Removed giflib as webp dependency #8661
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Alternative to #8658
We started mentioning giflib because it is used by
build_libwebp
- python-pillow/pillow-wheels#98 / https://github.com/multi-build/multibuild/blob/42d761728d141d8462cd9943f4329f12fe62b155/library_builders.sh#L286-L293However, https://developers.google.com/speed/webp/docs/compiling states
We don't ask libwebp to convert between GIF and WebP formats, so the dependency can be removed by replacing
build_libwebp
with a directbuild_simple
call.cifuzz still appears to be failing because just runs on main - https://github.com/google/oss-fuzz/blob/master/projects/pillow/Dockerfile
If I test one of our old vulnerabilities on oss-fuzz, you can see the
convert
problem - https://github.com/radarhere/oss-fuzz/actions/runs/12605648048/job/35134631013#step:7:6363But once I switch to this branch, it goes away - https://github.com/radarhere/oss-fuzz/actions/runs/12605660381