Support for Pillow >= 12.0 (Dependency Conflict with Pillow 12.1.1)

[alex-pro27]

Hello!

I would like to request support for Pillow 12.x.

Currently, moviepy (v2.2.1) restricts the Pillow dependency to <12.0. However, Pillow 12.1.1 has been released, and other modern libraries (such as agora in my project) already require the newest version.

This causes a dependency conflict when using package managers like Poetry.

Error log:
Because moviepy (2.2.1) depends on pillow (>=9.2.0,<12.0)
and no versions of moviepy match >2.2.1,<3.0.0, moviepy (>=2.2.1,<3.0.0) requires pillow (>=9.2.0,<12.0).
So, because agora depends on both pillow (12.1.1) and moviepy (^2.2.1), version solving failed.

Request:
Could you please verify compatibility with Pillow 12 and bump the upper bound limit in pyproject.toml / setup.py in a future release?

Thank you for your work on this library!

[MBiondi-AIKOSpace]

Hi all,
Another important reason to update the pillow compatibility window in moviepy v2.2.1 is the presence of a known security vulnerability within the currently allowed dependency range:
pillow>=9.2.0,<12.0

This version constraint range includes a vulnerable release of pillow affected by CVE-2026-25990.
The issue is resolved starting from pillow v12.1.1, which is currently excluded.

Updating the compatibility range would help users remain compliant with security best practices without requiring workarounds.
Thanks!

[mmatl]

Seconding (thirding?) this because of the vulnerability mentioned above. Thanks!

[mag-michelleshyr]

@Zulko Bumping this issue as well. Like mentioned by the other comments, the strict <12.0 constraint is preventing our team from resolving the pillow vulnerability (CVE-2026-25990). Releasing an update with a broader compatibility range would allow downstream users to safely meet security requirements without having to maintain custom workarounds. Thank you!

[sosahi]

hey folks, bumping this up as this dependency is affecting many developers. Pillow <12.0 has a vulnerability that is fixed in >12.0 but anyone using moviepy cannot get that Pillow CVE patch.

[kevinmagnopus]

Hi @Zulko . Please cut a new release, primarily due to the above mentioned vulnerability. This will shortly block our use of moviepy entirely, since we cannot address the vulnerability. Our automated security tools reject the inclusion of moviepy for this reason.