chore(deps): bump pillow from 12.2.0 to 12.3.0 in /envs/websearch_env#1004
chore(deps): bump pillow from 12.2.0 to 12.3.0 in /envs/websearch_env#1004dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [pillow](https://github.com/python-pillow/Pillow) from 12.2.0 to 12.3.0. - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@12.2.0...12.3.0) --- updated-dependencies: - dependency-name: pillow dependency-version: 12.3.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
python:uv
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
PR #1004 — bump pillow 12.2.0 → 12.3.0 in /envs/websearch_env (dependabot). Scope is lockfile-only: a single file envs/websearch_env/uv.lock (+219/−223). Package set is unchanged (122 packages, 0 added / 0 removed); the only version change is pillow 12.2.0 → 12.3.0.
Automated Checks
- Lint: PASS (N/A to this PR).
.claude/hooks/lint.shonly lints.pyundersrc//tests//envs/and its non-zero exit comes from pre-existing reformat candidates in unrelated envs — it never touchesuv.lock/TOML, and this PR changes no Python. Authoritative checkuv lock --check --project envs/websearch_envpasses (resolves cleanly). - Debug code: CLEAN.
check-debug.shhits are all pre-existing insrc/; the only changed file isenvs/websearch_env/uv.lock(0 debug hits).
Open RFCs Context
RFCs present: 000/001/002/005 (In Review), 003 (In Review, MCP), 004 (Rubrics, no status header), 010 (Draft, env-token world-modeling). None govern dependency management, packaging, or the PyPI index, so there is no RFC surface for a lockfile bump.
Tier 1: Fixes Required
None.
- Lockfile is internally consistent (
uv lock --checkpasses). - pillow 12.3.0 artifacts verified live against PyPI: sdist
3b8182a7…/ size47025035matches the lock, not yanked,requires-python >=3.10is satisfied by the env. - Every changed
files.pythonhosted.orgline belongs to pillow only (net −4 lines = pillow dropped cp313t free-threaded wheels and added 3.15-beta previews upstream — not a package removal). - Security-positive: pillow 12.2.0 carries 21 advisories, ALL
fixed_in: 12.3.0(e.g. GHSA-62p4-gmf7-7g93, GHSA-8v84-f9pq-wr9x, PYSEC-2026-2253…). This bump is a net security improvement.
Tier 2: Alignment Discussion
Principle Conflicts
None. pillow is a transitive dep (via gradio; not pinned in pyproject.toml), so a lock-only change with no floor bump is correct. No API / reward / client-server / MCP surface is touched. Two recurring reproducibility / process notes (informational, not blockers):
ALIGNMENT FLAG: Index source flipped from the HF mirror to public PyPI
- Principle at stake: "Container isolation for reproducibility" (PRINCIPLES.md)
- The concern: all 129
source = { registry = … }refs were rewrittenhttps://pypi.registries.huggingface.tech/→https://pypi.org/simple. Artifact URLs stay onfiles.pythonhosted.organd hashes are unchanged (very likely benign), but it changes the env's declared provenance fleet-wide. Registry choice is a team decision → flagging, not fixing. - Suggested reviewer: @Darktex, @burtenshaw
ALIGNMENT FLAG: Lock revision bumped 2 → 3
- The concern:
envs/websearch_env/server/Dockerfilebuilds withuv sync --frozen, so the resolver reading this lock must support revision 3. Low risk — the Dockerfile installs currentuvon the fly when the base image lacks it (lines 35–39), which supports rev 3. Heads-up only. - Suggested reviewer: @Darktex, @burtenshaw
Process note (unchanged file, no inline): .github/dependabot.yml's uv updater declares exclude-paths: ["envs/**"], yet this native dependabot/uv/envs/websearch_env/… PR still edits envs/. Known platform limitation (the uv ecosystem isn't honoring exclude-paths); the aggregate codex/dependabot-envs-* roll-ups are the intended path. FYI @burtenshaw.
RFC Conflicts
None identified.
Summary
- 0 mechanical issues to fix (Tier 1)
- 2 alignment points for human review (index-source flip + lock revision bump — both recurring, low-risk) + 1 dependabot-config process note
- 0 RFC conflicts
Verdict: Clean, security-positive transitive dependency bump. Safe to proceed once the team is comfortable with the index-source flip (a fleet-wide recurring pattern, not specific to this PR).
Sent by Cursor Automation: Pre-review
| @@ -1,5 +1,5 @@ | |||
| version = 1 | |||
| revision = 2 | |||
| revision = 3 | |||
There was a problem hiding this comment.
Lock revision 2 → 3. This env's server/Dockerfile builds with uv sync --frozen, so the resolver that reads this lock must understand revision 3. Low risk: the Dockerfile installs the current uv on the fly when the base image lacks it (Dockerfile lines 35–39), and current uv supports rev 3. Heads-up only — no action needed. cc @Darktex @burtenshaw
| @@ -17,7 +17,7 @@ resolution-markers = [ | |||
| [[package]] | |||
| name = "aiofile" | |||
| version = "3.9.0" | |||
| source = { registry = "https://pypi.registries.huggingface.tech/" } | |||
| source = { registry = "https://pypi.org/simple" } | |||
There was a problem hiding this comment.
Index-source flip (reproducibility). This is the first of 129 source = { registry = … } refs rewritten from the HF mirror (pypi.registries.huggingface.tech) to public PyPI (pypi.org/simple). Artifact URLs remain on files.pythonhosted.org and every hash is unchanged, so it's very likely benign — but it changes this env's declared provenance fleet-wide. Registry choice is a team decision, so flagging rather than reverting. cc @Darktex @burtenshaw
| { url = "https://files.pythonhosted.org/packages/c3/28/ec0fc38107fc32536908034e990c47914c57cd7c5a3ece4d8d8f7ffd7e27/pillow-12.2.0-pp311-pypy311_pp73-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4a6c9fa44005fa37a91ebfc95d081e8079757d2e904b27103f4f5fa6f0bf78c0", size = 5355404, upload-time = "2026-04-01T14:46:06.33Z" }, | ||
| { url = "https://files.pythonhosted.org/packages/5e/8b/51b0eddcfa2180d60e41f06bd6d0a62202b20b59c68f5a132e615b75aecf/pillow-12.2.0-pp311-pypy311_pp73-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:25373b66e0dd5905ed63fa3cae13c82fbddf3079f2c8bf15c6fb6a35586324c1", size = 6002215, upload-time = "2026-04-01T14:46:08.83Z" }, | ||
| { url = "https://files.pythonhosted.org/packages/bc/60/5382c03e1970de634027cee8e1b7d39776b778b81812aaf45b694dfe9e28/pillow-12.2.0-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:bfa9c230d2fe991bed5318a5f119bd6780cda2915cca595393649fc118ab895e", size = 7080946, upload-time = "2026-04-01T14:46:11.734Z" }, | ||
| version = "12.3.0" |
There was a problem hiding this comment.
The actual bump — and it's security-positive. pillow 12.2.0 → 12.3.0 (transitive via gradio). Verified against PyPI: sdist 3b8182a7… / size 47025035 matches, not yanked, requires-python >=3.10 satisfied. pillow 12.2.0 carries 21 advisories, all fixed_in: 12.3.0 (GHSA-62p4-gmf7-7g93, GHSA-8v84-f9pq-wr9x, PYSEC-2026-2253…). uv lock --check passes. No action needed.
1 participant
Bumps pillow from 12.2.0 to 12.3.0.
Release notes
Sourced from pillow's releases.
... (truncated)
Commits
bb1d8e812.3.0 version bumpe63fc48Add release notes for SBOM and performance improvements (#9747)13b701bAdd release notes for #96795564ca7List methodsa0920fdSpeed up ImageChops operations (#9738)07e9a6cSpeed upImage.filter()(#9736)a94578cSpeed upImage.getchannel(),Image.merge(),Image.putalpha()and `Image...53e02c4Speed upImage.fill(),Image.linear_gradient()and `Image.radial_gradient...af03747Speed upImage.resample()(#9739)5c9ca56Speed upalpha_composite,matrix,negative,quantize(#9740)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Lockfile-only transitive dependency bump with no repo code changes; typical low risk for a patch release, with minor upstream API removals in niche ImageCms paths.
Overview
Bumps the locked Pillow image library from 12.2.0 to 12.3.0 in
envs/websearch_env(viauv.lock). Pillow is not declared inpyproject.toml; it remains a transitive dependency of the websearch environment’s resolved graph.This is a patch/minor dependency refresh only—no application source changes. 12.3.0 includes security-related release notes, performance improvements, and removal of non-image ImageCms modes upstream.
Reviewed by Cursor Bugbot for commit 951aa3a. Bugbot is set up for automated code reviews on this repo. Configure here.