v1.137.1

nautechsystems/nautilus_traderv1.137.1Jan 15, 2022by github-actions[bot]

AI Summary

This is a patch release addressing moderate to high severity security vulnerabilities in the Pillow library by upgrading to version 9.0.0.

Key Highlights

Upgraded to Pillow 9.0.0 to patch security vulnerabilities.
Fixed arbitrary expression evaluation vulnerability in PIL.ImageMath.eval.
Fixed buffer over-read and improper initialization issues in path.c.

Full Release Notes

# NautilusTrader 1.137.1 Beta

## Release Notes

Released on 15th January 2022 (UTC).

This is a patch release which fixes moderate to high severity security vulnerabilities in
`pillow < 9.0.0`:
- PIL.ImageMath.eval allows evaluation of arbitrary expressions, such as ones that use the Python exec method.
- path_getbbox in path.c has a buffer over-read during initialization of ImagePath.Path.
- path_getbbox in path.c improperly initializes ImagePath.Path.

This release upgrades to `pillow 9.0.0`.