# Advisories pip-audit may ignore on the Python 3.10 CI leg only.
# pillow 12.3.0 (via matplotlib) is fixed in 13.0.0, which requires Python 3.11,
# so 3.10 has no fixed release. vol-assign only writes PNGs via savefig and never
# decodes untrusted images. Delete this file when Python 3.10 support is dropped.
CVE-2026-112390
CVE-2026-112391
CVE-2026-112392
CVE-2026-112393
CVE-2026-112395
CVE-2026-112396
CVE-2026-112397
CVE-2026-112399
CVE-2026-112400
CVE-2026-112401
CVE-2026-112402
CVE-2026-112404
CVE-2026-112405
CVE-2026-112406
CVE-2026-112891
CVE-2026-112892
CVE-2026-112893
CVE-2026-112894
CVE-2026-112895
CVE-2026-112896
CVE-2026-112897
CVE-2026-112899
CVE-2026-112900
CVE-2026-112901
CVE-2026-96636
CVE-2026-96637
CVE-2026-96638
CVE-2026-96639
CVE-2026-96640
CVE-2026-96641
CVE-2026-96642
CVE-2026-96643
CVE-2026-96644
CVE-2026-96778
GHSA-78g4-xqwv-q3g8
# pillow advisories published 2026-11 (decoders and Arrow export): same 13.0.0 fix,
# same rationale; vol-assign neither decodes images nor exports Arrow.
CVE-2026-112394
CVE-2026-112398
CVE-2026-112403
CVE-2026-114501
# filelock 4.2.1 fixes these but requires Python 3.11, so 3.10 resolves 4.1.0.
# filelock is dev-only here (pip-audit -> cachecontrol[filecache]) and never ships
# with the package; 3.11+ legs get 4.2.x and audit it with nothing ignored.
CVE-2026-112906
CVE-2026-112907
CVE-2026-112908
CVE-2026-112909
CVE-2026-112910
CVE-2026-112911
CVE-2026-112912
CVE-2026-112913
CVE-2026-112914
CVE-2026-112915
CVE-2026-112934
CVE-2026-112935
CVE-2026-112937
CVE-2026-112938
CVE-2026-112939
CVE-2026-112940
CVE-2026-112941
