Use CVE and CWE roles from Sphinx 8.1

[hugovk]

Changes proposed in this pull request:

• Sphinx 8.1 adds roles for referencing CVEs (:cve:) and CWEs (:cwe:)
• https://www.sphinx-doc.org/en/master/changes/index.html
• Let's use those instead of our own extlinks
• Update Makefile so we install Pillow for docs builds using the docs extra, so installs Sphinx 8.1+, and avoids defining the docs dependencies in two places

[radarhere]

Note: This changes the CVE URL from https://www.cve.org/CVERecord?id=CVE-%s to https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-%s

[radarhere]

Why change this to use an editable install?

[hugovk]

Force of habit typing -e!

Which do you prefer?

[radarhere]

I'm not fussed. I suppose -e is consistent with our other command in the Makefile that installs an optional dependency.

Pillow/Makefile

Line 76 in 97438cb

python3 -m pip install -e .[tests]

[radarhere]

Sphinx 8 doesn't support Python 3.9. Maybe we should hold off on this until Pillow 12?

[hugovk]

Note: This changes the CVE URL from cve.org/CVERecord?id=CVE-%s to cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-%s

Thanks, I've opened sphinx-doc/sphinx#13006 to update it in Sphinx.

Sphinx 8 doesn't support Python 3.9. Maybe we should hold off on this until Pillow 12?

Building docs is a different application to the Pillow API's version support policy. And we already upgraded to Sphinx 7.3 (#7985) which also doesn't support Python 3.9 :)

Sphinx's support policy is derived from SPEC 0 meaning they support fewer versions than we do. If we required Sphinx to build on all our supported versions, we'd have to use quite old Sphinx versions.

[radarhere]

we already upgraded to Sphinx 7.3 (#7985) which also doesn't support Python 3.9 :)

I think it does support Python 3.9.

But that PR did mean that Sphinx didn't support Python 3.8, before we dropped Python 3.8 support from the rest of Pillow in #8183, so your point still stands.

[hugovk]

But that PR did mean that Sphinx didn't support Python 3.8, before we dropped Python 3.8 support from the rest of Pillow in #8183, so your point still stands.

Yes, this is what I meant 😅

[hugovk]

Thanks, I've opened sphinx-doc/sphinx#13006 to update it in Sphinx.

Merged and released in https://github.com/sphinx-doc/sphinx/releases/tag/v8.1.1.