Subject: python-pillow-simd package vulnerable to at least CVE-2021-25293
From: Léo Le Bouter <[email-masked]>
To: [email-masked]
Date: Fri, 19 Mar 2021 11:37:09 +0100
List-Id: <debbugs-submit.debbugs.gnu.org>

Hello!

pillow-simd is a fork of pillow (
https://github.com/uploadcare/pillow-simd), it's currently still at
version 7.x and it does not seem like it backports security patches
from pillow.

$ ./pre-inst-env guix refresh -l python-pillow-simd
No dependents other than itself: [email-masked]

Do we remove it? Do we want to commit to backporting/applying all fixes
from python-pillow back in python-pillow-simd ourselves (I don't)?

Léo