Merge branch 'main' into upload-fribidi

.appveyor.yml

@@ -25,8 +25,8 @@ install:
 - mv c:\pillow-depends-main c:\pillow-depends
 - xcopy /S /Y c:\pillow-depends\test_images\* c:\pillow\tests\images
 - 7z x ..\pillow-depends\nasm-2.15.05-win64.zip -oc:\
-- ..\pillow-depends\gs9561w32.exe /S
-- path c:\nasm-2.15.05;C:\Program Files (x86)\gs\gs9.56.1\bin;%PATH%
+- ..\pillow-depends\gs1000w32.exe /S
+- path c:\nasm-2.15.05;C:\Program Files (x86)\gs\gs10.0.0\bin;%PATH%
 - cd c:\pillow\winbuild\
 - ps: |
         c:\python37\python.exe c:\pillow\winbuild\build_prepare.py -v --depends=C:\pillow-depends\

.ci/install.sh

@@ -37,8 +37,7 @@ python3 -m pip install -U pytest-timeout
 python3 -m pip install pyroma
 
 if [[ $(uname) != CYGWIN* ]]; then
-    # TODO Remove condition when NumPy supports 3.11
-    if ! [ "$GHA_PYTHON_VERSION" == "3.11-dev" ]; then python3 -m pip install numpy ; fi
+    python3 -m pip install numpy
 
     # PyQt6 doesn't support PyPy3
     if [[ $GHA_PYTHON_VERSION == 3.* ]]; then

.github/renovate.json

@@ -0,0 +1,17 @@
+{
+    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+    "extends": [
+        "config:base"
+    ],
+    "labels": [
+        "Dependency"
+    ],
+    "packageRules": [
+        {
+            "groupName": "github-actions",
+            "matchManagers": ["github-actions"],
+            "separateMajorMinor": "false"
+        }
+    ],
+    "schedule": ["on the 3rd day of the month"]
+}

.github/workflows/cifuzz.yml

@@ -11,6 +11,13 @@ on:
       - "**.h"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
+concurrency: 
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   Fuzzing:
     runs-on: ubuntu-latest

.github/workflows/lint.yml

@@ -5,6 +5,10 @@ on: [push, pull_request, workflow_dispatch]
 permissions:
   contents: read
 
+concurrency: 
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
 
@@ -16,15 +20,15 @@ jobs:
     - uses: actions/checkout@v3
 
     - name: pre-commit cache
-      uses: actions/cache@v2
+      uses: actions/cache@v3
       with:
         path: ~/.cache/pre-commit
         key: lint-pre-commit-${{ hashFiles('**/.pre-commit-config.yaml') }}
         restore-keys: |
           lint-pre-commit-
 
     - name: Set up Python
-      uses: actions/setup-python@v3
+      uses: actions/setup-python@v4
       with:
         python-version: "3.10"
         cache: pip

.github/workflows/macos-install.sh

@@ -14,8 +14,7 @@ python3 -m pip install -U pytest-timeout
 python3 -m pip install pyroma
 
 echo -e "[openblas]\nlibraries = openblas\nlibrary_dirs = /usr/local/opt/openblas/lib" >> ~/.numpy-site.cfg
-# TODO Remove condition when NumPy supports 3.11
-if ! [ "$GHA_PYTHON_VERSION" == "3.11-dev" ]; then python3 -m pip install numpy ; fi
+python3 -m pip install numpy
 
 # extra test images
 pushd depends && ./install_extra_test_images.sh && popd

.github/workflows/release-drafter.yml

@@ -10,6 +10,10 @@ on:
 permissions:
   contents: read
 
+concurrency: 
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   update_release_draft:
     permissions:

.github/workflows/stale.yml

@@ -8,6 +8,10 @@ on:
 permissions:
   issues: write
 
+concurrency: 
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   stale:
     if: github.repository_owner == 'python-pillow'
@@ -16,7 +20,7 @@ jobs:
 
     steps:
     - name: "Check issues"
-      uses: actions/stale@v5
+      uses: actions/stale@v6
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         only-labels: "Awaiting OP Action"

.github/workflows/test-cygwin.yml

@@ -2,6 +2,13 @@ name: Test Cygwin
 
 on: [push, pull_request, workflow_dispatch]
 
+permissions:
+  contents: read
+
+concurrency: 
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
     runs-on: windows-latest
@@ -41,7 +48,7 @@ jobs:
             qt5-devel-tools subversion xorg-server-extra zlib-devel
 
       - name: Add Lapack to PATH
-        uses: egor-tensin/cleanup-path@v1
+        uses: egor-tensin/cleanup-path@v2
         with:
           dirs: 'C:\cygwin\bin;C:\cygwin\lib\lapack'
 

.github/workflows/test-docker.yml

@@ -5,6 +5,10 @@ on: [push, pull_request, workflow_dispatch]
 permissions:
   contents: read
 
+concurrency: 
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
 
@@ -79,7 +83,7 @@ jobs:
         MATRIX_DOCKER: ${{ matrix.docker }}
 
     - name: Upload coverage
-      uses: codecov/codecov-action@v1
+      uses: codecov/codecov-action@v3
       with:
         flags: GHA_Docker
         name: ${{ matrix.docker }}

.github/workflows/test-mingw.yml

@@ -5,6 +5,10 @@ on: [push, pull_request, workflow_dispatch]
 permissions:
   contents: read
 
+concurrency: 
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
     runs-on: windows-latest
@@ -73,11 +77,11 @@ jobs:
           python3 -m pytest -vx --cov PIL --cov Tests --cov-report term --cov-report xml Tests
 
       - name: Upload coverage
-        run: |
-          python3 -m pip install codecov
-          bash <(curl -s https://codecov.io/bash) -F GHA_Windows
-        env:
-          CODECOV_NAME: ${{ matrix.name }}
+        uses: codecov/codecov-action@v3
+        with:
+          file: ./coverage.xml
+          flags: GHA_Windows
+          name: ${{ matrix.name }}
 
   success:
     permissions:

.github/workflows/test-valgrind.yml

@@ -16,6 +16,10 @@ on:
 permissions:
   contents: read
 
+concurrency: 
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
 

.github/workflows/test-windows.yml

@@ -5,13 +5,17 @@ on: [push, pull_request, workflow_dispatch]
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
     runs-on: windows-latest
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.7", "3.8", "3.9", "3.10", "3.11-dev"]
+        python-version: ["3.7", "3.8", "3.9", "3.10", "3.11"]
         architecture: ["x86", "x64"]
         include:
           # PyPy 7.3.4+ only ships 64-bit binaries for Windows
@@ -36,7 +40,7 @@ jobs:
 
     # sets env: pythonLocation
     - name: Set up Python
-      uses: actions/setup-python@v3
+      uses: actions/setup-python@v4
       with:
         python-version: ${{ matrix.python-version }}
         architecture: ${{ matrix.architecture }}
@@ -55,8 +59,8 @@ jobs:
         7z x winbuild\depends\nasm-2.15.05-win64.zip "-o$env:RUNNER_WORKSPACE\"
         echo "$env:RUNNER_WORKSPACE\nasm-2.15.05" >> $env:GITHUB_PATH
 
-        winbuild\depends\gs9561w32.exe /S
-        echo "C:\Program Files (x86)\gs\gs9.56.1\bin" >> $env:GITHUB_PATH
+        winbuild\depends\gs1000w32.exe /S
+        echo "C:\Program Files (x86)\gs\gs10.0.0\bin" >> $env:GITHUB_PATH
 
         xcopy /S /Y winbuild\depends\test_images\* Tests\images\
 
@@ -66,7 +70,7 @@ jobs:
 
     - name: Cache build
       id: build-cache
-      uses: actions/cache@v2
+      uses: actions/cache@v3
       with:
         path: winbuild\build
         key:
@@ -86,19 +90,28 @@ jobs:
       if: steps.build-cache.outputs.cache-hit != 'true'
       run: "& winbuild\\build\\build_dep_zlib.cmd"
 
-    - name: Build dependencies / LibTiff
+    - name: Build dependencies / xz
       if: steps.build-cache.outputs.cache-hit != 'true'
-      run: "& winbuild\\build\\build_dep_libtiff.cmd"
+      run: "& winbuild\\build\\build_dep_xz.cmd"
 
     - name: Build dependencies / WebP
       if: steps.build-cache.outputs.cache-hit != 'true'
       run: "& winbuild\\build\\build_dep_libwebp.cmd"
 
+    - name: Build dependencies / LibTiff
+      if: steps.build-cache.outputs.cache-hit != 'true'
+      run: "& winbuild\\build\\build_dep_libtiff.cmd"
+
     # for FreeType CBDT/SBIX font support
     - name: Build dependencies / libpng
       if: steps.build-cache.outputs.cache-hit != 'true'
       run: "& winbuild\\build\\build_dep_libpng.cmd"
 
+    # for FreeType WOFF2 font support
+    - name: Build dependencies / brotli
+      if: steps.build-cache.outputs.cache-hit != 'true'
+      run: "& winbuild\\build\\build_dep_brotli.cmd"
+
     - name: Build dependencies / FreeType
       if: steps.build-cache.outputs.cache-hit != 'true'
       run: "& winbuild\\build\\build_dep_freetype.cmd"
@@ -171,7 +184,7 @@ jobs:
       shell: pwsh
 
     - name: Upload coverage
-      uses: codecov/codecov-action@v1
+      uses: codecov/codecov-action@v3
       with:
         file: ./coverage.xml
         flags: GHA_Windows
@@ -183,6 +196,22 @@ jobs:
       run: |
         mkdir fribidi\${{ matrix.architecture }}
         copy winbuild\build\bin\fribidi* fribidi\${{ matrix.architecture }}
+        setlocal EnableDelayedExpansion
+        for %%f in (winbuild\build\license\*) do (
+          set x=%%~nf
+          rem Skip FriBiDi license, it is not included in the wheel.
+          set fribidi=!x:~0,7!
+          if NOT !fribidi!==fribidi (
+            rem Skip imagequant license, it is not included in the wheel.
+            set libimagequant=!x:~0,13!
+            if NOT !libimagequant!==libimagequant (
+              echo. >> LICENSE
+              echo ===== %%~nf ===== >> LICENSE
+              echo. >> LICENSE
+              type %%f >> LICENSE
+            )
+          )
+        )
         for /f "tokens=3 delims=/" %%a in ("${{ github.ref }}") do echo ::set-output name=dist::dist-%%a
         winbuild\\build\\build_pillow.cmd --disable-imagequant bdist_wheel
       shell: cmd

.github/workflows/test.yml

@@ -5,6 +5,10 @@ on: [push, pull_request, workflow_dispatch]
 permissions:
   contents: read
 
+concurrency: 
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
 
@@ -18,7 +22,7 @@ jobs:
         python-version: [
           "pypy-3.8",
           "pypy-3.7",
-          "3.11-dev",
+          "3.11",
           "3.10",
           "3.9",
           "3.8",
@@ -30,11 +34,6 @@ jobs:
           REVERSE: "--reverse"
         - python-version: "3.8"
           PYTHONOPTIMIZE: 2
-        # Include new variables for Codecov
-        - os: ubuntu-latest
-          codecov-flag: GHA_Ubuntu
-        - os: macos-latest
-          codecov-flag: GHA_macOS
 
     runs-on: ${{ matrix.os }}
     name: ${{ matrix.os }} Python ${{ matrix.python-version }}
@@ -43,7 +42,7 @@ jobs:
     - uses: actions/checkout@v3
 
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v3
+      uses: actions/setup-python@v4
       with:
         python-version: ${{ matrix.python-version }}
         cache: pip
@@ -99,17 +98,18 @@ jobs:
     - name: Docs
       if: startsWith(matrix.os, 'ubuntu') && matrix.python-version == 3.10
       run: |
-        python3 -m pip install furo sphinx-copybutton sphinx-issues sphinx-removed-in sphinxext-opengraph
         make doccheck
 
     - name: After success
       run: |
         .ci/after_success.sh
 
     - name: Upload coverage
-      run: bash <(curl -s https://codecov.io/bash) -F ${{ matrix.codecov-flag }}
-      env:
-        CODECOV_NAME: ${{ matrix.os }} Python ${{ matrix.python-version }}
+      uses: codecov/codecov-action@v3
+      with:
+        file: ./coverage.xml
+        flags: ${{ matrix.os == 'macos-latest' && 'GHA_macOS' || 'GHA_Ubuntu' }}
+        name: ${{ matrix.os }} Python ${{ matrix.python-version }}
 
   success:
     permissions:

.github/workflows/tidelift.yml

@@ -1,4 +1,5 @@
 name: Tidelift Align
+
 on:
   schedule:
     - cron: "30 2 * * *"  # daily at 02:30 UTC
@@ -15,6 +16,10 @@ on:
 permissions:
   contents: read
 
+concurrency: 
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
     if: github.repository_owner == 'python-pillow'