Robocorp 3.1.7: pillow 13 and Python 3.11 for robocorp-windows and robocorp-excel, viewer tooling update in robocorp-log

Robocorp Windows and Robocorp Excel: Python 3.11 and pillow 13

robocorp-windows 2.0.0 and robocorp-excel 0.6.0 now require Python 3.11 or newer and pillow 13.0.0 or newer (#498). Pillow 13 fixes 41 advisories reported against the previous lock files, five of them CRITICAL: heap buffer overflows in the JPEG, FlashPix and TIFF decoders, stale native storage reuse in the multi-frame loaders and argument injection in the Ghostscript call. Pillow 13 only supports Python 3.11 and newer, and Python 3.10 reached end of life in October 2026, so both packages raise their Python floor and get a breaking version bump. Nothing changes in the libraries themselves.

On Python 3.10, pip install robocorp-windows keeps resolving to 1.1.3 and robocorp-excel to 0.5.1. If something else in your environment pins pillow below 13, pip will tell you when you upgrade.

Robocorp Log

robocorp-log 3.1.7 rebuilds the React application that renders log.html with vite 6.4.5 (CVE-2026-118662, server.fs.deny bypassed with query strings in the development server) and minimatch 11 (CVE-2026-118764, denial of service through glob-parts amplification). Both are build-time dependencies and do not end up in the generated log, so nothing changes in how you write logs.

The one remaining advisory in the repository, deepmerge (CVE-2026-93753, low), has no fixed release yet. It is a test-time dependency of the viewer build, pulled in by jest, and never ships to users.

Certificates

certifi 2026.10.18 and newer removes emSign root certificates whose intermediate CA keys were compromised. certifi is a transitive runtime dependency through requests and has no version floor in these packages, so every fresh install already receives the current release; the development lock files of robocorp-http, robocorp-storage, robocorp-vault, robocorp-workitems and the meta package were refreshed to 2026.10.23 without a release.

Upgrading

robocorp 3.1.7 pins the new robocorp-log, so upgrading the meta package is enough for it:

robocorp-windows and robocorp-excel are not part of the meta package; upgrade them separately if you use them, on Python 3.11 or newer:

Released packages

• package robocorp 3.1.7 (meta package)
• package robocorp-log 3.1.7
• package robocorp-windows 2.0.0
• package robocorp-excel 0.6.0