chore: bump pillow and python-multipart for CVEs, add SECURITY.md

[johnnygreco]

Summary

• Pillow 12.1.1 → 12.2.0 to fix CVE-2026-40192 (unbounded GZIP decompression in FitsGzipDecoder.decode() — DoS via decompression bomb). Direct dep of data-designer-config; floor bumped in its pyproject.toml.
• python-multipart 0.0.22 → 0.0.26 via a new entry in the workspace [tool.uv].constraint-dependencies block (transitive dep via mcp).
• Adds NVIDIA SECURITY.md outlining the vulnerability disclosure process (PSIRT email, submission form).

[greptile-apps]

Greptile Summary

This PR bumps Pillow from 12.1.1 to 12.2.0 (CVE-2026-40192 — FITS GZIP decompression bomb DoS), adds a >=0.0.26 floor constraint for python-multipart (transitive via mcp) in the workspace constraint-dependencies, updates uv.lock accordingly, and adds an NVIDIA SECURITY.md with the PSIRT vulnerability disclosure process.

Confidence Score: 5/5

Safe to merge — routine security dependency bumps with no logic changes and consistent lockfile updates.

All changes are targeted version floor bumps for known CVEs, the lockfile is updated consistently, and no application logic is touched. No P0 or P1 findings.

No files require special attention.

Important Files Changed

Filename	Overview
packages/data-designer-config/pyproject.toml	Pillow floor bumped from >=12.1.1 to >=12.2.0 with inline CVE comment; change is correct and consistent with the lockfile update.
pyproject.toml	python-multipart>=0.0.26 added to workspace constraint-dependencies alongside the existing aiohttp and cryptography entries; comment is slightly less specific (no CVE number) compared to sibling entries but not a bug.
uv.lock	Lockfile updated to reflect Pillow 12.2.0 wheels/hashes and the new python-multipart constraint; no inconsistencies observed.
SECURITY.md	New NVIDIA PSIRT disclosure policy file; content and contact details match standard NVIDIA security policy; top-level heading uses ## (H2) rather than # (H1), which is atypical but likely matches the intended NVIDIA template.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[uv workspace root\npyproject.toml] -->|constraint-dependencies| B[python-multipart >= 0.0.26]
    A -->|constraint-dependencies| C[aiohttp >= 3.13.5]
    A -->|constraint-dependencies| D[cryptography >= 46.0.7]

    E[packages/data-designer-config\npyproject.toml] -->|direct dependency| F[pillow >= 12.2.0, < 13\nfixes CVE-2026-40192]

    B -->|resolves transitive dep via| G[mcp]
    F -->|updated in| H[uv.lock\nPillow 12.2.0 wheels + hashes\npython-multipart constraint]

Loading

_{Reviews (1): Last reviewed commit: "chore: bump pillow and python-multipart ..." | Re-trigger Greptile}