{ "$schema": "http://cyclonedx.org/schema/bom-1.7.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.7", "serialNumber": "urn:uuid:81a9dfa3-d713-4390-be28-45c6979b49ca", "version": 1, "metadata": { "timestamp": "2026-10-16T20:10:55Z", "lifecycles": [ { "phase": "build" } ], "tools": { "components": [ { "type": "application", "name": "generate-sbom.py", "group": "pillow" } ] }, "component": { "bom-ref": "pkg:pypi/pillow@13.0.0", "type": "library", "name": "Pillow", "version": "13.0.0", "description": "Python Imaging Library (fork)", "licenses": [ { "license": { "id": "MIT-CMU" } } ], "purl": "pkg:pypi/pillow@13.0.0", "externalReferences": [ { "type": "website", "url": "https://python-pillow.org" }, { "type": "vcs", "url": "https://github.com/python-pillow/Pillow" }, { "type": "documentation", "url": "https://pillow.readthedocs.io" }, { "type": "security-contact", "url": "https://github.com/python-pillow/Pillow/security/policy" } ] } }, "components": [ { "bom-ref": "pkg:pypi/pillow@13.0.0#c-ext/PIL._avif", "type": "library", "name": "PIL._avif", "version": "13.0.0", "description": "AVIF image format extension", "licenses": [ { "license": { "id": "MIT-CMU" } } ], "purl": "pkg:pypi/pillow@13.0.0#c-ext/PIL._avif" }, { "bom-ref": "pkg:pypi/pillow@13.0.0#c-ext/PIL._imaging", "type": "library", "name": "PIL._imaging", "version": "13.0.0", "description": "Core image processing extension (decode, encode, map, display, outline, path, libImaging)", "licenses": [ { "license": { "id": "MIT-CMU" } } ], "purl": "pkg:pypi/pillow@13.0.0#c-ext/PIL._imaging" }, { "bom-ref": "pkg:pypi/pillow@13.0.0#c-ext/PIL._imagingcms", "type": "library", "name": "PIL._imagingcms", "version": "13.0.0", "description": "LittleCMS2 colour management extension", "licenses": [ { "license": { "id": "MIT-CMU" } } ], "purl": "pkg:pypi/pillow@13.0.0#c-ext/PIL._imagingcms" }, { "bom-ref": "pkg:pypi/pillow@13.0.0#c-ext/PIL._imagingft", "type": "library", "name": "PIL._imagingft", "version": "13.0.0", "description": "FreeType font rendering extension", "licenses": [ { "license": { "id": "MIT-CMU" } } ], "purl": "pkg:pypi/pillow@13.0.0#c-ext/PIL._imagingft" }, { "bom-ref": "pkg:pypi/pillow@13.0.0#c-ext/PIL._imagingmath", "type": "library", "name": "PIL._imagingmath", "version": "13.0.0", "description": "Image math operations extension", "licenses": [ { "license": { "id": "MIT-CMU" } } ], "purl": "pkg:pypi/pillow@13.0.0#c-ext/PIL._imagingmath" }, { "bom-ref": "pkg:pypi/pillow@13.0.0#c-ext/PIL._imagingmorph", "type": "library", "name": "PIL._imagingmorph", "version": "13.0.0", "description": "Image morphology extension", "licenses": [ { "license": { "id": "MIT-CMU" } } ], "purl": "pkg:pypi/pillow@13.0.0#c-ext/PIL._imagingmorph" }, { "bom-ref": "pkg:pypi/pillow@13.0.0#c-ext/PIL._imagingtk", "type": "library", "name": "PIL._imagingtk", "version": "13.0.0", "description": "Tk/Tcl display extension", "licenses": [ { "license": { "id": "MIT-CMU" } } ], "purl": "pkg:pypi/pillow@13.0.0#c-ext/PIL._imagingtk" }, { "bom-ref": "pkg:pypi/pillow@13.0.0#c-ext/PIL._webp", "type": "library", "name": "PIL._webp", "version": "13.0.0", "description": "WebP image format extension", "licenses": [ { "license": { "id": "MIT-CMU" } } ], "purl": "pkg:pypi/pillow@13.0.0#c-ext/PIL._webp" }, { "bom-ref": "pkg:pypi/pillow@13.0.0#thirdparty/fribidi-shim", "type": "library", "name": "fribidi-shim", "version": "1.x", "description": "FriBiDi runtime-loading shim (vendored in src/thirdparty/fribidi-shim/); loads libfribidi dynamically", "licenses": [ { "license": { "id": "MIT-CMU" } } ], "hashes": [ { "alg": "SHA-256", "content": "1237c1af420466696635bcbcf5a7738b4662872dae7066df9df28c2e2f8603ea" } ], "pedigree": { "notes": "Pillow-authored shim; not taken from an upstream project. fribidi.h declares the subset of FriBiDi's public API types, constants and function signatures needed to load libfribidi at runtime. No FriBiDi implementation code is included." }, "externalReferences": [ { "type": "website", "url": "https://github.com/fribidi/fribidi" } ] }, { "bom-ref": "pkg:github/python/pythoncapi-compat", "type": "library", "name": "pythoncapi_compat", "description": "Backport header for new CPython C-API functions (vendored in src/thirdparty/pythoncapi_compat.h)", "licenses": [ { "license": { "id": "0BSD" } } ], "hashes": [ { "alg": "SHA-256", "content": "526f4e1a9f41c0dc641e24f723d85fe8b31b80405b6769510d998043907aa513" } ], "pedigree": { "notes": "Vendored unmodified from upstream python/pythoncapi-compat." }, "externalReferences": [ { "type": "vcs", "url": "https://github.com/python/pythoncapi-compat" } ] }, { "bom-ref": "pkg:pypi/pillow@13.0.0#thirdparty/raqm", "type": "library", "name": "raqm", "version": "0.11.0", "description": "Complex text layout library (vendored in src/thirdparty/raqm/)", "licenses": [ { "license": { "id": "MIT" } } ], "hashes": [ { "alg": "SHA-256", "content": "d3cb7309f91c5804fd19adc04efdcaf167d26e156f3459844b205b25dedca001" } ], "pedigree": { "ancestors": [ { "bom-ref": "pkg:github/HOST-Oman/libraqm@0.11.0#upstream", "type": "library", "name": "raqm", "version": "0.11.0", "purl": "pkg:github/HOST-Oman/libraqm@0.11.0", "externalReferences": [ { "type": "distribution", "url": "https://github.com/HOST-Oman/libraqm/releases/tag/v0.11.0" } ] } ], "patches": [ { "type": "unofficial", "diff": { "text": { "content": "LS0tIGEvc3JjL3JhcW0tdmVyc2lvbi5oLmluCisrKyBiL3NyYy9yYXFtLXZlcnNpb24uaApAQCAtMzEsMTEgKzMxLDExIEBACiAjaWZuZGVmIF9SQVFNX1ZFUlNJT05fSF8KICNkZWZpbmUgX1JBUU1fVkVSU0lPTl9IXwogCi0jZGVmaW5lIFJBUU1fVkVSU0lPTl9NQUpPUiBAUkFRTV9WRVJTSU9OX01BSk9SQAotI2RlZmluZSBSQVFNX1ZFUlNJT05fTUlOT1IgQFJBUU1fVkVSU0lPTl9NSU5PUkAKLSNkZWZpbmUgUkFRTV9WRVJTSU9OX01JQ1JPIEBSQVFNX1ZFUlNJT05fTUlDUk9ACisjZGVmaW5lIFJBUU1fVkVSU0lPTl9NQUpPUiAwCisjZGVmaW5lIFJBUU1fVkVSU0lPTl9NSU5PUiAxMQorI2RlZmluZSBSQVFNX1ZFUlNJT05fTUlDUk8gMAogCi0jZGVmaW5lIFJBUU1fVkVSU0lPTl9TVFJJTkcgIkBSQVFNX1ZFUlNJT05AIgorI2RlZmluZSBSQVFNX1ZFUlNJT05fU1RSSU5HICIwLjExLjAiCiAKICNkZWZpbmUgUkFRTV9WRVJTSU9OX0FUTEVBU1QobWFqb3IsbWlub3IsbWljcm8pIFwKICAgICAgICAgKChtYWpvcikqMTAwMDArKG1pbm9yKSoxMDArKG1pY3JvKSA8PSBcCg==", "encoding": "base64" } } }, { "type": "unofficial", "diff": { "text": { "content": "LS0tIGEvc3JjL3JhcW0uYworKysgYi9zcmMvcmFxbS5jCkBAIC0zNiw3ICszNiwxMSBAQAogI2luY2x1ZGUgPFNoZWVuQmlkaS5oPgogI2VuZGlmCiAjZWxzZQorI2lmZGVmIEhBVkVfRlJJQklESV9TWVNURU0KICNpbmNsdWRlIDxmcmliaWRpLmg+CisjZWxzZQorI2luY2x1ZGUgIi4uL2ZyaWJpZGktc2hpbS9mcmliaWRpLmgiCisjZW5kaWYKICNlbmRpZgogCiAjaW5jbHVkZSA8aGIuaD4K", "encoding": "base64" } } } ], "notes": "Vendored from upstream HOST-Oman/libraqm v0.11.0 with two Pillow-specific modifications: (1) raqm-version.h.in was pre-processed into raqm-version.h with version placeholders replaced by literal values; (2) raqm.c wraps the include in an #ifdef HAVE_FRIBIDI_SYSTEM guard so Pillow's bundled fribidi-shim is used when a system FriBiDi is absent." }, "externalReferences": [ { "type": "vcs", "url": "https://github.com/python-pillow/Pillow/tree/main/src/thirdparty/raqm" } ] }, { "bom-ref": "pkg:generic/freetype2", "type": "library", "name": "FreeType", "version": "2.14.3", "scope": "optional", "description": "Font rendering (optional, used by PIL._imagingft). Required for text/font support.", "licenses": [ { "license": { "id": "FTL" } } ], "externalReferences": [ { "type": "website", "url": "https://freetype.org" }, { "type": "distribution", "url": "https://download.savannah.gnu.org/releases/freetype/" } ] }, { "bom-ref": "pkg:generic/fribidi", "type": "library", "name": "FriBiDi", "version": "1.0.17", "scope": "optional", "description": "Unicode bidi algorithm library (optional, loaded at runtime by fribidi-shim).", "licenses": [ { "license": { "id": "LGPL-2.1-or-later" } } ], "externalReferences": [ { "type": "website", "url": "https://github.com/fribidi/fribidi" }, { "type": "distribution", "url": "https://github.com/fribidi/fribidi/releases" } ] }, { "bom-ref": "pkg:generic/harfbuzz", "type": "library", "name": "HarfBuzz", "version": "14.5.0", "scope": "optional", "description": "Text shaping (optional, required by libraqm for complex text layout).", "licenses": [ { "license": { "id": "MIT" } } ], "externalReferences": [ { "type": "website", "url": "https://harfbuzz.github.io" }, { "type": "distribution", "url": "https://github.com/harfbuzz/harfbuzz/releases" } ] }, { "bom-ref": "pkg:generic/libavif", "type": "library", "name": "libavif", "version": "1.4.2", "scope": "optional", "description": "AVIF codec (optional, used by PIL._avif).", "licenses": [ { "license": { "id": "BSD-2-Clause" } } ], "externalReferences": [ { "type": "website", "url": "https://github.com/AOMediaCodec/libavif" }, { "type": "distribution", "url": "https://github.com/AOMediaCodec/libavif/releases" } ] }, { "bom-ref": "pkg:generic/libimagequant", "type": "library", "name": "libimagequant", "version": "4.4.1", "scope": "optional", "description": "Improved colour quantization (optional).", "licenses": [ { "license": { "id": "GPL-3.0-or-later" } } ], "externalReferences": [ { "type": "website", "url": "https://pngquant.org/lib/" }, { "type": "distribution", "url": "https://github.com/ImageOptim/libimagequant/tags" } ] }, { "bom-ref": "pkg:generic/libjpeg", "type": "library", "name": "libjpeg / libjpeg-turbo", "version": "3.2.0", "description": "JPEG codec (required by default; disable with -C jpeg=disable).", "licenses": [ { "license": { "id": "IJG" } }, { "license": { "id": "BSD-3-Clause" } } ], "externalReferences": [ { "type": "website", "url": "https://ijg.org" }, { "type": "website", "url": "https://libjpeg-turbo.org" }, { "type": "distribution", "url": "https://github.com/libjpeg-turbo/libjpeg-turbo/releases" } ] }, { "bom-ref": "pkg:generic/libtiff", "type": "library", "name": "libtiff", "version": "4.7.2", "scope": "optional", "description": "TIFF codec (optional).", "licenses": [ { "license": { "id": "libtiff" } } ], "externalReferences": [ { "type": "website", "url": "https://libtiff.gitlab.io/libtiff/" }, { "type": "distribution", "url": "https://download.osgeo.org/libtiff/" } ] }, { "bom-ref": "pkg:generic/libwebp", "type": "library", "name": "libwebp", "version": "1.6.0", "scope": "optional", "description": "WebP codec (optional, used by PIL._webp).", "licenses": [ { "license": { "id": "BSD-3-Clause" } } ], "externalReferences": [ { "type": "website", "url": "https://chromium.googlesource.com/webm/libwebp" }, { "type": "distribution", "url": "https://chromium.googlesource.com/webm/libwebp" } ] }, { "bom-ref": "pkg:generic/libxcb", "type": "library", "name": "libxcb", "version": "1.17.0", "scope": "optional", "description": "X11 screen-grab support (optional, used by PIL._imaging on macOS and Linux).", "licenses": [ { "license": { "id": "X11" } } ], "externalReferences": [ { "type": "website", "url": "https://xcb.freedesktop.org" }, { "type": "distribution", "url": "https://xcb.freedesktop.org/dist/" } ] }, { "bom-ref": "pkg:generic/littlecms2", "type": "library", "name": "Little CMS 2", "version": "2.19.1", "scope": "optional", "description": "Colour management (optional, used by PIL._imagingcms).", "licenses": [ { "license": { "id": "MIT" } } ], "externalReferences": [ { "type": "website", "url": "https://www.littlecms.com" }, { "type": "distribution", "url": "https://github.com/mm2/Little-CMS/releases" } ] }, { "bom-ref": "pkg:generic/openjpeg", "type": "library", "name": "OpenJPEG", "version": "2.5.4", "scope": "optional", "description": "JPEG 2000 codec (optional).", "licenses": [ { "license": { "id": "BSD-2-Clause" } } ], "pedigree": { "ancestors": [ { "bom-ref": "pkg:generic/openjpeg@2.5.4#upstream", "type": "library", "name": "libtiff", "version": "2.5.4", "purl": "pkg:generic/openjpeg@2.5.4", "externalReferences": [ { "type": "distribution", "url": "https://github.com/uclouvain/openjpeg/releases/tag/v2.5.4" } ] } ], "patches": [ { "type": "cherry-pick", "diff": { "text": { "content": "Y29tbWl0IDkxZDA4YjExYTcyNzY0ZjZkMTk5ZjMyZmEwYzFiMWFiZDRlZGMyYWQKQXV0aG9yOiBQR1pYQiA8cGd6eGJAcXEuY29tPgpEYXRlOiAgIFR1ZSBGZWIgMTAgMTc6MDk6MzAgMjAyNiArMDAwMAoKICAgIEZpeCBoZWFwIGJ1ZmZlciBvdmVybGZvdyBpbiBvcGpfajJrX3JlYWRfc29kCgpkaWZmIC0tZ2l0IGEvc3JjL2xpYi9vcGVuanAyL2oyay5jIGIvc3JjL2xpYi9vcGVuanAyL2oyay5jCmluZGV4IGEyMDE0Yzg5Li5hZDc2YWNhNyAxMDA2NDQKLS0tIHNyYy9saWIvb3BlbmpwMi9qMmsuYworKysgc3JjL2xpYi9vcGVuanAyL2oyay5jCkBAIC01MDgyLDEyICs1MDgyLDE0IEBAIHN0YXRpYyBPUEpfQk9PTCBvcGpfajJrX3JlYWRfc29kKG9wal9qMmtfdCAqcF9qMmssCgogICAgICAgICBPUEpfVUlOVDMyIGxfY3VycmVudF90aWxlX3BhcnQgPQogICAgICAgICAgICAgbF9jc3RyX2luZGV4LT50aWxlX2luZGV4W3BfajJrLT5tX2N1cnJlbnRfdGlsZV9udW1iZXJdLmN1cnJlbnRfdHBzbm87Ci0gICAgICAgIGxfY3N0cl9pbmRleC0+dGlsZV9pbmRleFtwX2oyay0+bV9jdXJyZW50X3RpbGVfbnVtYmVyXS50cF9pbmRleFtsX2N1cnJlbnRfdGlsZV9wYXJ0XS5lbmRfaGVhZGVyCi0gICAgICAgICAgICA9Ci0gICAgICAgICAgICAgICAgbF9jdXJyZW50X3BvczsKLSAgICAgICAgbF9jc3RyX2luZGV4LT50aWxlX2luZGV4W3BfajJrLT5tX2N1cnJlbnRfdGlsZV9udW1iZXJdLnRwX2luZGV4W2xfY3VycmVudF90aWxlX3BhcnRdLmVuZF9wb3MKLSAgICAgICAgICAgID0KLSAgICAgICAgICAgICAgICBsX2N1cnJlbnRfcG9zICsgcF9qMmstPm1fc3BlY2lmaWNfcGFyYW0ubV9kZWNvZGVyLm1fc290X2xlbmd0aCArIDI7CisgICAgICAgIGlmIChsX2NzdHJfaW5kZXgtPnRpbGVfaW5kZXhbcF9qMmstPm1fY3VycmVudF90aWxlX251bWJlcl0udHBfaW5kZXggJiYKKyAgICAgICAgICAgICAgICBsX2N1cnJlbnRfdGlsZV9wYXJ0IDwKKyAgICAgICAgICAgICAgICBsX2NzdHJfaW5kZXgtPnRpbGVfaW5kZXhbcF9qMmstPm1fY3VycmVudF90aWxlX251bWJlcl0ubmJfdHBzKSB7CisgICAgICAgICAgICBsX2NzdHJfaW5kZXgtPnRpbGVfaW5kZXhbcF9qMmstPm1fY3VycmVudF90aWxlX251bWJlcl0udHBfaW5kZXhbbF9jdXJyZW50X3RpbGVfcGFydF0uZW5kX2hlYWRlcgorICAgICAgICAgICAgICAgID0gbF9jdXJyZW50X3BvczsKKyAgICAgICAgICAgIGxfY3N0cl9pbmRleC0+dGlsZV9pbmRleFtwX2oyay0+bV9jdXJyZW50X3RpbGVfbnVtYmVyXS50cF9pbmRleFtsX2N1cnJlbnRfdGlsZV9wYXJ0XS5lbmRfcG9zCisgICAgICAgICAgICAgICAgPSBsX2N1cnJlbnRfcG9zICsgcF9qMmstPm1fc3BlY2lmaWNfcGFyYW0ubV9kZWNvZGVyLm1fc290X2xlbmd0aCArIDI7CisgICAgICAgIH0KCiAgICAgICAgIGlmIChPUEpfRkFMU0UgPT0gb3BqX2oya19hZGRfdGxtYXJrZXIocF9qMmstPm1fY3VycmVudF90aWxlX251bWJlciwKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsX2NzdHJfaW5kZXgsCg==", "encoding": "base64" } } } ], "notes": "Vendored from upstream openjpeg 2.5.4 with a commit from master cherry-picked to fix OSV-2025-219." }, "externalReferences": [ { "type": "website", "url": "https://www.openjpeg.org" }, { "type": "distribution", "url": "https://github.com/uclouvain/openjpeg/releases" } ] }, { "bom-ref": "pkg:pypi/pybind11", "type": "library", "name": "pybind11", "scope": "excluded", "description": "Parallel C compilation library (build-time dependency).", "licenses": [ { "license": { "id": "BSD-3-Clause" } } ], "externalReferences": [ { "type": "website", "url": "https://pybind11.readthedocs.io" }, { "type": "distribution", "url": "https://github.com/pybind/pybind11/releases" } ] }, { "bom-ref": "pkg:generic/zlib", "type": "library", "name": "zlib", "version": "2.3.3", "description": "Deflate/PNG compression (required by default; disable with -C zlib=disable).", "licenses": [ { "license": { "id": "Zlib" } } ], "externalReferences": [ { "type": "website", "url": "https://zlib.net" }, { "type": "distribution", "url": "https://zlib.net" } ] } ], "dependencies": [ { "ref": "pkg:pypi/pillow@13.0.0", "dependsOn": [ "pkg:pypi/pillow@13.0.0#c-ext/PIL._avif", "pkg:pypi/pillow@13.0.0#c-ext/PIL._imaging", "pkg:pypi/pillow@13.0.0#c-ext/PIL._imagingcms", "pkg:pypi/pillow@13.0.0#c-ext/PIL._imagingft", "pkg:pypi/pillow@13.0.0#c-ext/PIL._imagingmath", "pkg:pypi/pillow@13.0.0#c-ext/PIL._imagingmorph", "pkg:pypi/pillow@13.0.0#c-ext/PIL._imagingtk", "pkg:pypi/pillow@13.0.0#c-ext/PIL._webp" ] }, { "ref": "pkg:pypi/pillow@13.0.0#c-ext/PIL._avif", "dependsOn": [ "pkg:generic/libavif" ] }, { "ref": "pkg:pypi/pillow@13.0.0#c-ext/PIL._imaging", "dependsOn": [ "pkg:generic/libimagequant", "pkg:generic/libjpeg", "pkg:generic/libtiff", "pkg:generic/libxcb", "pkg:generic/openjpeg", "pkg:generic/zlib" ] }, { "ref": "pkg:pypi/pillow@13.0.0#c-ext/PIL._imagingcms", "dependsOn": [ "pkg:generic/littlecms2" ] }, { "ref": "pkg:pypi/pillow@13.0.0#c-ext/PIL._imagingft", "dependsOn": [ "pkg:generic/freetype2", "pkg:generic/fribidi", "pkg:generic/harfbuzz", "pkg:pypi/pillow@13.0.0#thirdparty/fribidi-shim", "pkg:pypi/pillow@13.0.0#thirdparty/raqm" ] }, { "ref": "pkg:pypi/pillow@13.0.0#c-ext/PIL._webp", "dependsOn": [ "pkg:generic/libwebp" ] }, { "ref": "pkg:pypi/pillow@13.0.0#thirdparty/raqm", "dependsOn": [ "pkg:generic/harfbuzz", "pkg:pypi/pillow@13.0.0#thirdparty/fribidi-shim" ] } ] }