Eventual-Inc/Daft - CodSpeed

Daft

Blog Docs Changelog

Performance History

Latest Results

chore: Bump Pillow to 13.0.0 for CVE-2026-96639 Pillow 13.0.0 fixes CVE-2026-96639 (CVSS 9.8, out-of-bounds write in multi-frame loaders such as MPO; affects 11.0.0 to <13.0.0) and about 40 other memory-safety and DoS issues. Pillow 13.0.0 requires Python >= 3.11. Daft supports Python >= 3.10, so the google, openai, transformers and video extras and the dev group pin pillow==13.0.0 for Python >= 3.11 and keep pillow==12.2.0 for Python 3.10. Add PNG round-trip tests for the numpy image path of the OpenAI and Google prompters (uint8 L/LA/RGB/RGBA and uint16 L16). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

everettVT/pillow-13

3 hours ago

Merge branch 'main' into fix/split-part-broadcast

DogerW666:fix/split-part-broadcast

13 hours ago

Merge branch 'main' into fix/bisect-round-robin-bundles

DogerW666:fix/bisect-round-robin-bundles

13 hours ago

fix(catalog): return False from GlueCatalog.has_table for missing tables

nirmalpatel008:fix/glue-has-table

15 hours ago

confirm working

slade/cache-docker

18 hours ago

Merge branch 'main' into slade/upgrade-python-deps

slade/upgrade-python-deps

1 day ago

fix: Bump webpki-roots to 1.0.10 for eMudhra CA compromise (#7628) ## Changes Made Bumps `webpki-roots` from 1.0.6 to 1.0.10 in `Cargo.lock`. No other changes. On 2026-10-17, a researcher disclosed that the private keys of eight eMudhra intermediate CAs can be recovered from their certificates. These intermediates chain to the `emSign Root TLS CA - G3` and `AAA Certificate Services` roots. A holder of one of the keys can issue a certificate for any domain. The disclosure site lists `webpki-roots` 1.0.10 as the patched version: https://emudhra.we-have-a-problem.com/ Daft compiles `webpki-roots` into the wheel through the Azure IO path: ``` daft-io → azure_core (reqwest_rustls) → reqwest (rustls) → hyper-rustls → webpki-roots ``` Browsers are protected because they enforce Certificate Transparency and have blocked the intermediates. Daft's rustls clients do neither, so with 1.0.6 they trust the compromised intermediates. `cargo check -p daft-io` passes. ## Related Issues None. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Srinivas Lade <srinulade1@gmail.com>

main

1 day ago

Merge branch 'main' into fix/rust-doctests

AYUSHNSUT:fix/rust-doctests

1 day ago

Latest Branches

0%

chore: Bump Pillow to 13.0.0 for CVE-2026-96639#7635

3 hours ago

235c614

everettVT/pillow-13

0%

fix(utf8): broadcast split_part over all arguments#7548

14 hours ago

d549573

DogerW666:fix/split-part-broadcast

0%

fix(distributed): balance bisect bundle selection#7519

14 hours ago

40692d3

DogerW666:fix/bisect-round-robin-bundles

© 2026 CodSpeed Technology

Home Terms Privacy Docs