Enforce newer pillow when possible

Author: molinav

CHANGELOG.md

@@ -22,6 +22,22 @@ since version 1.3.0.
 - Fix `sdist` so that packages can be built from source distributions
   (PR [#532] by @DWesl).
 - Specify Cython language level for `_geoslib` extension explicitly.
+- Enforce up-to-date `pillow` dependency when possible:
+  - `pillow >= 9.0.0` for Python >= 3.7 due to `pillow` vulnerabilities
+    [CVE-2022-22815], [CVE-2022-22816] and [CVE-2022-22817].
+  - `pillow >= 8.3.2` for Python >= 3.6 due to `pillow` vulnerabilities
+    [CVE-2020-35653], [CVE-2020-35654], [CVE-2020-35655],
+    [CVE-2021-23437], [CVE-2021-25287], [CVE-2021-25288],
+    [CVE-2021-25290], [CVE-2021-25291], [CVE-2021-25292],
+    [CVE-2021-25293], [CVE-2021-27921], [CVE-2021-27922],
+    [CVE-2021-27923], [CVE-2021-28675], [CVE-2021-28676],
+    [CVE-2021-28677], [CVE-2021-28678] and [CVE-2021-34552].
+  - `pillow >= 7.1.0` for Python >= 3.5 due to `pillow` vulnerabilities
+    [CVE-2020-10177], [CVE-2020-10378], [CVE-2020-10379],
+    [CVE-2020-10994] and [CVE-2020-11538].
+  - `pillow >= 6.2.2` For Python == 2.7 due to `pillow` vulnerabilities
+    [CVE-2019-16865], [CVE-2019-19911], [CVE-2020-5310], [CVE-2020-5312]
+    and [CVE-2020-5313].
 
 ### Removed
 - Remove deprecation notices (issue [#527]).
@@ -946,5 +962,67 @@ https://github.com/matplotlib/basemap/compare/v1.0.3rel...v1.0.4rel
 [1.0.3]:
 https://github.com/matplotlib/basemap/tree/v1.0.3rel
 
+[CVE-2022-22817]:
+https://nvd.nist.gov/vuln/detail/CVE-2022-22817
+[CVE-2022-22816]:
+https://nvd.nist.gov/vuln/detail/CVE-2022-22816
+[CVE-2022-22815]:
+https://nvd.nist.gov/vuln/detail/CVE-2022-22815
+[CVE-2021-34552]:
+https://nvd.nist.gov/vuln/detail/CVE-2021-34552
 [CVE-2021-33430]:
 https://nvd.nist.gov/vuln/detail/CVE-2021-33430
+[CVE-2021-28678]:
+https://nvd.nist.gov/vuln/detail/CVE-2021-28678
+[CVE-2021-28677]:
+https://nvd.nist.gov/vuln/detail/CVE-2021-28677
+[CVE-2021-28676]:
+https://nvd.nist.gov/vuln/detail/CVE-2021-28676
+[CVE-2021-28675]:
+https://nvd.nist.gov/vuln/detail/CVE-2021-28675
+[CVE-2021-27923]:
+https://nvd.nist.gov/vuln/detail/CVE-2021-27923
+[CVE-2021-27922]:
+https://nvd.nist.gov/vuln/detail/CVE-2021-27922
+[CVE-2021-27921]:
+https://nvd.nist.gov/vuln/detail/CVE-2021-27921
+[CVE-2021-25293]:
+https://nvd.nist.gov/vuln/detail/CVE-2021-25293
+[CVE-2021-25292]:
+https://nvd.nist.gov/vuln/detail/CVE-2021-25292
+[CVE-2021-25291]:
+https://nvd.nist.gov/vuln/detail/CVE-2021-25291
+[CVE-2021-25290]:
+https://nvd.nist.gov/vuln/detail/CVE-2021-25290
+[CVE-2021-25288]:
+https://nvd.nist.gov/vuln/detail/CVE-2021-25288
+[CVE-2021-25287]:
+https://nvd.nist.gov/vuln/detail/CVE-2021-25287
+[CVE-2021-23437]:
+https://nvd.nist.gov/vuln/detail/CVE-2021-23437
+[CVE-2020-35655]:
+https://nvd.nist.gov/vuln/detail/CVE-2020-35655
+[CVE-2020-35654]:
+https://nvd.nist.gov/vuln/detail/CVE-2020-35654
+[CVE-2020-35653]:
+https://nvd.nist.gov/vuln/detail/CVE-2020-35653
+[CVE-2020-11538]:
+https://nvd.nist.gov/vuln/detail/CVE-2020-11538
+[CVE-2020-10994]:
+https://nvd.nist.gov/vuln/detail/CVE-2020-10994
+[CVE-2020-10379]:
+https://nvd.nist.gov/vuln/detail/CVE-2020-10379
+[CVE-2020-10378]:
+https://nvd.nist.gov/vuln/detail/CVE-2020-10378
+[CVE-2020-10177]:
+https://nvd.nist.gov/vuln/detail/CVE-2020-10177
+[CVE-2020-5313]:
+https://nvd.nist.gov/vuln/detail/CVE-2020-5313
+[CVE-2020-5312]:
+https://nvd.nist.gov/vuln/detail/CVE-2020-5312
+[CVE-2020-5310]:
+https://nvd.nist.gov/vuln/detail/CVE-2020-5310
+[CVE-2019-19911]:
+https://nvd.nist.gov/vuln/detail/CVE-2019-19911
+[CVE-2019-16865]:
+https://nvd.nist.gov/vuln/detail/CVE-2019-16865

packages/basemap/requirements-test.txt

@@ -21,9 +21,11 @@ ordereddict; python_version == "2.6"
 netCDF4 >= 1.3, < 1.4; python_version < "3.6"
 netCDF4 >= 1.3, < 1.5.6; python_version >= "3.6"
 
-pillow >= 3.4, < 4.0; python_version == "2.6"
-pillow >= 6.2, < 7.0; python_version == "2.7"
-pillow >= 3.4, < 4.0; python_version == "3.2"
-pillow >= 4.3, < 5.0; python_version == "3.3"
-pillow >= 5.4, < 6.0; python_version == "3.4"
-pillow >= 6.2, < 8.5; python_version >= "3.5"
+pillow >= 3.4.0, < 4.0.0; python_version == "2.6"
+pillow >= 6.2.2, < 7.0.0; python_version == "2.7"
+pillow >= 3.4.0, < 4.0.0; python_version == "3.2"
+pillow >= 4.3.0, < 5.0.0; python_version == "3.3"
+pillow >= 5.4.0, < 6.0.0; python_version == "3.4"
+pillow >= 7.1.0, < 8.0.0; python_version == "3.5"
+pillow >= 8.3.2, < 9.0.0; python_version == "3.6"
+pillow >= 9.0.0, < 10.0.0; python_version >= "3.7"