument

The file argument in ~PIL.ImageShow.Viewer.show_file() has been deprecated and will be removed in Pillow 10.0.0 (2023-07-01). It has been replaced by path.

In effect, viewer.show_file("test.jpg") will continue to work unchanged. viewer.show_file(file="test.jpg") will raise a deprecation warning, and suggest viewer.show_file(path="test.jpg") instead.

FitsStubImagePlugin

The stub image plugin FitsStubImagePlugin has been deprecated and will be removed in Pillow 10.0.0 (2023-07-01). FITS images can be read without a handler through ~PIL.FitsImagePlugin instead.

API changes

Raise an error when performing a negative crop

Performing a negative crop on an image previously just returned a (0, 0) image. Now it will raise a ValueError, to help reduce confusion if a user has unintentionally provided the wrong arguments.

Added specific error if path coordinate type is incorrect

Rather than returning a SystemError, passing the incorrect types of coordinates into a path will now raise a more specific ValueError, with the message "incorrect coordinate type".

Replace requirements.txt with extras

Rather than installing all dependencies for docs and tests via requirements.txt, extras_require is used instead. This installs only those needed and at the same time as installing Pillow.

For example:

# Install with dependencies for tests:
python3 -m pip install .[tests]

# Or for building docs:
python3 -m pip install .[docs]

# Or for all:
python3 -m pip install .[docs,tests]

On macOS, the last argument may need to be wrapped in quotes, e.g. python3 -m pip install ".[tests]"

Therefore requirements.txt has been removed along with the make install-req command for installing its contents.

API additions

Added get_photoshop_blocks() to parse Photoshop TIFF tag

~PIL.TiffImagePlugin.TiffImageFile.get_photoshop_blocks has been added, to allow users to determine what Photoshop "Image Resource Blocks" are contained within an image. The keys of the returned dictionary are the image resource IDs.

At present, the information within each block is merely returned as a dictionary with a "data" entry. This will allow more useful information to be added in the future without breaking backwards compatibility.

Added mct and no_jp2 options for saving JPEG 2000

The PIL.Image.Image.save method now supports the following options for JPEG 2000:

mct

If 1 then enable multiple component transformation when encoding, otherwise use 0 for no component transformation (default). If MCT is enabled and irreversible is True then the Irreversible Color Transformation will be applied, otherwise encoding will use the Reversible Color Transformation. MCT works best with a mode of RGB and is only applicable when the image data has 3 components.

no_jp2

If True then don't wrap the raw codestream in the JP2 file format when saving, otherwise the extension of the filename will be used to determine the format (default).

Added PyEncoder

~PIL.ImageFile.PyEncoder has been added, allowing for file encoders to be written in Python. See Writing Your Own File Codec in Python for more information.

GifImagePlugin loading strategy

Pillow 9.0.0 introduced the conversion of subsequent GIF frames to RGB or RGBA. This behaviour can now be changed so that the first P frame is converted to RGB as well.

from PIL import GifImagePlugin
GifImagePlugin.LOADING_STRATEGY = GifImagePlugin.LoadingStrategy.RGB_ALWAYS

Or subsequent frames can be kept in P mode as long as there is only a single palette.

from PIL import GifImagePlugin
GifImagePlugin.LOADING_STRATEGY = GifImagePlugin.LoadingStrategy.RGB_AFTER_DIFFERENT_PALETTE_ONLY

Other changes

musllinux wheels

Pillow now builds binary wheels for musllinux, suitable for Linux distributions based on the musl C standard library such as Alpine (rather than the glibc library used by manylinux wheels). See 656.

ImageShow temporary files on Unix

When calling ~PIL.Image.Image.show or using ~PIL.ImageShow, a temporary file is created from the image. On Unix, Pillow will no longer delete these files, and instead leave it to the operating system to do so.

Image._repr_pretty_

im._repr_pretty_ has been added to provide a representation of an image without the identity of the object. This allows Jupyter to describe an image and have that description stay the same on subsequent executions of the same code.

Added BigTIFF reading

Support has been added for reading BigTIFF images.

Added BLP saving

Support has been added for saving BLP images. blp_version can be used to specify whether the image should be saved as BLP1 or BLP2, e.g. im.save("out.blp", blp_version="BLP1"). By default, BLP2 will be used.

• In show_file, use os.remove to remove temporary images. CVE-2022-24303 #6010 [radarhere, hugovk]

• Restrict builtins within lambdas for ImageMath.eval. CVE-2022-22817 #6009 [radarhere]

9.0.1

Security

This release addresses several security problems.

2022-24303: Temp image removal

If the path to the temporary directory on Linux or macOS contained a space, this would break removal of the temporary image file after im.show() (and related actions), and potentially remove an unrelated file. This has been present since PIL.

2022-22817: Restrict lambda expressions

While Pillow 9.0 restricted top-level builtins available to !PIL.ImageMath.eval, it did not prevent builtins available to lambda expressions. These are now also restricted.

Other changes

Pillow 9.0 added support for xdg-open as an image viewer, but there have been reports that the temporary image file was removed too quickly to be loaded into the final application. A delay has been added.

• Restrict builtins for ImageMath.eval(). CVE-2022-22817 #5923 [radarhere]

• Ensure JpegImagePlugin stops at the end of a truncated file #5921 [radarhere]

• Fixed ImagePath.Path array handling. CVE-2022-22815, CVE-2022-22816 #5920 [radarhere]

• Remove consecutive duplicate tiles that only differ by their offset #5919 [radarhere]

• Improved I;16 operations on big endian #5901 [radarhere]

• Limit quantized palette to number of colors #5879 [radarhere]

• Fixed palette index for zeroed color in FASTOCTREE quantize #5869 [radarhere]

• When saving RGBA to GIF, make use of first transparent palette entry #5859 [radarhere]

• Pass SAMPLEFORMAT to libtiff #5848 [radarhere]

• Added rounding when converting P and PA #5824 [radarhere]

• Improved putdata() documentation and data handling #5910 [radarhere]

• Exclude carriage return in PDF regex to help prevent ReDoS #5912 [hugovk]

• Fixed freeing pointer in ImageDraw.Outline.transform #5909 [radarhere]

• Added ImageShow support for xdg-open #5897 [m-shinder, radarhere]

• Support 16-bit grayscale ImageQt conversion #5856 [cmbruns, radarhere]

• Convert subsequent GIF frames to RGB or RGBA #5857 [radarhere]

• Do not prematurely return in ImageFile when saving to stdout #5665 [infmagic2047, radarhere]

• Added support for top right and bottom right TGA orientations #5829 [radarhere]

• Corrected ICNS file length in header #5845 [radarhere]

• Block tile TIFF tags when saving #5839 [radarhere]

• Added line width argument to polygon #5694 [radarhere]

• Do not redeclare class each time when converting to NumPy #5844 [radarhere]

• Only prevent repeated polygon pixels when drawing with transparency #5835 [radarhere]

• Add support for pickling TrueType fonts #5826 [hugovk, radarhere]

• Only prefer command line tools SDK on macOS over default MacOSX SDK #5828 [radarhere]

• Drop support for soon-EOL Python 3.6 #5768 [hugovk, nulano, radarhere]

• Fix compilation on 64-bit Termux #5793 [landfillbaby]

• Use title for display in ImageShow #5788 [radarhere]

• Remove support for FreeType 2.7 and older #5777 [hugovk, radarhere]

• Fix for PyQt6 #5775 [hugovk, radarhere]

• Removed deprecated PILLOW_VERSION, Image.show command parameter, Image._showxv and ImageFile.raise_ioerror #5776 [radarhere]

9.0.0

Fredrik Lundh

This release is dedicated to the memory of Fredrik Lundh, aka Effbot, who died in November 2021. Fredrik created PIL in 1995 and he was instrumental in the early success of Python.

Guido wrote:

Fredrik was an early Python contributor (e.g. Elementtree and the 're' module) and his enthusiasm for the language and community were inspiring for all who encountered him or his work. He spent countless hours on comp.lang.python answering questions from newbies and advanced users alike.

He also co-founded an early Python startup, Secret Labs AB, which among other software released an IDE named PythonWorks. Fredrik also created the Python Imaging Library (PIL) which is still THE way to interact with images in Python, now most often through its Pillow fork. His effbot.org site was a valuable resource for generations of Python users, especially its Tkinter documentation.

Thank you, Fredrik.

Security

Ensure JpegImagePlugin stops at the end of a truncated file

JpegImagePlugin may append an EOF marker to the end of a truncated file, so that the last segment of the data will still be processed by the decoder.

If the EOF marker is not detected as such however, this could lead to an infinite loop where JpegImagePlugin keeps trying to end the file.

Remove consecutive duplicate tiles that only differ by their offset

To prevent attempts to slow down loading times for images, if an image has consecutive duplicate tiles that only differ by their offset, only load the last tile. Credit to Google's OSS-Fuzz project for finding this issue.

2022-22817: Restrict builtins available to ImageMath.eval

To limit PIL.ImageMath to working with images, Pillow will now restrict the builtins available to !PIL.ImageMath.eval. This will help prevent problems arising if users evaluate arbitrary expressions, such as ImageMath.eval("exec(exit())").

2022-22815, 2022-22816: ImagePath.Path array handling

2022-22815 (126) and 2022-22816 (665) were found when initializing ImagePath.Path.

Backwards incompatible changes

Python 3.6

Pillow has dropped support for Python 3.6, which reached end-of-life on 2021-12-23.

PILLOW_VERSION constant

PILLOW_VERSION has been removed. Use __version__ instead.

FreeType 2.7

Support for FreeType 2.7 has been removed; FreeType 2.8 is the minimum supported.

We recommend upgrading to at least FreeType 2.10.4, which fixed a severe vulnerability introduced in FreeType 2.6 (2020-15999).

Image.show command parameter

The command parameter has been removed. Use a subclass of PIL.ImageShow.Viewer instead.

Image._showxv

Image._showxv has been removed. Use ~PIL.Image.Image.show instead. If custom behaviour is required, use ~PIL.ImageShow.register to add a custom ~PIL.ImageShow.Viewer class.

ImageFile.raise_ioerror

IOError was merged into OSError in Python 3.3. So, ImageFile.raise_ioerror has been removed. Use ImageFile.raise_oserror instead.

API changes

Added line width parameter to ImageDraw polygon

An optional line width parameter has been added to ImageDraw.Draw.polygon.

API additions

ImageShow.XDGViewer

If xdg-open is present on Linux, this new PIL.ImageShow.Viewer subclass will be registered. It displays images using the application selected by the system.

It is higher in priority than the other default PIL.ImageShow.Viewer instances, so it will be preferred by im.show() or .ImageShow.show().

Added support for "title" argument to DisplayViewer

Support has been added for the "title" argument in ~PIL.ImageShow.UnixViewer.DisplayViewer, so that when im.show() or .ImageShow.show() use the display command line tool, the "title" argument will also now be supported, e.g. im.show(title="My Image") and ImageShow.show(im, title="My Image").

Other changes

Convert subsequent GIF frames to RGB or RGBA

Since each frame of a GIF can have up to 256 colors, after the first frame it is possible for there to be too many colors to fit in a P mode image. To allow for this, seeking to any subsequent GIF frame will now convert the image to RGB or RGBA, depending on whether or not the first frame had transparency.

Switched to libjpeg-turbo in macOS and Linux wheels

The Pillow wheels from PyPI for macOS and Linux have switched from libjpeg to libjpeg-turbo. It is a fork of libjpeg, popular for its speed.

Because different JPEG decoders load images differently, JPEG pixels may be altered slightly with this change.

Added support for pickling TrueType fonts

TrueType fonts may now be pickled and unpickled. For example:

import pickle
from PIL import ImageFont

font = ImageFont.truetype("arial.ttf", size=30)
pickled_font = pickle.dumps(font, protocol=pickle.HIGHEST_PROTOCOL)

# Later...
unpickled_font = pickle.loads(pickled_font)

Added support for additional TGA orientations

TGA images with top right or bottom right orientations are now supported.

• Prefer global transparency in GIF when replacing with background color #5756 [radarhere]

• Added "exif" keyword argument to TIFF saving #5575 [radarhere]

• Copy Python palette to new image in quantize() #5696 [radarhere]

• Read ICO AND mask from end #5667 [radarhere]

• Actually check the framesize in FliDecode.c #5659 [wiredfool]

• Determine JPEG2000 mode purely from ihdr header box #5654 [radarhere]

• Fixed using info dictionary when writing multiple APNG frames #5611 [radarhere]

• Allow saving 1 and L mode TIFF with PhotometricInterpretation 0 #5655 [radarhere]

• For GIF save_all with palette, do not include palette with each frame #5603 [radarhere]

• Keep transparency when converting from P to LA or PA #5606 [radarhere]

• Copy palette to new image in transform() #5647 [radarhere]

• Added "transparency" argument to EpsImagePlugin load() #5620 [radarhere]

• Corrected pathlib.Path detection when saving #5633 [radarhere]

• Added WalImageFile class #5618 [radarhere]

• Consider I;16 pixel size when drawing text #5598 [radarhere]

• If default conversion from P is RGB with transparency, convert to RGBA #5594 [radarhere]

• Speed up rotating square images by 90 or 270 degrees #5646 [radarhere]

• Add support for reading DPI information from JPEG2000 images [rogermb, radarhere]

• Catch TypeError from corrupted DPI value in EXIF #5639 [homm, radarhere]

• Do not close file pointer when saving SGI images #5645 [farizrahman4u, radarhere]

• Deprecate ImagePalette size parameter #5641 [radarhere, hugovk]

• Prefer command line tools SDK on macOS #5624 [radarhere]

• Added tags when saving YCbCr TIFF #5597 [radarhere]

• PSD layer count may be negative #5613 [radarhere]

• Fixed ImageOps expand with tuple border on P image #5615 [radarhere]

• Fixed error saving APNG with duplicate frames and different duration times #5609 [thak1411, radarhere]

8.4.0

Deprecations

ImagePalette size parameter

The size parameter will be removed in Pillow 10.0.0 (2023-07-01).

Before Pillow 8.3.0, ImagePalette required palette data of particular lengths by default, and the size parameter could be used to override that. Pillow 8.3.0 removed the default required length, also removing the need for the size parameter.

API additions

Added "transparency" argument for loading EPS images

This new argument switches the Ghostscript device from "ppmraw" to "pngalpha", generating an RGBA image with a transparent background instead of an RGB image with a white background.

with Image.open("sample.eps") as im:
    im.load(transparency=True)

Added WalImageFile class

PIL.WalImageFile.open() previously returned a generic PIL.Image.Image instance. It now returns a dedicated PIL.WalImageFile.WalImageFile class.

Other changes

Speed improvement when rotating square images

Starting with Pillow 3.3.0, the speed of rotating images by 90 or 270 degrees was improved by quickly returning ~PIL.Image.Image.transpose instead, if the rotate operation allowed for expansion and did not specify a center or post-rotate translation.

Since the expand flag makes no difference for square images though, Pillow now uses this faster method for square images without the expand flag as well.

8.3.2

Security

2021-23437: Avoid potential ReDoS (regular expression denial of service)

Avoid a potential ReDoS (regular expression denial of service) in ~PIL.ImageColor's ~PIL.ImageColor.getrgb by raising ValueError if the color specifier is too long. Present since Pillow 5.2.0.

Fix 6-byte out-of-bounds (OOB) read

Fix 6-byte out-of-bounds (OOB) read. The previous bounds check in FliDecode.c incorrectly calculated the required read buffer size when copying a chunk, potentially reading six extra bytes off the end of the allocated buffer from the heap. Present since Pillow 7.1.0.

This bug was found by Google's OSS-Fuzz CIFuzz runs.

Other changes

Python 3.10 wheels

Pillow now includes binary wheels for Python 3.10.

The Python 3.10 release candidate was released on 2021-08-03 with the final release due 2021-10-04 (619). The CPython core team strongly encourages maintainers of third-party Python projects to prepare for 3.10 compatibility. And as there are no ABI changes planned we are releasing wheels to help others prepare for 3.10, and ensure Pillow can be used immediately on release day of 3.10.0 final.

Fixed regressions

• Ensure TIFF RowsPerStrip is multiple of 8 for JPEG compression (5588).

• Updates for ~PIL.ImagePalette channel order (5599).

• Hide FriBiDi shim symbols to avoid conflict with real FriBiDi library (5651).

• Catch OSError when checking if fp is sys.stdout #5585 [radarhere]

• Handle removing orientation from alternate types of EXIF data #5584 [radarhere]

• Make Image.__array__ take optional dtype argument #5572 [t-vi, radarhere]

8.3.1

Fixed regression converting to NumPy arrays

This fixes a regression introduced in 8.3.0 when converting an image to a NumPy array with a dtype argument.

>>> from PIL import Image
>>> import numpy
>>> im = Image.new("RGB", (100, 100))
>>> numpy.array(im, dtype=numpy.float64)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
TypeError: __array__() takes 1 positional argument but 2 were given
>>>

Catch OSError when checking if destination is sys.stdout

In 8.3.0, a check to see if the destination was sys.stdout when saving an image was updated. This lead to an OSError being raised if the environment restricted access.

The OSError is now silently caught.

Fixed removing orientation in ImageOps.exif_transpose

In 8.3.0, ~PIL.ImageOps.exif_transpose was changed to ensure that the original image EXIF data was not modified, and the orientation was only removed from the modified copy.

However, for certain images the orientation was already missing from the modified image, leading to a KeyError.

This error has been resolved, and the copying of metadata to the modified image improved.

• Use snprintf instead of sprintf. CVE-2021-34552 #5567 [radarhere]

• Limit TIFF strip size when saving with LibTIFF #5514 [kmilos]

• Allow ICNS save on all operating systems #4526 [baletu, radarhere, newpanjing, hugovk]

• De-zigzag JPEG's DQT when loading; deprecate convert_dict_qtables #4989 [gofr, radarhere]

• Replaced xml.etree.ElementTree #5565 [radarhere]

• Moved CVE image to pillow-depends #5561 [radarhere]

• Added tag data for IFD groups #5554 [radarhere]

• Improved ImagePalette #5552 [radarhere]

• Add DDS saving #5402 [radarhere]

• Improved getxmp() #5455 [radarhere]

• Convert to float for comparison with float in IFDRational __eq__ #5412 [radarhere]

• Allow getexif() to access TIFF tag_v2 data #5416 [radarhere]

• Read FITS image mode and size #5405 [radarhere]

• Merge parallel horizontal edges in ImagingDrawPolygon #5347 [radarhere, hrdrq]

• Use transparency behind first GIF frame and when disposing to background #5557 [radarhere, zewt]

• Avoid unstable nature of qsort in Quant.c #5367 [radarhere]

• Copy palette to new images in ImageOps expand #5551 [radarhere]

• Ensure palette string matches RGB mode #5549 [radarhere]

• Do not modify EXIF of original image instance in exif_transpose() #5547 [radarhere]

• Fixed default numresolution for small JPEG2000 images #5540 [radarhere]

• Added DDS BC5 reading #5501 [radarhere]

• Raise an error if ImageDraw.textbbox is used without a TrueType font #5510 [radarhere]

• Added ICO saving in BMP format #5513 [radarhere]

• Ensure PNG seeks to end of previous chunk at start of load_end #5493 [radarhere]

• Do not allow TIFF to seek to a past frame #5473 [radarhere]

• Avoid race condition when displaying images with eog #5507 [mconst]

• Added specific error messages when ink has incorrect number of bands #5504 [radarhere]

• Allow converting an image to a numpy array to raise errors #5379 [radarhere]

• Removed DPI rounding from BMP, JPEG, PNG and WMF loading #5476, #5470 [radarhere]

• Remove spikes when drawing thin pieslices #5460 [xtsm]

• Updated default value for SAMPLESPERPIXEL TIFF tag #5452 [radarhere]

• Removed TIFF DPI rounding #5446 [radarhere, hugovk]

• Include code in WebP error #5471 [radarhere]

• Do not alter pixels outside mask when drawing text on an image with transparency #5434 [radarhere]

• Reset handle when seeking backwards in TIFF #5443 [radarhere]

• Replace sys.stdout with sys.stdout.buffer when saving #5437 [radarhere]

• Fixed UNDEFINED TIFF tag of length 0 being changed in roundtrip #5426 [radarhere]

• Fixed bug when checking FreeType2 version if it is not installed #5445 [radarhere]

• Do not round dimensions when saving PDF #5459 [radarhere]

• Added ImageOps contain() #5417 [radarhere, hugovk]

• Changed WebP default "method" value to 4 #5450 [radarhere]

• Switched to saving 1-bit PDFs with DCTDecode #5430 [radarhere]

• Use bpp from ICO header #5429 [radarhere]

• Corrected JPEG APP14 transform value #5408 [radarhere]

• Changed TIFF tag 33723 length to 1 #5425 [radarhere]

• Changed ImageMorph incorrect mode errors to ValueError #5414 [radarhere]

• Add EXIF tags specified in EXIF 2.32 #5419 [gladiusglad]

• Treat previous contents of first GIF frame as transparent #5391 [radarhere]

• For special image modes, revert default resize resampling to NEAREST #5411 [radarhere]

• JPEG2000: Support decoding subsampled RGB and YCbCr images #4996 [nulano, radarhere]

• Stop decoding BC1 punchthrough alpha in BC2&3 #4144 [jansol]

• Use zero if GIF background color index is missing #5390 [radarhere]

• Fixed ensuring that GIF previous frame was loaded #5386 [radarhere]

• Valgrind fixes #5397 [wiredfool]

• Round down the radius in rounded_rectangle #5382 [radarhere]

• Fixed reading uncompressed RGB data from DDS #5383 [radarhere]

8.3.0

Security

2021-34552: Fix buffer overflow

PIL since 1.1.4 and Pillow since 1.0 allowed parameters passed into a convert function to trigger buffer overflow in Convert.c.

Parsing XML

Pillow previously parsed XMP data using Python's xml module. However, this module is not secure.

• ~PIL.Image.Image.getexif has used xml to potentially retrieve orientation data since Pillow 7.2.0. It has been refactored to use re instead.

• getxmp() was added to ~PIL.JpegImagePlugin.JpegImageFile in Pillow 8.2.0. It will now use defusedxml instead. If the dependency is not present, an empty dictionary will be returned and a warning raised.

Deprecations

JpegImagePlugin.convert_dict_qtables

JPEG quantization is now automatically converted, but still returned as a dictionary. The convert_dict_qtables method no longer performs any operations on the data given to it, has been deprecated and will be removed in Pillow 10.0.0 (2023-07-01).

API changes

Changed WebP default "method" value when saving

Previously, it was 0, for the best speed. The default has now been changed to 4, to match WebP's default, for higher quality with still some speed optimisation.

Default resampling filter for special image modes

Pillow 7.0 changed the default resampling filter to Image.BICUBIC. However, as this is not supported yet for images with a custom number of bits, the default filter for those modes has been reverted to Image.NEAREST.

ImageMorph incorrect mode errors

For apply(), match() and get_on_pixels(), if the image mode is not L, an Exception was thrown. This has now been changed to a ValueError.

getxmp()

XMP data can now be returned for PNG and TIFF images, through getxmp() for each format.

The returned dictionary will start from the base of the XML, meaning that the top level should contain an "xmpmeta" key. JPEG's getxmp() method has also been updated to this structure.

TIFF getexif()

TIFF ~PIL.TiffImagePlugin.TiffImageFile.tag_v2 data can now be accessed through ~PIL.Image.Image.getexif. This also provides access to the GPS and EXIF IFDs, through im.getexif().get_ifd(0x8825) and im.getexif().get_ifd(0x8769) respectively.

API additions

ImageOps.contain

Returns a resized version of the image, set to the maximum width and height within size, while maintaining the original aspect ratio.

To compare it to other ImageOps methods:

• ~PIL.ImageOps.fit expands an image until is fills size, cropping the parts of the image that do not fit.

• ~PIL.ImageOps.pad expands an image to fill size, without cropping, but instead filling the extra space with color.

• ~PIL.ImageOps.contain is similar to ~PIL.ImageOps.pad, but it does not fill the extra space. Instead, the original aspect ratio is maintained. So unlike the other two methods, it is not guaranteed to return an image of size.

ICO saving: bitmap_format argument

By default, Pillow saves ICO files in the PNG format. They can now also be saved in BMP format, through the new bitmap_format argument:

im.save("out.ico", bitmap_format="bmp")

Other changes

Added DDS BC5 reading and uncompressed saving

Support has been added to read the BC5 format of DDS images, whether UNORM, SNORM or TYPELESS.

Support has also been added to write the uncompressed format of DDS images.

• Added getxmp() method #5144 [UrielMaD, radarhere]

• Add ImageShow support for GraphicsMagick #5349 [latosha-maltba, radarhere]

• Do not load transparent pixels from subsequent GIF frames #5333 [zewt, radarhere]

• Use LZW encoding when saving GIF images #5291 [raygard]

• Set all transparent colors to be equal in quantize() #5282 [radarhere]

• Allow PixelAccess to use Python __int__ when parsing x and y #5206 [radarhere]

• Removed Image._MODEINFO #5316 [radarhere]

• Add preserve_tone option to autocontrast #5350 [elejke, radarhere]

• Fixed linear_gradient and radial_gradient I and F modes #5274 [radarhere]

• Add support for reading TIFFs with PlanarConfiguration=2 #5364 [kkopachev, wiredfool, nulano]

• Deprecated categories #5351 [radarhere]

• Do not premultiply alpha when resizing with Image.NEAREST resampling #5304 [nulano]

• Dynamically link FriBiDi instead of Raqm #5062 [nulano]

• Allow fewer PNG palette entries than the bit depth maximum when saving #5330 [radarhere]

• Use duration from info dictionary when saving WebP #5338 [radarhere]

• Stop flattening EXIF IFD into getexif() #4947 [radarhere, kkopachev]

• Replaced tiff_deflate with tiff_adobe_deflate compression when saving TIFF images #5343 [radarhere]

• Save ICC profile from TIFF encoderinfo #5321 [radarhere]

• Moved RGB fix inside ImageQt class #5268 [radarhere]

• Allow alpha_composite destination to be negative #5313 [radarhere]

• Ensure file is closed if it is opened by ImageQt.ImageQt #5260 [radarhere]

• Added ImageDraw rounded_rectangle method #5208 [radarhere]

• Added IPythonViewer #5289 [radarhere, Kipkurui-mutai]

• Only draw each rectangle outline pixel once #5183 [radarhere]

• Use mmap instead of built-in Win32 mapper #5224 [radarhere, cgohlke]

• Handle PCX images with an odd stride #5214 [radarhere]

• Only read different sizes for "Large Thumbnail" MPO frames #5168 [radarhere]

• Added PyQt6 support #5258 [radarhere]

• Changed Image.open formats parameter to be case-insensitive #5250 [Piolie, radarhere]

• Deprecate Tk/Tcl 8.4, to be removed in Pillow 10 (2023-07-01) #5216 [radarhere]

• Added tk version to pilinfo #5226 [radarhere, nulano]

• Support for ignoring tests when running valgrind #5150 [wiredfool, radarhere, hugovk]

• OSS-Fuzz support #5189 [wiredfool, radarhere]

8.2.0

Security

These issues were all found with OSS-Fuzz.

2021-25287, 2021-25288: OOB read in Jpeg2KDecode

• For J2k images with multiple bands, it's legal to have different widths for each band, e.g. 1 byte for L, 4 bytes for A.

• This dates to Pillow 2.4.0.

2021-28675: DOS attack in PsdImagePlugin

• .PsdImagePlugin.PsdImageFile did not sanity check the number of input layers with regard to the size of the data block, this could lead to a denial-of-service on ~PIL.Image.open prior to ~PIL.Image.Image.load.

• This dates to the PIL fork.

2021-28676: FLI image DOS attack

• FliDecode.c did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.

• This dates to the PIL fork.

2021-28677: EPS DOS on _open

• The readline used in EPS has to deal with any combination of \r and \n as line endings. It accidentally used a quadratic method of accumulating lines while looking for a line ending.

• A malicious EPS file could use this to perform a denial-of-service of Pillow in the open phase, before an image was accepted for opening.

• This dates to the PIL fork.

2021-28678: BLP DOS attack

• BlpImagePlugin did not properly check that reads after jumping to file offsets returned data. This could lead to a denial-of-service where the decoder could be run a large number of times on empty data.

• This dates to Pillow 5.1.0.

Fix memory DOS in ImageFont

• A corrupt or specially crafted TTF font could have font metrics that lead to unreasonably large sizes when rendering text in font. ImageFont.py did not check the image size before allocating memory for it.

• This dates to the PIL fork.

Deprecations

Categories

im.category is deprecated and will be removed in Pillow 10.0.0 (2023-07-01), along with the related Image.NORMAL, Image.SEQUENCE and Image.CONTAINER attributes.

To determine if an image has multiple frames or not, getattr(im, "is_animated", False) can be used instead.

Tk/Tcl 8.4

Support for Tk/Tcl 8.4 is deprecated and will be removed in Pillow 10.0.0 (2023-07-01), when Tk/Tcl 8.5 will be the minimum supported.

API changes

Image.alpha_composite: dest

When calling ~PIL.Image.Image.alpha_composite, the dest argument now accepts negative coordinates, like the upper left corner of the box argument of ~PIL.Image.Image.paste can be negative. Naturally, this has effect of cropping the overlaid image.

Image.getexif: EXIF and GPS IFD

Previously, ~PIL.Image.Image.getexif flattened the EXIF IFD into the rest of the data, losing information. This information is now kept separate, moved under im.getexif().get_ifd(0x8769).

Direct access to the GPS IFD dictionary was possible through im.getexif()[0x8825]. This is now consistent with other IFDs, and must be accessed through im.getexif().get_ifd(0x8825).

These changes only affect ~PIL.Image.Image.getexif, introduced in Pillow 6.0. The older _getexif() methods are unaffected.

Image._MODEINFO

This internal dictionary had been deprecated by a comment since PIL, and is now removed. Instead, Image.getmodebase(), Image.getmodetype(), Image.getmodebandnames(), Image.getmodebands() or ImageMode.getmode() can be used.

API additions

getxmp() for JPEG images

A new method has been added to return XMP data for JPEG images. It reads the XML data into a dictionary of names and values.

For example:

>>> from PIL import Image
>>> with Image.open("Tests/images/xmp_test.jpg") as im:
>>>     print(im.getxmp())
{'RDF': {}, 'Description': {'Version': '10.4', 'ProcessVersion': '10.0', ...}, ...}

ImageDraw.rounded_rectangle

Added ~PIL.ImageDraw.ImageDraw.rounded_rectangle. It works the same as ~PIL.ImageDraw.ImageDraw.rectangle, except with an additional radius argument. radius is limited to half of the width or the height, so that users can create a circle, but not any other ellipse.

from PIL import Image, ImageDraw
im = Image.new("RGB", (200, 200))
draw = ImageDraw.Draw(im)
draw.rounded_rectangle(xy=(10, 20, 190, 180), radius=30, fill="red")

ImageOps.autocontrast: preserve_tone

The default behaviour of ~PIL.ImageOps.autocontrast is to normalize separate histograms for each color channel, changing the tone of the image. The new preserve_tone argument keeps the tone unchanged by using one luminance histogram for all channels.

ImageShow.GmDisplayViewer

If GraphicsMagick is present, this new PIL.ImageShow.Viewer subclass will be registered. It uses GraphicsMagick, an ImageMagick fork, to display images.

The GraphicsMagick based viewer has a lower priority than its ImageMagick counterpart. Thus, if both ImageMagick and GraphicsMagick are installed, im.show() and .ImageShow.show() prefer the viewer based on ImageMagick, i.e the behaviour stays the same for Pillow users having ImageMagick installed.

ImageShow.IPythonViewer

If IPython is present, this new PIL.ImageShow.Viewer subclass will be registered. It displays images on all IPython frontends. This will be helpful to users of Google Colab, allowing im.show() to display images.

It is lower in priority than the other default PIL.ImageShow.Viewer instances, so it will only be used by im.show() or .ImageShow.show() if none of the other viewers are available. This means that the behaviour of PIL.ImageShow will stay the same for most Pillow users.

Saving TIFF with ICC profile

As is already possible for JPEG, PNG and WebP, the ICC profile for TIFF files can now be specified through a keyword argument:

im.save("out.tif", icc_profile=...)

Other changes

GIF writer uses LZW encoding

GIF files are now written using LZW encoding, which will generate smaller files, typically about 70% of the size generated by the older encoder.

The pixel data is encoded using the format specified in the CompuServe GIF standard.

The older encoder used a variant of run-length encoding that was compatible but less efficient.

GraphicsMagick

The test suite can now be run on systems which have GraphicsMagick but not ImageMagick installed. If both are installed, the tests prefer ImageMagick.

Libraqm and FriBiDi linking

The way the libraqm dependency for complex text scripts is linked has been changed:

Source builds will now link against the system version of libraqm at build time rather than at runtime by default.

Binary wheels now include a statically linked modified version of libraqm that links against FriBiDi at runtime instead. This change is intended to address issues with the previous implementation on some platforms. These are created by building Pillow with the new build flags --vendor-raqm --vendor-fribidi.

Windows users will now need to install fribidi.dll (or fribidi-0.dll) only, libraqm.dll is no longer used.

See installation documentation for more information.

PyQt6

Support has been added for PyQt6. If it is installed, it will be used instead of PySide6, PyQt5 or PySide2.

• Fix Memory DOS in BLP (CVE-2021-27921), ICNS (CVE-2021-27922) and ICO (CVE-2021-27923) Image Plugins [wiredfool]

8.1.2

Security

2021-27921, 2021-27922, 2021-27923: Fix DOS attacks

There is an exhaustion of memory DOS attack in BLP, ICNS, ICO images where Pillow did not properly check the reported size of the contained image. These images could cause arbitrarily large memory allocations.

These issues were reported by Jiayi Lin, Luke Shaffer, Xinran Xie and Akshay Ajayan of Arizona State University.

• Use more specific regex chars to prevent ReDoS. CVE-2021-25292 [hugovk]

• Fix OOB Read in TiffDecode.c, and check the tile validity before reading. CVE-2021-25291 [wiredfool]

• Fix negative size read in TiffDecode.c. CVE-2021-25290 [wiredfool]

• Fix OOB read in SgiRleDecode.c. CVE-2021-25293 [wiredfool]

• Incorrect error code checking in TiffDecode.c. CVE-2021-25289 [wiredfool]

• PyModule_AddObject fix for Python 3.10 #5194 [radarhere]

8.1.1

Security

2021-25289: Correct the fix for 2020-35654

The previous fix for 2020-35654 was insufficient due to incorrect error checking in TiffDecode.c.

2021-25290: Fix buffer overflow in TiffDecode.c

In TiffDecode.c, there is a negative-offset memcpy with an invalid size.

2021-25291: Fix buffer overflow in TIFFReadRGBATile

In TiffDecode.c, invalid tile boundaries could lead to an out-of-bounds read in TIFFReadRGBATile.

2021-25292: Fix DOS attack

The PDF parser has a catastrophic backtracking regex that could be used as a DOS attack.

2021-25293: Fix buffer overflow in SgiRleDecode.c

There is an out-of-bounds read in SgiRleDecode.c since Pillow 4.3.0.

Other changes

A crash with the feature flags for libimagequant, libjpeg-turbo, WebP and XCB on unreleased Python 3.10 has been fixed (5193).

• Fix TIFF OOB Write error. CVE-2020-35654 #5175 [wiredfool]

• Fix for Read Overflow in PCX Decoding. CVE-2020-35653 #5174 [wiredfool, radarhere]

• Fix for SGI Decode buffer overrun. CVE-2020-35655 #5173 [wiredfool, radarhere]

• Fix OOB Read when saving GIF of xsize=1 #5149 [wiredfool]

• Makefile updates #5159 [wiredfool, radarhere]

• Add support for PySide6 #5161 [hugovk]

• Use disposal settings from previous frame in APNG #5126 [radarhere]

• Added exception explaining that _repr_png_ saves to PNG #5139 [radarhere]

• Use previous disposal method in GIF load_end #5125 [radarhere]

• Allow putpalette to accept 1024 integers to include alpha values #5089 [radarhere]

• Fix OOB Read when writing TIFF with custom Metadata #5148 [wiredfool]

• Added append_images support for ICO #4568 [ziplantil, radarhere]

• Block TIFFTAG_SUBIFD #5120 [radarhere]

• Fixed dereferencing potential null pointers #5108, #5111 [cgohlke, radarhere]

• Deprecate FreeType 2.7 #5098 [hugovk, radarhere]

• Moved warning to end of execution #4965 [radarhere]

• Removed unused fromstring and tostring C methods #5026 [radarhere]

• init() if one of the formats is unrecognised #5037 [radarhere]

• Moved string_dimension CVE image to pillow-depends #4993 [radarhere]

• Support raw rgba8888 for DDS #4760 [qiankanglai]

8.1.0

Security

This release includes security fixes.

• An out-of-bounds read when saving TIFFs with custom metadata through LibTIFF

• An out-of-bounds read when saving a GIF of 1px width

2020-35653: Buffer read overrun in PCX decoding

The PCX image decoder used the reported image stride to calculate the row buffer, rather than calculating it from the image size. This issue dates back to the PIL fork. Thanks to Google's OSS-Fuzz project for finding this.

2020-35654: TIFF out-of-bounds write error

Out-of-bounds write in TiffDecode.c when reading corrupt YCbCr files in some LibTIFF versions (4.1.0/Ubuntu 20.04, but not 4.0.9/Ubuntu 18.04). In some cases LibTIFF's interpretation of the file is different when reading in RGBA mode, leading to an out-of-bounds write in TiffDecode.c. This potentially affects Pillow versions from 6.0.0 to 8.0.1, depending on the version of LibTIFF. This was reported through Tidelift.

2020-35655: SGI decode buffer overrun

4 byte read overflow in SgiRleDecode.c, where the code was not correctly checking the offsets and length tables. Independently reported through Tidelift and Google's OSS-Fuzz. This vulnerability covers Pillow versions 4.3.0->8.0.1.

Dependencies

OpenJPEG in the macOS and Linux wheels has been updated from 2.3.1 to 2.4.0, including security fixes.

LibTIFF in the macOS and Linux wheels has been updated from 4.1.0 to 4.2.0, including security fixes discovered by fuzzers.

Deprecations

FreeType 2.7

Support for FreeType 2.7 is deprecated and will be removed in Pillow 9.0.0 (2022-01-02), when FreeType 2.8 will be the minimum supported.

We recommend upgrading to at least FreeType 2.10.4, which fixed a severe vulnerability introduced in FreeType 2.6 (2020-15999).

Makefile

The install-venv target has been deprecated.

API additions

Append images to ICO

When saving an ICO image, the file may contain versions of the image at different sizes. By default, Pillow will scale down the main image to create these copies.

With this release, a list of images can be provided to the append_images parameter when saving, to replace the scaled down versions. This is the same functionality that already exists for the ICNS format.

Other changes

Makefile

The co target has been removed.

PyPy wheels

Wheels have been added for PyPy 3.7.

PySide6

Support has been added for PySide6. If it is installed, it will be used instead of PyQt5 or PySide2, since it is based on a newer Qt.

• Update FreeType used in binary wheels to 2.10.4 to fix CVE-2020-15999. [radarhere]

• Moved string_dimension image to pillow-depends #4993 [radarhere]

8.0.1

Security

2020-15999: Update FreeType in wheels to 2.10.4

• A heap buffer overflow has been found in the handling of embedded PNG bitmaps, introduced in FreeType version 2.6.

• If you use option FT_CONFIG_OPTION_USE_PNG you should upgrade immediately.

We strongly recommend updating to Pillow 8.0.1 if you are using Pillow 8.0.0, which improved support for bitmap fonts.

In Pillow 7.2.0 and earlier bitmap fonts were disabled with FT_LOAD_NO_BITMAP, but it is not clear if this prevents the exploit and we recommend updating to Pillow 8.0.1.

Pillow 8.0.0 and earlier are potentially vulnerable releases, including the last release to support Python 2.7, namely Pillow 6.2.2.

• Drop support for EOL Python 3.5 #4746, #4794 [hugovk, radarhere, nulano]

• Drop support for PyPy3 < 7.2.0 #4964 [nulano]

• Remove ImageCms.CmsProfile attributes deprecated since 3.2.0 #4768 [hugovk, radarhere]

• Remove long-deprecated Image.py functions #4798 [hugovk, nulano, radarhere]

• Add support for 16-bit precision JPEG quantization values #4918 [gofr]

• Added reading of IFD tag type #4979 [radarhere]

• Initialize offset memory for PyImagingPhotoPut #4806 [nqbit]

• Fix TiffDecode comparison warnings #4756 [nulano]

• Docs: Add dark mode #4968 [hugovk, nulano]

• Added macOS SDK install path to library and include directories #4974 [radarhere, fxcoudert]

• Imaging.h: prevent confusion with system #4923 [ax3l, ,radarhere]

• Avoid using pkg_resources in PIL.features.pilinfo #4975 [nulano]

• Add getlength and getbbox functions for TrueType fonts #4959 [nulano, radarhere, hugovk]

• Allow tuples with one item to give single color value in getink #4927 [radarhere, nulano]

• Add support for CBDT and COLR fonts #4955 [nulano, hugovk]

• Removed OSError in favour of DecompressionBombError for BMP #4966 [radarhere]

• Implemented another ellipse drawing algorithm #4523 [xtsm, radarhere]

• Removed unused JpegImagePlugin._fixup_dict function #4957 [radarhere]

• Added reading and writing of private PNG chunks #4292 [radarhere]

• Implement anchor for TrueType fonts #4930 [nulano, hugovk]

• Fixed bug in Exif __delitem__ #4942 [radarhere]

• Fix crash in ImageTk.PhotoImage on MinGW 64-bit #4946 [nulano]

• Moved CVE images to pillow-depends #4929 [radarhere]

• Refactor font_getsize and font_render #4910 [nulano]

• Fixed loading profile with non-ASCII path on Windows #4914 [radarhere]

• Fixed effect_spread bug for zero distance #4908 [radarhere, hugovk]

• Added formats parameter to Image.open #4837 [nulano, radarhere]

• Added regular_polygon draw method #4846 [comhar]

• Raise proper TypeError in putpixel #4882 [nulano, hugovk]

• Added writing of subIFDs #4862 [radarhere]

• Fix IFDRational __eq__ bug #4888 [luphord, radarhere]

• Fixed duplicate variable name #4885 [liZe, radarhere]

• Added homebrew zlib include directory #4842 [radarhere]

• Corrected inverted PDF CMYK colors #4866 [radarhere]

• Do not try to close file pointer if file pointer is empty #4823 [radarhere]

• ImageOps.autocontrast: add mask parameter #4843 [navneeth, hugovk]

• Read EXIF data tEXt chunk into info as bytes instead of string #4828 [radarhere]

• Replaced distutils with setuptools #4797, #4809, #4814, #4817, #4829, #4890 [hugovk, radarhere]

• Add MIME type to PsdImagePlugin #4788 [samamorgan]

• Allow ImageOps.autocontrast to specify low and high cutoffs separately #4749 [millionhz, radarhere]

8.0.0

Backwards incompatible changes

Python 3.5

Pillow has dropped support for Python 3.5, which reached end-of-life on 2020-09-13.

PyPy 7.1.x

Pillow has dropped support for PyPy3 7.1.1. PyPy3 7.2.0, released on 2019-10-14, is now the minimum compatible version.

im.offset

im.offset() has been removed, call .ImageChops.offset() instead.

Image.fromstring, im.fromstring and im.tostring

• Image.fromstring() has been removed, call .Image.frombytes() instead.

• im.fromstring() has been removed, call ~PIL.Image.Image.frombytes() instead.

• im.tostring() has been removed, call ~PIL.Image.Image.tobytes() instead.

ImageCms.CmsProfile attributes

Some attributes in PIL.ImageCms.core.CmsProfile have been removed:

Removed	Use instead
color_space	Padded ~.CmsProfile.xcolor_space
pcs	Padded ~.CmsProfile.connection_space
product_copyright	Unicode ~.CmsProfile.copyright
product_desc	Unicode ~.CmsProfile.profile_description
product_description	Unicode ~.CmsProfile.profile_description
product_manufacturer	Unicode ~.CmsProfile.manufacturer
product_model	Unicode ~.CmsProfile.model

API changes

ImageDraw.text: stroke_width

Fixed issue where passing stroke_width with a non-zero value to .ImageDraw.text would cause the text to be offset by that amount.

ImageDraw.text: anchor

The anchor parameter of .ImageDraw.text has been implemented.

Use this parameter to change the position of text relative to the specified xy point. See text-anchors for details.

Add MIME type to PsdImagePlugin

"image/vnd.adobe.photoshop" is now registered as the .PsdImagePlugin.PsdImageFile MIME type.

API additions

Image.open: add formats parameter

Added a new formats parameter to .Image.open:

• A list or tuple of formats to attempt to load the file in. This can be used to restrict the set of formats checked. Pass None to try all supported formats. You can print the set of available formats by running python3 -m PIL or using the PIL.features.pilinfo function.

ImageOps.autocontrast: add mask parameter

.ImageOps.autocontrast can now take a mask parameter:

• Histogram used in contrast operation is computed using pixels within the mask. If no mask is given the entire image is used for histogram computation.

ImageOps.autocontrast cutoffs

Previously, the cutoff parameter of .ImageOps.autocontrast could only be a single number, used as the percent to cut off from the histogram on the low and high ends.

Now, it can also be a tuple (low, high).

ImageDraw.regular_polygon

A new method .ImageDraw.regular_polygon, draws a regular polygon of n_sides, inscribed in a bounding_circle.

For example draw.regular_polygon(((100, 100), 50), 5) draws a pentagon centered at the point (100, 100) with a polygon radius of 50.

ImageDraw.text: embedded_color

The methods .ImageDraw.text and .ImageDraw.multiline_text now support fonts with embedded color data.

To render text with embedded color data, use the parameter embedded_color=True.

Support for CBDT fonts requires FreeType 2.5 compiled with libpng. Support for SBIX fonts requires FreeType 2.5.1 compiled with libpng. Support for COLR fonts requires FreeType 2.10. SVG fonts are not yet supported.

ImageDraw.textlength

Two new methods .ImageDraw.textlength and .FreeTypeFont.getlength were added, returning the exact advance length of text with 1/64 pixel precision.

These can be used for word-wrapping or rendering text in parts.

ImageDraw.textbbox

Three new methods .ImageDraw.textbbox, .ImageDraw.multiline_textbbox, and .FreeTypeFont.getbbox return the bounding box of rendered text.

These functions accept an anchor parameter, see text-anchors for details.

Other changes

Improved ellipse-drawing algorithm

The ellipse-drawing algorithm has been changed from drawing a 360-sided polygon to one which resembles Bresenham's algorithm for circles. It should be faster and produce smoother curves, especially for smaller ellipses.

ImageDraw.text and ImageDraw.multiline_text

Fixed multiple issues in methods .ImageDraw.text and .ImageDraw.multiline_text sometimes causing unexpected text alignment issues.

The align parameter of .ImageDraw.multiline_text now gives better results in some cases.

TrueType fonts with embedded bitmaps are now supported.

Added writing of subIFDs

When saving EXIF data, Pillow is now able to write subIFDs, such as the GPS IFD. This should happen automatically when saving an image using the EXIF data that it was opened with, such as in ~PIL.ImageOps.exif_transpose.

Previously, the code of the first tag of the subIFD was incorrectly written as the offset.

Error for large BMP files

Previously, if a BMP file was too large, an OSError would be raised. Now, DecompressionBombError is used instead, as Pillow already uses for other formats.

Dark theme for docs

The https://pillow.readthedocs.io documentation will use a dark theme if the user has requested the system use one. Uses the prefers-color-scheme CSS media query.

• Do not convert I;16 images when showing PNGs #4744 [radarhere]

• Fixed ICNS file pointer saving #4741 [radarhere]

• Fixed loading non-RGBA mode APNGs with dispose background #4742 [radarhere]

• Deprecated _showxv #4714 [radarhere]

• Deprecate Image.show(command="...") #4646 [nulano, hugovk, radarhere]

• Updated JPEG magic number #4707 [Cykooz, radarhere]

• Change STRIPBYTECOUNTS to LONG if necessary when saving #4626 [radarhere, hugovk]

• Write JFIF header when saving JPEG #4639 [radarhere]

• Replaced tiff_jpeg with jpeg compression when saving TIFF images #4627 [radarhere]

• Writing TIFF tags: improved BYTE, added UNDEFINED #4605 [radarhere]

• Consider transparency when pasting text on an RGBA image #4566 [radarhere]

• Added method argument to single frame WebP saving #4547 [radarhere]

• Use ImageFileDirectory_v2 in Image.Exif #4637 [radarhere]

• Corrected reading EXIF metadata without prefix #4677 [radarhere]

• Fixed drawing a jointed line with a sequence of numeric values #4580 [radarhere]

• Added support for 1-D NumPy arrays #4608 [radarhere]

• Parse orientation from XMP tags #4560 [radarhere]

• Speed up text layout by not rendering glyphs #4652 [nulano]

• Fixed ZeroDivisionError in Image.thumbnail #4625 [radarhere]

• Replaced TiffImagePlugin DEBUG with logging #4550 [radarhere]

• Fix repeatedly loading .gbr #4620 [ElinksFr, radarhere]

• JPEG: Truncate icclist instead of setting to None #4613 [homm]

• Fixes default offset for Exif #4594 [rodrigob, radarhere]

• Fixed bug when unpickling TIFF images #4565 [radarhere]

• Fix pickling WebP #4561 [hugovk, radarhere]

• Replace IOError and WindowsError aliases with OSError #4536 [hugovk, radarhere]

7.2.0

API changes

Replaced TiffImagePlugin DEBUG with logging

TiffImagePlugin.DEBUG = True has been a way to print various debugging information when interacting with TIFF images. This has now been removed in favour of Python's logging module, already used in other places in the Pillow source code.

Corrected default offset when writing EXIF data

Previously, the default offset argument for ~PIL.Image.Exif.tobytes was 0, which did not include the magic header. It is now 8.

Moved to ImageFileDirectory_v2 in Image.Exif

Moved from the legacy PIL.TiffImagePlugin.ImageFileDirectory_v1 to PIL.TiffImagePlugin.ImageFileDirectory_v2 in PIL.Image.Exif. This means that Exif RATIONALs and SIGNED_RATIONALs are now read as PIL.TiffImagePlugin.IFDRational, instead of as a tuple with a numerator and a denominator.

TIFF BYTE tags format

TIFF BYTE tags were previously read as a tuple containing a bytestring. They are now read as just a single bytestring.

Deprecations

Image.show command parameter

The command parameter was deprecated and will be removed in a future release. Use a subclass of PIL.ImageShow.Viewer instead.

Image._showxv

Image._showxv has been deprecated. Use ~PIL.Image.Image.show instead. If custom behaviour is required, use ~PIL.ImageShow.register to add a custom ~PIL.ImageShow.Viewer class.

ImageFile.raise_ioerror

IOError was merged into OSError in Python 3.3. So, ImageFile.raise_ioerror is now deprecated and will be removed in a future release. Use ImageFile.raise_oserror instead.

• Raise an EOFError when seeking too far in PNG #4528 [radarhere]

7.1.2

Fix another regression seeking PNG files

This fixes a regression introduced in 7.1.0 when adding support for APNG files.

When calling seek(n) on a regular PNG where n > 0, it failed to raise an EOFError as it should have done, resulting in:

AttributeError: 'NoneType' object has no attribute 'read'

Pillow 7.1.2 now raises the correct exception.

• Fix regression seeking and telling PNGs #4512 #4514 [hugovk, radarhere]

7.1.1

Fix regression seeking PNG files

This fixes a regression introduced in 7.1.0 when adding support for APNG files when calling seek and tell:

>>> from PIL import Image
>>> with Image.open("Tests/images/hopper.png") as im:
...     im.seek(0)
...
Traceback (most recent call last):
  File "<stdin>", line 2, in <module>
  File "/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/site-packages/PIL/PngImagePlugin.py", line 739, in seek
    if not self._seek_check(frame):
  File "/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/site-packages/PIL/ImageFile.py", line 306, in _seek_check
    return self.tell() != frame
  File "/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/site-packages/PIL/PngImagePlugin.py", line 827, in tell
    return self.__frame
AttributeError: 'PngImageFile' object has no attribute '_PngImageFile__frame'
>>>

• Fix multiple OOB reads in FLI decoding #4503 [wiredfool]

• Fix buffer overflow in SGI-RLE decoding #4504 [wiredfool, hugovk]

• Fix bounds overflow in JPEG 2000 decoding #4505 [wiredfool]

• Fix bounds overflow in PCX decoding #4506 [wiredfool]

• Fix 2 buffer overflows in TIFF decoding #4507 [wiredfool]

• Add APNG support #4243 [pmrowla, radarhere, hugovk]

• ImageGrab.grab() for Linux with XCB #4260 [nulano, radarhere]

• Added three new channel operations #4230 [dwastberg, radarhere]

• Prevent masking of Image reduce method in Jpeg2KImagePlugin #4474 [radarhere, homm]

• Added reading of earlier ImageMagick PNG EXIF data #4471 [radarhere]

• Fixed endian handling for I;16 getextrema #4457 [radarhere]

• Release buffer if function returns prematurely #4381 [radarhere]

• Add JPEG comment to info dictionary #4455 [radarhere]

• Fix size calculation of Image.thumbnail() #4404 [orlnub123]

• Fixed stroke on FreeType < 2.9 #4401 [radarhere]

• If present, only use alpha channel for bounding box #4454 [radarhere]

• Warn if an unknown feature is passed to features.check() #4438 [jdufresne]

• Fix Name field length when saving IM images #4424 [hugovk, radarhere]

• Allow saving of zero quality JPEG images #4440 [radarhere]

• Allow explicit zero width to hide outline #4334 [radarhere]

• Change ContainerIO return type to match file object mode #4297 [jdufresne, radarhere]

• Only draw each polygon pixel once #4333 [radarhere]

• Add support for shooting situation Exif IFD tags #4398 [alexagv]

• Handle multiple and malformed JPEG APP13 markers #4370 [homm]

• Depends: Update libwebp to 1.1.0 #4342, libjpeg to 9d #4352 [radarhere]

7.1.0

Security

This release includes many security fixes.

2020-10177: Multiple out-of-bounds reads in FLI decoding

Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.

2020-10378: Bounds overflow in PCX decoding

In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer.

2020-10379: Two buffer overflows in TIFF decoding

In Pillow before 7.1.0, there are two buffer overflows in libImaging/TiffDecode.c.

2020-10994: Bounds overflow in JPEG 2000 decoding

In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file.

2020-11538: Buffer overflow in SGI-RLE decoding

In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than 2020-5311.

API changes

Allow saving of zero quality JPEG images

If no quality was specified when saving a JPEG, Pillow internally used a value of zero to indicate that the default quality should be used. However, this removed the ability to actually save a JPEG with zero quality. This has now been resolved.

from PIL import Image
im = Image.open("hopper.jpg")
im.save("out.jpg", quality=0)

API additions

New channel operations

Three new channel operations have been added: ~PIL.ImageChops.soft_light, ~PIL.ImageChops.hard_light and ~PIL.ImageChops.overlay.

PILLOW_VERSION constant

PILLOW_VERSION has been re-added but is deprecated and will be removed in a future release. Use __version__ instead.

It was initially removed in Pillow 7.0.0, but brought back in 7.1.0 to give projects more time to upgrade.

Reading JPEG comments

When opening a JPEG image, the comment may now be read into ~PIL.Image.Image.info.

Support for different charset encodings in PcfFontFile

Previously PcfFontFile output only bitmap PIL fonts with ISO 8859-1 encoding, even though the PCF format supports Unicode, making it hard to work with Pillow with bitmap fonts in languages which use different character sets.

Now it's possible to set a different charset encoding in PcfFontFile's class constructor. By default, it generates a PIL font file with ISO 8859-1 as before. The generated PIL font file still contains up to 256 characters, but the character set is different depending on the selected encoding.

To use such a font with ImageDraw.text, call it with a bytes object with the same encoding as the font file.

X11 ImageGrab.grab()

Support has been added for ImageGrab.grab() on Linux using the X server with the XCB library.

An optional xdisplay parameter has been added to select the X server, with the default value of None using the default X server.

Passing a different value on Windows or macOS will force taking a snapshot using the selected X server; pass an empty string to use the default X server. XCB support is not included in pre-compiled wheels for Windows and macOS.

Other changes

If present, only use alpha channel for bounding box

When the ~PIL.Image.Image.getbbox method calculates the bounding box, for an RGB image it trims black pixels. Similarly, for an RGBA image it would trim black transparent pixels. This is now changed so that if an image has an alpha channel (RGBA, RGBa, PA, LA, La), any transparent pixels are trimmed.

Improved APNG support

Added support for reading and writing Animated Portable Network Graphics (APNG) images. The PNG plugin now supports using the ~PIL.Image.Image.seek method and the ~PIL.ImageSequence.Iterator class to read APNG frame sequences. The PNG plugin also now supports using the append_images argument to write APNG frame sequences. See apng-sequences for further details.

• Drop support for EOL Python 2.7 #4109 [hugovk, radarhere, jdufresne]

• Fix rounding error on RGB to L conversion #4320 [homm]

• Exif writing fixes: Rational boundaries and signed/unsigned types #3980 [kkopachev, radarhere]

• Allow loading of WMF images at a given DPI #4311 [radarhere]

• Added reduce operation #4251 [homm]

• Raise ValueError for io.StringIO in Image.open #4302 [radarhere, hugovk]

• Fix thumbnail geometry when DCT scaling is used #4231 [homm, radarhere]

• Use default DPI when exif provides invalid x_resolution #4147 [beipang2, radarhere]

• Change default resize resampling filter from NEAREST to BICUBIC #4255 [homm]

• Fixed black lines on upscaled images with the BOX filter #4278 [homm]

• Better thumbnail aspect ratio preservation #4256 [homm]

• Add La mode packing and unpacking #4248 [homm]

• Include tests in coverage reports #4173 [hugovk]

• Handle broken Photoshop data #4239 [radarhere]

• Raise a specific exception if no data is found for an MPO frame #4240 [radarhere]

• Fix Unicode support for PyPy #4145 [nulano]

• Added UnidentifiedImageError #4182 [radarhere, hugovk]

• Remove deprecated __version__ from plugins #4197 [hugovk, radarhere]

• Fixed freeing unallocated pointer when resizing with height too large #4116 [radarhere]

• Copy info in Image.transform #4128 [radarhere]

• Corrected DdsImagePlugin setting info gamma #4171 [radarhere]

• Depends: Update libtiff to 4.1.0 #4195, Tk Tcl to 8.6.10 #4229, libimagequant to 2.12.6 #4318 [radarhere]

• Improve handling of file resources #3577 [jdufresne]

• Removed CI testing of Fedora 29 #4165 [hugovk]

• Added pypy3 to tox envlist #4137 [jdufresne]

• Drop support for EOL PyQt4 and PySide #4108 [hugovk, radarhere]

• Removed deprecated setting of TIFF image sizes #4114 [radarhere]

• Removed deprecated PILLOW_VERSION #4107 [hugovk]

• Changed default frombuffer raw decoder args #1730 [radarhere]

7.0.0

Backwards incompatible changes

Python 2.7

Pillow has dropped support for Python 2.7, which reached end-of-life on 2020-01-01.

PILLOW_VERSION constant

PILLOW_VERSION has been removed. Use __version__ instead.

PIL.*ImagePlugin.__version__ attributes

The version constants of individual plugins have been removed. Use PIL.__version__ instead.

Removed	Removed	Removed
BmpImagePlugin.__version__	Jpeg2KImagePlugin.__version__	PngImagePlugin.__version__
CurImagePlugin.__version__	JpegImagePlugin.__version__	PpmImagePlugin.__version__
DcxImagePlugin.__version__	McIdasImagePlugin.__version__	PsdImagePlugin.__version__
EpsImagePlugin.__version__	MicImagePlugin.__version__	SgiImagePlugin.__version__
FliImagePlugin.__version__	MpegImagePlugin.__version__	SunImagePlugin.__version__
FpxImagePlugin.__version__	MpoImagePlugin.__version__	TgaImagePlugin.__version__
GdImageFile.__version__	MspImagePlugin.__version__	TiffImagePlugin.__version__
GifImagePlugin.__version__	PalmImagePlugin.__version__	WmfImagePlugin.__version__
IcoImagePlugin.__version__	PcdImagePlugin.__version__	XbmImagePlugin.__version__
ImImagePlugin.__version__	PcxImagePlugin.__version__	XpmImagePlugin.__version__
ImtImagePlugin.__version__	PdfImagePlugin.__version__	XVThumbImagePlugin.__version__
IptcImagePlugin.__version__	PixarImagePlugin.__version__

PyQt4 and PySide

Qt 4 reached end-of-life on 2015-12-19. Its Python bindings are also EOL: PyQt4 since 2018-08-31 and PySide since 2015-10-14.

Support for PyQt4 and PySide has been removed from ImageQt. Please upgrade to PyQt5 or PySide2.

Setting the size of TIFF images

Setting the size of a TIFF image directly (eg. im.size = (256, 256)) throws an error. Use Image.resize instead.

Default resampling filter

The default resampling filter has been changed to the high-quality convolution Image.BICUBIC instead of Image.NEAREST, for the ~PIL.Image.Image.resize method and the ~PIL.ImageOps.pad, ~PIL.ImageOps.scale and ~PIL.ImageOps.fit functions. Image.NEAREST is still always used for images in "P" and "1" modes. See concept-filters to learn the difference. In short, Image.NEAREST is a very fast filter, but simple and low-quality.

Image.draft() return value

If the ~PIL.Image.Image.draft method has no effect, it returns None. If it does have an effect, then it previously returned the image itself. However, unlike other chain methods, ~PIL.Image.Image.draft does not return a modified version of the image, but modifies it in-place. So instead, if ~PIL.Image.Image.draft has an effect, Pillow will now return a tuple of the image mode and a co-ordinate box. The box is the original coordinates in the bounds of resulting image. This may be useful in a subsequent ~PIL.Image.Image.resize call.

API additions

Custom unidentified image error

Pillow will now throw a custom UnidentifiedImageError when an image cannot be identified. For backwards compatibility, this will inherit from OSError.

New argument reducing_gap for Image.resize() and Image.thumbnail() methods

Speeds up resizing by resizing the image in two steps. The bigger reducing_gap, the closer the result to the fair resampling. The smaller reducing_gap, the faster resizing. With reducing_gap greater or equal to 3.0, the result is indistinguishable from fair resampling.

The default value for ~PIL.Image.Image.resize is None, which means that the optimization is turned off by default.

The default value for ~PIL.Image.Image.thumbnail is 2.0, which is very close to fair resampling while still being faster in many cases. In addition, the same gap is applied when ~PIL.Image.Image.thumbnail calls ~PIL.Image.Image.draft, which may greatly improve the quality of JPEG thumbnails. As a result, ~PIL.Image.Image.thumbnail in the new version provides equally high speed and high quality from any source (JPEG or arbitrary images).

New Image.reduce() method

~PIL.Image.Image.reduce is a highly efficient operation to reduce an image by integer times. Normally, it shouldn't be used directly. Used internally by ~PIL.Image.Image.resize and ~PIL.Image.Image.thumbnail methods to speed up resize when a new argument reducing_gap is set.

Loading WMF images at a given DPI

On Windows, Pillow can read WMF files, with a default DPI of 72. An image can now also be loaded at another resolution:

from PIL import Image
with Image.open("drawing.wmf") as im:
    im.load(dpi=144)

Other changes

Image.__del__

Implicitly closing the image's underlying file in Image.__del__ has been removed. Use a context manager or call ~PIL.Image.Image.close instead to close the file in a deterministic way.

Previous method:

im = Image.open("hopper.png")
im.save("out.jpg")

Use instead:

with Image.open("hopper.png") as im:
    im.save("out.jpg")

Better thumbnail geometry

When calculating the new dimensions in ~PIL.Image.Image.thumbnail, round to the nearest integer, instead of always rounding down. This better preserves the original aspect ratio.

When the image width or height is not divisible by 8 the last row and column in the image get the correct weight after JPEG DCT scaling.

• This is the last Pillow release to support Python 2.7 #3642

• Overflow checks for realloc for tiff decoding. CVE-2020-5310 [wiredfool, radarhere]

• Catch SGI buffer overrun. CVE-2020-5311 [radarhere]

• Catch PCX P mode buffer overrun. CVE-2020-5312 [radarhere]

• Catch FLI buffer overrun. CVE-2020-5313 [radarhere]

• Raise an error for an invalid number of bands in FPX image. CVE-2019-19911 [wiredfool, radarhere]

6.2.2

Security

This release fixes several buffer overflow issues and a DOS attack vulnerability.

2020-5310, 2020-5311, 2020-5312, 2020-5313: Overflow checks added

Overflow checks have been added when calculating the size of a memory block to be reallocated in the processing of TIFF, SGI, PCX and FLI images.

2019-19911: DOS attack vulnerability

If an FPX image reports that it has a large number of bands, a large amount of resources will be used when trying to process the image. This is fixed by limiting the number of bands to those usable by Pillow.

• Add support for Python 3.8 #4141 [hugovk]

6.2.1

API changes

Deprecations

Python 2.7

Python 2.7 reaches end-of-life on 2020-01-01.

Pillow 7.0.0 will be released on 2020-01-01 and will drop support for Python 2.7, making Pillow 6.2.x the last release series to support Python 2.

Other changes

Support added for Python 3.8

Pillow 6.2.1 supports Python 3.8.

• Catch buffer overruns #4104 [radarhere]

• Initialize rows_per_strip when RowsPerStrip tag is missing #4034 [cgohlke, radarhere]

• Raise error if TIFF dimension is a string #4103 [radarhere]

• Added decompression bomb checks #4102 [radarhere]

• Fix ImageGrab.grab DPI scaling on Windows 10 version 1607+ #4000 [nulano, radarhere]

• Corrected negative seeks #4101 [radarhere]

• Added argument to capture all screens on Windows #3950 [nulano, radarhere]

• Updated warning to specify when Image.frombuffer defaults will change #4086 [radarhere]

• Changed WindowsViewer format to PNG #4080 [radarhere]

• Use TIFF orientation #4063 [radarhere]

• Raise the same error if a truncated image is loaded a second time #3965 [radarhere]

• Lazily use ImageFileDirectory_v1 values from Exif #4031 [radarhere]

• Improved HSV conversion #4004 [radarhere]

• Added text stroking #3978 [radarhere, hugovk]

• No more deprecated bdist_wininst .exe installers #4029 [hugovk]

• Do not allow floodfill to extend into negative coordinates #4017 [radarhere]

• Fixed arc drawing bug for a non-whole number of degrees #4014 [radarhere]

• Fix bug when merging identical images to GIF with a list of durations #4003 [djy0, radarhere]

• Fix bug in TIFF loading of BufferedReader #3998 [chadawagner]

• Added fallback for finding ld on MinGW Cygwin #4019 [radarhere]

• Remove indirect dependencies from requirements.txt #3976 [hugovk]

• Depends: Update libwebp to 1.0.3 #3983, libimagequant to 2.12.5 #3993, freetype to 2.10.1 #3991 [radarhere]

• Change overflow check to use PY_SSIZE_T_MAX #3964 [radarhere]

• Report reason for pytest skips #3942 [hugovk]

6.2.0

Security

This release catches several buffer overruns and fixes 2019-16865.

Buffer overruns

In RawDecode.c, an error is now thrown if skip is calculated to be less than zero. It is intended to skip padding between lines, not to go backwards.

In PsdImagePlugin, if the combined sizes of the individual parts is larger than the declared size of the extra data field, then it looked for the next layer by seeking backwards. This is now corrected by seeking to (the start of the layer + the size of the extra data field) instead of (the read parts of the layer + the rest of the layer).

Decompression bomb checks have been added to GIF and ICO formats.

An error is now raised if a TIFF dimension is a string, rather than trying to perform operations on it.

2019-16865: Fix DOS attack

The CVE is regarding DOS problems, such as consuming large amounts of memory, or taking a large amount of time to process an image.

API changes

Image.getexif

To allow for lazy loading of Exif data, Image.getexif() now returns a shared instance of Image.Exif.

Deprecations

Image.frombuffer

There has been a longstanding warning that the defaults of Image.frombuffer may change in the future for the "raw" decoder. The change will now take place in Pillow 7.0.

API additions

Text stroking

stroke_width and stroke_fill arguments have been added to text drawing operations. They allow text to be outlined, setting the width of the stroke and and the color respectively. If not provided, stroke_fill will default to the fill parameter.

from PIL import Image, ImageDraw, ImageFont

font = ImageFont.truetype("Tests/fonts/FreeMono.ttf", 40)
font.getsize_multiline("A", stroke_width=2)
font.getsize("ABC\nAaaa", stroke_width=2)

im = Image.new("RGB", (100, 100))
draw = ImageDraw.Draw(im)
draw.textsize("A", font, stroke_width=2)
draw.multiline_textsize("ABC\nAaaa", font, stroke_width=2)
draw.text((10, 10), "A", "#f00", font, stroke_width=2, stroke_fill="#0f0")
draw.multiline_text((10, 10), "A\nB", "#f00", font,
                    stroke_width=2, stroke_fill="#0f0")

For example,

from PIL import Image, ImageDraw, ImageFont

im = Image.new("RGB", (120, 130))
draw = ImageDraw.Draw(im)
font = ImageFont.truetype("Tests/fonts/FreeMono.ttf", 120)
draw.text((10, 10), "A", "#f00", font, stroke_width=2, stroke_fill="#0f0")

creates the following image:

ImageGrab on multi-monitor Windows

An all_screens argument has been added to ImageGrab.grab. If True, all monitors will be included in the created image.

Other changes

Removed bdist_wininst .exe installers

.exe installers fell out of favour with 527, and will be deprecated in Python 3.8. Pillow will no longer be distributing them. Wheels should be used instead.

Flags for libwebp in wheels

When building libwebp for inclusion in wheels, Pillow now adds the -O3 and -DNDEBUG CFLAGS. These flags would be used by default if building libwebp without debugging, and using them fixes a significant decrease in speed when a wheel-installed copy of Pillow performs libwebp operations.

• Deprecate Image.__del__ #3929 [jdufresne]

• Tiff: Add support for JPEG quality #3886 [olt]

• Respect the PKG_CONFIG environment variable when building #3928 [chewi]

• Use explicit memcpy() to avoid unaligned memory accesses #3225 [DerDakon]

• Improve encoding of TIFF tags #3861 [olt]

• Update Py_UNICODE to Py_UCS4 #3780 [nulano]

• Consider I;16 pixel size when drawing #3899 [radarhere]

• Add TIFFTAG_SAMPLEFORMAT to blocklist #3926 [cgohlke, radarhere]

• Create GIF deltas from background colour of GIF frames if disposal mode is 2 #3708 [sircinnamon, radarhere]

• Added ImageSequence all_frames #3778 [radarhere]

• Use unsigned int to store TIFF IFD offsets #3923 [cgohlke]

• Include CPPFLAGS when searching for libraries #3819 [jefferyto]

• Updated TIFF tile descriptors to match current decoding functionality #3795 [dmnisson]

• Added an image.entropy() method (second revision) #3608 [fish2000]

• Pass the correct types to PyArg_ParseTuple #3880 [QuLogic]

• Fixed crash when loading non-font bytes #3912 [radarhere]

• Fix SPARC memory alignment issues in Pack/Unpack functions #3858 [kulikjak]

• Added CMYK;16B and CMYK;16N unpackers #3913 [radarhere]

• Fixed bugs in calculating text size #3864 [radarhere]

• Add __main__.py to output basic format and support information #3870 [jdufresne]

• Added variation font support #3802 [radarhere]

• Do not down-convert if image is LA when showing with PNG format #3869 [radarhere]

• Improve handling of PSD frames #3759 [radarhere]

• Improved ICO and ICNS loading #3897 [radarhere]

• Changed Preview application path so that it is no longer static #3896 [radarhere]

• Corrected ttb text positioning #3856 [radarhere]

• Handle unexpected ICO image sizes #3836 [radarhere]

• Fixed bits value for RGB;16N unpackers #3837 [kkopachev]

• Travis CI: Add Fedora 30, remove Fedora 28 #3821 [hugovk]

• Added reading of CMYK;16L TIFF images #3817 [radarhere]

• Fixed dimensions of 1-bit PDFs #3827 [radarhere]

• Fixed opening mmap image through Path on Windows #3825 [radarhere]

• Fixed ImageDraw arc gaps #3824 [radarhere]

• Expand GIF to include frames with extents outside the image size #3822 [radarhere]

• Fixed ImageTk getimage #3814 [radarhere]

• Fixed bug in decoding large images #3791 [radarhere]

• Fixed reading APP13 marker without Photoshop data #3771 [radarhere]

• Added option to include layered windows in ImageGrab.grab on Windows #3808 [radarhere]

• Detect libimagequant when installed by pacman on MingW #3812 [radarhere]

• Fixed raqm layout bug #3787 [radarhere]

• Fixed loading font with non-Unicode path on Windows #3785 [radarhere]

• Travis CI: Upgrade PyPy from 6.0.0 to 7.1.1 #3783 [hugovk, johnthagen]

• Depends: Updated openjpeg to 2.3.1 #3794, raqm to 0.7.0 #3877, libimagequant to 2.12.3 #3889 [radarhere]

• Fix numpy bool bug #3790 [radarhere]

6.1.0

Deprecations

Image.__del__

Implicitly closing the image's underlying file in Image.__del__ has been deprecated. Use a context manager or call Image.close() instead to close the file in a deterministic way.

Deprecated:

im = Image.open("hopper.png")
im.save("out.jpg")

Use instead:

with Image.open("hopper.png") as im:
    im.save("out.jpg")

API additions

Image.entropy

Calculates and returns the entropy for the image. A bilevel image (mode "1") is treated as a grayscale ("L") image by this method. If a mask is provided, the method employs the histogram for those parts of the image where the mask image is non-zero. The mask image must have the same size as the image, and be either a bi-level image (mode "1") or a grayscale image ("L").

ImageGrab.grab

An optional include_layered_windows parameter has been added to ImageGrab.grab, defaulting to False. If true, layered windows will be included in the resulting image on Windows.

ImageSequence.all_frames

A new method to facilitate applying a given function to all frames in an image, or to all frames in a list of images. The frames are returned as a list of separate images. For example, ImageSequence.all_frames(im, lambda im_frame: im_frame.rotate(90)) could be used to return all frames from an image, each rotated 90 degrees.

Variation fonts

Variation fonts are now supported, allowing for different styles from the same font file. ImageFont.FreeTypeFont has four new methods, PIL.ImageFont.FreeTypeFont.get_variation_names and PIL.ImageFont.FreeTypeFont.set_variation_by_name for using named styles, and PIL.ImageFont.FreeTypeFont.get_variation_axes and PIL.ImageFont.FreeTypeFont.set_variation_by_axes for using font axes instead. An IOError will be raised if the font is not a variation font. FreeType 2.9.1 or greater is required.

Other changes

ImageTk.getimage

This function is now supported. It returns the contents of an ImageTk.PhotoImage as an RGBA Image.Image instance.

Image quality for JPEG compressed TIFF

The TIFF encoder accepts a quality parameter for jpeg compressed TIFF files. A value from 0 (worst) to 100 (best) controls the image quality, similar to the JPEG encoder. The default is 75. For example:

im.save("out.tif", compression="jpeg", quality=85)

Improve encoding of TIFF tags

The TIFF encoder supports more types, especially arrays. This is required for the GeoTIFF format which encodes geospatial information.

• Pass tagtype from v2 directory to libtiff encoder, instead of autodetecting type.

• Use explicit types eg. uint32_t for TIFF_LONG to fix issues on platforms with 64-bit longs.

• Add support for multiple values (arrays). Requires type in v2 directory and values must be passed as a tuple.

• Add support for signed types eg. TIFFTypes.TIFF_SIGNED_SHORT.

Respect PKG_CONFIG environment variable when building

This variable is commonly used by other build systems and using it can help with cross-compiling. Falls back to pkg-config as before.

Top-to-bottom complex text rendering

Drawing text in the 'ttb' direction with ImageFont has been significantly improved and requires Raqm 0.7 or greater.