They say they filed a false positive with Microsoft, it would be best if it's resolved that way so we can keep the sdist as testable as possible on its own.

So shall we only include the actual problematic ones in this PR?

And it's only a couple of weeks until the next release, shall we check back in with the reporter a few days before release, and if it's not been resolved by MS, then merge?

Sure, I've updated the commit to only include the reported image.

Be interesting to see if Microsoft does accept this as a false positive - they'd have to detect that a more recent version of Pillow is present on the system to understand that this is not a threat.

Two days until release. Please could you ping the original reporter? Thanks!

Sure, pinged them on gitter - https://gitter.im/python-pillow/Pillow?at=60d9b48eb60c3137c39812a6

Doesn't sound like Microsoft is going to resolve it - https://gitter.im/python-pillow/Pillow?at=60da4c58b60c3137c3997e19

Thanks for checking!