deps: Pillow 13.0.0 fixes the 39 advisories open against 12.3.0

Merged
HA
7d ago
+50-50

Summary

Dependabot has 39 open alerts against Pillow 12.3.0 (4 critical, 23 high, 12 medium), all fixed in 13.0.0, and the SBOM workflow's Grype scan reports the same 39 under code scanning. Pillow comes in through the load group (matplotlib draws the load-test charts), so it never ships in the backend image.

Changes

Pillow>=13.0.0 in the load group, relocked with uv 0.13.5, the version CI runs. The lock diff is Pillow alone. 13.0.0 came out on 2026-10-16, a few hours short of the 7-day cooldown Dependabot uses, and goes in now on request.

Type of Change

  • Bug fix (non-breaking change that fixes an issue)
  • New feature (non-breaking change that adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update
  • Refactoring (no functional changes)
  • CI/CD or tooling changes

Test Plan

  • Backend unit tests pass (cd backend && uv run pytest tests/unit)
  • Frontend unit tests pass (cd frontend && npm run test)
  • Backend E2E tests pass (docker compose exec -T backend sh -c 'uv sync --group test --no-dev --frozen --no-install-project --no-build && pytest tests/e2e')
  • Frontend E2E tests pass (cd frontend && npm run test:e2e)
  • API spec and client regenerated if routes or schemas changed (uv run python -m scripts.export_openapi in backend/, then npm run generate:api in frontend/), never edited by hand
  • Manual testing performed

Validation: tests/load/plot_report.py renders all three charts with Pillow 13.0.0 and matplotlib 3.11.2, and Pillow reads them back. All 140 locked packages come back clean from OSV, and npm audit finds nothing in the frontend lockfile.

Checklist

  • My code follows the project's style guidelines
  • I have run pre-commit run --all-files and all checks pass
  • I have added tests that prove my fix/feature works
  • I have updated documentation if needed
  • My changes don't introduce new warnings

Summary by cubic

Upgrades Pillow to 13.0.0 to fix the 39 security advisories (4 critical, 23 high, 12 medium) affecting 12.3.0. Pillow is only used by the load group for load-test charts, not in the backend image. Locked with the CI's uv version; the diff is Pillow alone. Verified all three charts render correctly with plot_report.py.