fix(deps): bump Pillow to 12.3.0 (clears 13 Dependabot alerts)

Merged
SA
3mo ago
+1-1

Bumps Pillow in agent/requirements.txt from 12.2.0 to 12.3.0, clearing all 13 open Dependabot alerts on this repo (10 high, 3 medium, max CVSS 8.2). Pillow is the only vulnerable package here, so this single bump takes the repo to zero open alerts.

Advisories fixed — GHSA-9hw9-ch79-4vh6, GHSA-vjc4-5qp5-m44j, GHSA-jjj6-mw9f-p565, GHSA-6r8x-57c9-28j4, GHSA-xj96-63gp-2gmr, GHSA-phj9-mv4w-65pm, GHSA-45hq-cxwh-f6vc, GHSA-5x94-69rx-g8h2, GHSA-8v84-f9pq-wr9x, GHSA-62p4-gmf7-7g93 (high); GHSA-fj7v-r99m-22gq, GHSA-4x4j-2g7c-83w6, GHSA-pg7v-jwj7-p798 (medium).

Verification

  • Installed Pillow==12.3.0 together with the other two pins (websockets==15.0.1, httpx==0.28.1) in a clean venv — resolves with no conflicts.
  • 12.3.0 requires Python >=3.10 (unchanged from 12.2.0) and ships manylinux wheels for cp310–cp315, so the python3 -m venv on the VM image still gets a wheel, not a source build.
  • The only Pillow consumer is agent/agency-report (Image.new, img.load(), ImageDraw.textbbox, ImageFont.truetype). Exercised those APIs against 12.3.0 — unchanged.
  • agent/bootstrap.sh hashes requirements.txt and re-runs pip install when it changes, so deployed agents pick this up on the next bootstrap without extra work.

Note: the same bump is still needed in browser-use and browser-harness per ENG-5628.

Closes ENG-5628

Summary by cubic

Updates Pillow from 12.2.0 to 12.3.0 to patch 13 security advisories and clear all Dependabot alerts in this repo. Behavior is unchanged; agent/agency-report image APIs remain compatible.

Review and rollout

  • Single-line change in agent/requirements.txt; resolves 13 alerts (10 high, 3 medium; max CVSS 8.2).
  • Verified Image.new, img.load(), ImageDraw.textbbox, and ImageFont.truetype against 12.3.0.
  • No action required: agent/bootstrap.sh re-installs on requirements hash change. Addresses ENG-5628; similar bumps may still be needed in browser-use and browser-harness.