Add INCIDENT_RESPONSE.md by aclark4life · Pull Request #9555 · python-pillow/Pillow

aclark4life · 2026-04-09T16:27:23Z

Changes proposed in this pull request:

Add INCIDENT_RESPONSE.md

At the risk of making this document larger, add in sections in Bootstrap IRP but not ours. - https://github.com/twbs/bootstrap/blob/main/.github/INCIDENT_RESPONSE.md

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…ignment step Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

radarhere · 2026-04-09T22:06:49Z

+|---|---|---|
+| `pybind11` | Build-time only | C++ ↔ Python bindings |
+| `olefile` | Optional (`fpx`, `mic` extras) | OLE2 container parsing (FPX, MIC formats) |
+| `defusedxml` | Optional (`xmp` extra) | Safe XML parsing for XMP metadata |


This list is missing setuptools

We have more lists of optional deps in pyproject.toml. Do they need repeating here?

The categories of dependencies that aren't covered are 'docs', 'test-arrow' and 'tests'.

I don't know if they should be included or not, but there is a distinction - documentation builds and testing aren't actions that most users undertake.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Andrew Murray <3112309+radarhere@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

hugovk · 2026-04-10T12:08:20Z

+|---|---|---|
+| `pybind11` | Build-time only | C++ ↔ Python bindings |
+| `olefile` | Optional (`fpx`, `mic` extras) | OLE2 container parsing (FPX, MIC formats) |
+| `defusedxml` | Optional (`xmp` extra) | Safe XML parsing for XMP metadata |


We have more lists of optional deps in pyproject.toml. Do they need repeating here?

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>

- Update CVSS v3.1 to CVSS 4.0 throughout - Remove 'Direct maintainer contact' from detection sources - Fix 'before it stays public' wording for user bug reports - Simplify sections 7.3 and 7.4 to reference RELEASING.md instead of duplicating release process steps - Update RELEASING.md Point release section with security-specific steps (amend CVE in commits, publish GitHub Security Advisory) - Fix PyPI API tokens entry (remove GitHub secrets reference) - Fix 404 PyPI manage URL (use correct case and /releases/ path) - Replace security@pypi.org mailto with https://pypi.org/security/ - Remove unconfirmed 'Notify GitHub Security' bullet - Fix section numbering: 10.x → 9.x under Section 9. Dependency Map - Reorder: move 9.3 Responding to Upstream Vulnerability before 9.3 Downstream Dependencies (now 9.2 and 9.3 respectively) - Add anchor link for Section 5 reference in 9.2 - Add #plugin-list anchor to third-party plugins handbook link - Fix GitLab issue tracker URLs to use /-/work_items for libtiff, freetype2, and bzip2 - Add pyproject.toml reference for complete optional dependencies list Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Andrew Murray <3112309+radarhere@users.noreply.github.com>

hugovk reviewed Apr 9, 2026

View reviewed changes

Comment thread .github/INCIDENT_RESPONSE.md Outdated

Add INCIDENT_RESPONSE.md

cb5736e

aclark4life force-pushed the irp branch from fd0c2c7 to cb5736e Compare April 9, 2026 16:36

aclark4life added 2 commits April 9, 2026 12:47

Fix links

4d63d0b

Add sections from Bootstrap example

cdaa1bf

At the risk of making this document larger, add in sections in Bootstrap IRP but not ours. - https://github.com/twbs/bootstrap/blob/main/.github/INCIDENT_RESPONSE.md

aclark4life added Documentation 🤖-assisted AI-assisted labels Apr 9, 2026

aclark4life and others added 2 commits April 9, 2026 16:59

Fix version support matrix to reflect main-only security policy

64ed471

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Update Readiness Review: quarterly cadence, trim checklist

4a74a20

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

aclark4life force-pushed the irp branch from 656b970 to 4a74a20 Compare April 9, 2026 21:24

aclark4life and others added 3 commits April 9, 2026 17:25

Remove backport comment from version support matrix

3aa0761

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Inline Readiness Review procedure as prose

c2ac2da

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Simplify Roles section note

ad582c1

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

wiredfool reviewed Apr 9, 2026

View reviewed changes

Comment thread .github/INCIDENT_RESPONSE.md Outdated

aclark4life and others added 4 commits April 9, 2026 17:46

Fix severity classification cross-reference, remove incident lead ass…

e0f9e2b

…ignment step Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Remove Tidelift notification step from triage

68be7f3

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Replace section sign (§) with plain Section references

3f90d5c

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Change Critical/High SLA targets to best effort

20af4ec

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

radarhere reviewed Apr 9, 2026

View reviewed changes

Comment thread .github/INCIDENT_RESPONSE.md Outdated

aclark4life and others added 3 commits April 9, 2026 17:59

Trim version support matrix prose

e74a89f

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Remove section 7.5 Rollback Procedures

00ff863

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Trim Plan Maintenance section

0d440b7

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

radarhere reviewed Apr 9, 2026

View reviewed changes

Add setuptools to Python-level dependencies

80a91fd

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

radarhere reviewed Apr 9, 2026

View reviewed changes

Comment thread .github/INCIDENT_RESPONSE.md Outdated

aclark4life and others added 4 commits April 9, 2026 18:13

Clarify advisory thread purpose as reporter coordination

6f815c2

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Link to section 1.3 in Plan Maintenance

b579577

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add private channels note to internal communication guidance

5598959

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Remove Wand from downstream dependencies

6fe81dd

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

aclark4life marked this pull request as ready for review April 9, 2026 22:22

radarhere reviewed Apr 10, 2026

View reviewed changes

Comment thread .github/INCIDENT_RESPONSE.md Outdated

radarhere reviewed Apr 10, 2026

View reviewed changes

Comment thread .github/INCIDENT_RESPONSE.md Outdated

radarhere reviewed Apr 10, 2026

View reviewed changes

Comment thread .github/INCIDENT_RESPONSE.md Outdated

radarhere reviewed Apr 10, 2026

View reviewed changes

Comment thread .github/INCIDENT_RESPONSE.md Outdated

aclark4life and others added 2 commits April 10, 2026 07:44

Update .github/INCIDENT_RESPONSE.md

6a0192a

Co-authored-by: Andrew Murray <3112309+radarhere@users.noreply.github.com>

Remove active exploitation escalation bullet from incident response

d016c90

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

aclark4life force-pushed the irp branch from 8dda360 to d016c90 Compare April 10, 2026 11:44

Combine plan maintenance into a single paragraph

24b12dc

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

hugovk reviewed Apr 10, 2026

View reviewed changes

radarhere reviewed Apr 10, 2026

View reviewed changes

Comment thread .github/INCIDENT_RESPONSE.md Outdated

radarhere reviewed Apr 10, 2026

View reviewed changes

Comment thread .github/INCIDENT_RESPONSE.md Outdated

radarhere reviewed Apr 10, 2026

View reviewed changes

Comment thread .github/INCIDENT_RESPONSE.md Outdated

aclark4life and others added 2 commits April 10, 2026 10:37

Update .github/INCIDENT_RESPONSE.md

0cbdd2e

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>

radarhere reviewed Apr 12, 2026

View reviewed changes

Comment thread .github/INCIDENT_RESPONSE.md Outdated

radarhere reviewed Apr 12, 2026

View reviewed changes

Comment thread RELEASING.md Outdated

Update .github/INCIDENT_RESPONSE.md

ee24a11

Co-authored-by: Andrew Murray <3112309+radarhere@users.noreply.github.com>

aclark4life force-pushed the irp branch from 5cb0696 to ee24a11 Compare April 14, 2026 15:26

Update template wording

a124ed2

aclark4life requested review from hugovk, radarhere and wiredfool April 14, 2026 15:37

radarhere reviewed Apr 15, 2026

View reviewed changes

Comment thread .github/INCIDENT_RESPONSE.md Outdated

radarhere reviewed Apr 15, 2026

View reviewed changes

Comment thread .github/INCIDENT_RESPONSE.md Outdated

Update .github/INCIDENT_RESPONSE.md

91fcc5d

Co-authored-by: Andrew Murray <3112309+radarhere@users.noreply.github.com>

aclark4life force-pushed the irp branch from a0a62d4 to 91fcc5d Compare April 15, 2026 17:17

Uh oh!

Conversation

aclark4life commented Apr 9, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

radarhere Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

hugovk Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

radarhere Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hugovk Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants