fix(deps): bump pillow to 13.0.0 for GHSA-8g5g-8vmr-9782

Merged
CL
1d ago
+171-171

Requested by Nikolas Garza ยท Slack thread

Description

Before: Pillow was locked at 12.3.0, which has a critical heap buffer overflow in the JPEG decoder (GHSA-8g5g-8vmr-9782). The daily CVE audit fails on main because of it (#16335).

After: Pillow is locked at 13.0.0, the first release with the fix. The audit finding should clear.

This bumps pillow from 12.3.0 to 13.0.0 in the Python lockfile, the exported requirements files and the sandbox image pins.

How: Pillow is not pinned in pyproject.toml (it comes in through other dependencies), so no constraint change was needed. I ran uv lock --upgrade-package pillow (only pillow changed in uv.lock) and re-ran the repo's pre-commit uv export commands for backend/requirements/{default,dev}.txt (ee.txt and model_server.txt don't include pillow). I also hand-edited the pillow pin in backend/onyx/server/features/build/sandbox/image/initial-requirements.txt, after checking that uv pip compile still resolves with pillow 13.0.0 alongside matplotlib, pdfplumber and python-pptx. 13.0.0 is a new major version, so CI should be watched for API breakage. A grep of backend/ found no uses of the usual removed Pillow APIs, but this was not run against tests.

Fixes #16335

The certifi finding (#16334) is not part of this PR; it already has #16337.

How Has This Been Tested?

Lockfile and requirements regenerated locally with uv. Relying on CI for the test run.

Additional Options

  • [Optional] Please cherry-pick this PR to the latest release version.

Generated by Claude Code

Summary by cubic

Bumps pillow from 12.3.0 to 13.0.0 to fix GHSA-8g5g-8vmr-9782, a critical heap buffer overflow in the JPEG decoder that has been failing the daily CVE audit on main (#16335). The uv lockfile, exported requirements files, and sandbox image pins are all updated; only pillow changed.

Dependencies

  • pillow is not pinned in pyproject.toml, so no constraint change was needed.
  • 13.0.0 is a major version bump; no removed Pillow APIs were found in backend/, but CI should still be watched.

Summary by CodeRabbit

  • Chores
    • Updated image-processing support to the latest available release.
    • Applied the update consistently across runtime, development, and build environments.
    • Refreshed package integrity information to support reliable installation and deployment.