presidio

This is a security release. It raises the Pillow requirement of presidio-image-redactor to 13.0.0, refreshes every lock file to clear 100 known advisories, locks Transformers 5.16.1 in the analyzer, and ships slimmed container images plus new distroless variants. It also drops Python 3.10.

Packages: presidio-analyzer 2.2.366, presidio-anonymizer 2.2.366, presidio 2.2.366, presidio-image-redactor 0.0.62, presidio-structured 0.0.10.

Upgrade notes

• Python 3.10 is no longer supported. Python 3.10 reached end of life on 2026-10-01. All packages now require Python >=3.11,<3.15. Installs on Python 3.10 resolve to the previous releases.
• presidio-image-redactor requires Pillow 13. The requirement is now pillow>=13.0.0,<14.0.0. Pillow 13 fixes the 41 security advisories (5 critical, 23 high) open against Pillow 12.3.0 (#2393).
• The spaCy factory hf_token_pipe is gone. The analyzer no longer depends on spacy-huggingface-pipelines. TransformersNlpEngine now registers its own presidio_hf_token_pipe factory. A spaCy pipeline saved with nlp.to_disk() that references hf_token_pipe no longer loads; Presidio never saves such a pipeline itself. Detection results and scores are unchanged.
• New minimums for the analyzer extras. The transformers extra requires transformers>=4.28.0,<6.0.0. The gliner extra requires gliner>=0.2.29, transformers>=4.51.3,<5.17.0 and a single onnxruntime>=1.19. Installing Transformers 5.10 or later is recommended to pick up the security fixes.
• Container images no longer ship curl. The image HEALTHCHECK now probes /health with the Python standard library and ignores HTTP_PROXY. The docker-compose.yml healthcheck overrides were removed so the image healthchecks apply. Existing image tags keep their names.

Security

• Slimmed and hardened the default analyzer and anonymizer images: the python:3.12-slim and python:3.14-slim bases are re-pinned with OS security updates applied, uv is bind-mounted at build time instead of installed, and setuptools and wheel (plus pip in the anonymizer) are removed from the final image. Trivy critical, high and medium findings drop from 321 to 103 (anonymizer) and from 345 to 113 (analyzer). (#2407)
• Refreshed every uv.lock file to fix the 100 known advisories in the locked development and CI dependencies, including pillow 13.0.0, virtualenv 21.14.13, pyjwt 2.15.1, aiohttp 3.14.5, urllib3 2.8.0, cryptography 50.0.2, filelock 4.2.4, oauthlib 4.0.0 and certifi 2026.10.23. Apart from the Pillow and onnxruntime requirements above, published dependency ranges are unchanged. (#2409)
• Locked transformers to 5.16.1 in the analyzer, which fixes GHSA-xrqw-3rrv-vx5w and GHSA-x9r9-c232-4q39. (#2201)
• Raised the presidio-image-redactor Pillow requirement to 13 and replaced the Image.getdata() call in the DICOM redactor with get_flattened_data(), since getdata() is deprecated in Pillow 13 and removed in Pillow 14. (#2393, #2409)

Added

• Distroless container images. The analyzer and anonymizer are also published as distroless images built on Azure Linux, tagged <version>-distroless and latest-distroless in the same GHCR repositories. The unsuffixed tags, including latest, remain the default images. The distroless images contain no shell, package manager, pip or uv, run Python 3.12 as UID 65532, listen on port 3000, and take gunicorn settings through GUNICORN_CMD_ARGS instead of PORT and WORKERS. Trivy findings are 1 (anonymizer) and 6 (analyzer). A docker-compose.distroless.yml override runs them locally. (#2407)

  docker pull ghcr.io/data-privacy-stack/presidio-analyzer:2.2.366-distroless
  docker pull ghcr.io/data-privacy-stack/presidio-anonymizer:2.2.366-distroless
  

• Context-aware enhancer configuration in YAML. A new optional context_aware_enhancer section in the analyzer configuration sets the `LemmaContextA