chore(deps): bump pillow from 12.2.0 to 12.3.0 in /envs/websearch_env - #1004
chore(deps): bump pillow from 12.2.0 to 12.3.0 in /envs/websearch_env#1004dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
Dependencies
python:uv
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
PR #1004 — bump pillow 12.2.0 → 12.3.0 in /envs/websearch_env (dependabot). Scope is lockfile-only: a single file envs/websearch_env/uv.lock (+219/−223). Package set is unchanged (122 packages, 0 added / 0 removed); the only version change is pillow 12.2.0 → 12.3.0.
Automated Checks
- Lint: PASS (N/A to this PR).
.claude/hooks/lint.shonly lints.pyundersrc//tests//envs/and its non-zero exit comes from pre-existing reformat candidates in unrelated envs — it never touchesuv.lock/TOML, and this PR changes no Python. Authoritative checkuv lock --check --project envs/websearch_envpasses (resolves cleanly). - Debug code: CLEAN.
check-debug.shhits are all pre-existing insrc/; the only changed file isenvs/websearch_env/uv.lock(0 debug hits).
Open RFCs Context
RFCs present: 000/001/002/005 (In Review), 003 (In Review, MCP), 004 (Rubrics, no status header), 010 (Draft, env-token world-modeling). None govern dependency management, packaging, or the PyPI index, so there is no RFC surface for a lockfile bump.
Tier 1: Fixes Required
None.
- Lockfile is internally consistent (
uv lock --checkpasses). - pillow 12.3.0 artifacts verified live against PyPI: sdist
3b8182a7…/ size47025035matches the lock, not yanked,requires-python >=3.10is satisfied by the env. - Every changed
files.pythonhosted.orgline belongs to pillow only (net −4 lines = pillow dropped cp313t free-threaded wheels and added 3.15-beta previews upstream — not a package removal). - Security-positive: pillow 12.2.0 carries 21 advisories, ALL
fixed_in: 12.3.0(e.g. GHSA-62p4-gmf7-7g93, GHSA-8v84-f9pq-wr9x, PYSEC-2026-2253…). This bump is a net security improvement.
Tier 2: Alignment Discussion
Principle Conflicts
None. pillow is a transitive dep (via gradio; not pinned in pyproject.toml), so a lock-only change with no floor bump is correct. No API / reward / client-server / MCP surface is touched. Two recurring reproducibility / process notes (informational, not blockers):
ALIGNMENT FLAG: Index source flipped from the HF mirror to public PyPI
- Principle at stake: "Container isolation for reproducibility" (PRINCIPLES.md)
- The concern: all 129
source = { registry = … }refs were rewrittenhttps://pypi.registries.huggingface.tech/→https://pypi.org/simple. Artifact URLs stay onfiles.pythonhosted.organd hashes are unchanged (very likely benign), but it changes the env's declared provenance fleet-wide. Registry choice is a team decision → flagging, not fixing. - Suggested reviewer: @Darktex, @burtenshaw
ALIGNMENT FLAG: Lock revision bumped 2 → 3
- The concern:
envs/websearch_env/server/Dockerfilebuilds withuv sync --frozen, so the resolver reading this lock must support revision 3. Low risk — the Dockerfile installs currentuvon the fly when the base image lacks it (lines 35–39), which supports rev 3. Heads-up only. - Suggested reviewer: @Darktex, @burtenshaw
Process note (unchanged file, no inline): .github/dependabot.yml's uv updater declares exclude-paths: ["envs/**"], yet this native dependabot/uv/envs/websearch_env/… PR still edits envs/. Known platform limitation (the uv ecosystem isn't honoring exclude-paths); the aggregate codex/dependabot-envs-* roll-ups are the intended path. FYI @burtenshaw.
RFC Conflicts
None identified.
Summary
- 0 mechanical issues to fix (Tier 1)
- 2 alignment points for human review (index-source flip + lock revision bump — both recurring, low-risk) + 1 dependabot-config process note
- 0 RFC conflicts
Verdict: Clean, security-positive transitive dependency bump. Safe to proceed once the team is comfortable with the index-source flip (a fleet-wide recurring pattern, not specific to this PR).
Sent by Cursor Automation: Pre-review
| @@ -1,5 +1,5 @@ | |||
| version = 1 | |||
| revision = 2 | |||
| revision = 3 | |||
There was a problem hiding this comment.
Lock revision 2 → 3. This env's server/Dockerfile builds with uv sync --frozen, so the resolver that reads this lock must understand revision 3. Low risk: the Dockerfile installs the current uv on the fly when the base image lacks it (Dockerfile lines 35–39), and current uv supports rev 3. Heads-up only — no action needed. cc @Darktex @burtenshaw
| @@ -17,7 +17,7 @@ resolution-markers = [ | |||
| [[package]] | |||
| name = "aiofile" | |||
| version = "3.9.0" | |||
| source = { registry = "https://pypi.registries.huggingface.tech/" } | |||
| source = { registry = "https://pypi.org/simple" } | |||
There was a problem hiding this comment.
Index-source flip (reproducibility). This is the first of 129 source = { registry = … } refs rewritten from the HF mirror (pypi.registries.huggingface.tech) to public PyPI (pypi.org/simple). Artifact URLs remain on files.pythonhosted.org and every hash is unchanged, so it's very likely benign — but it changes this env's declared provenance fleet-wide. Registry choice is a team decision, so flagging rather than reverting. cc @Darktex @burtenshaw
| { url = "https://files.pythonhosted.org/packages/c3/28/ec0fc38107fc32536908034e990c47914c57cd7c5a3ece4d8d8f7ffd7e27/pillow-12.2.0-pp311-pypy311_pp73-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4a6c9fa44005fa37a91ebfc95d081e8079757d2e904b27103f4f5fa6f0bf78c0", size = 5355404, upload-time = "2026-04-01T14:46:06.33Z" }, | ||
| { url = "https://files.pythonhosted.org/packages/5e/8b/51b0eddcfa2180d60e41f06bd6d0a62202b20b59c68f5a132e615b75aecf/pillow-12.2.0-pp311-pypy311_pp73-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:25373b66e0dd5905ed63fa3cae13c82fbddf3079f2c8bf15c6fb6a35586324c1", size = 6002215, upload-time = "2026-04-01T14:46:08.83Z" }, | ||
| { url = "https://files.pythonhosted.org/packages/bc/60/5382c03e1970de634027cee8e1b7d39776b778b81812aaf45b694dfe9e28/pillow-12.2.0-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:bfa9c230d2fe991bed5318a5f119bd6780cda2915cca595393649fc118ab895e", size = 7080946, upload-time = "2026-04-01T14:46:11.734Z" }, | ||
| version = "12.3.0" |
There was a problem hiding this comment.
The actual bump — and it's security-positive. pillow 12.2.0 → 12.3.0 (transitive via gradio). Verified against PyPI: sdist 3b8182a7… / size 47025035 matches, not yanked, requires-python >=3.10 satisfied. pillow 12.2.0 carries 21 advisories, all fixed_in: 12.3.0 (GHSA-62p4-gmf7-7g93, GHSA-8v84-f9pq-wr9x, PYSEC-2026-2253…). uv lock --check passes. No action needed.
|
Aggregated into maintainer PR #1015 for env-only Dependabot updates. |
Bumps [pillow](https://github.com/python-pillow/Pillow) from 12.2.0 to 12.3.0. - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@12.2.0...12.3.0) --- updated-dependencies: - dependency-name: pillow dependency-version: 12.3.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
951aa3a to
fd00d2c
Compare
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps pillow from 12.2.0 to 12.3.0.
Release notes
Sourced from pillow's releases.
... (truncated)
Commits
bb1d8e812.3.0 version bumpe63fc48Add release notes for SBOM and performance improvements (#9747)13b701bAdd release notes for #96795564ca7List methodsa0920fdSpeed up ImageChops operations (#9738)07e9a6cSpeed upImage.filter()(#9736)a94578cSpeed upImage.getchannel(),Image.merge(),Image.putalpha()and `Image...53e02c4Speed upImage.fill(),Image.linear_gradient()and `Image.radial_gradient...af03747Speed upImage.resample()(#9739)5c9ca56Speed upalpha_composite,matrix,negative,quantize(#9740)Note
Low Risk
Lockfile-only patch/minor dependency bump with no repo code changes; main caveat is upstream API removal for niche ImageCms modes.
Overview
Updates the Pillow transitive dependency in
envs/websearch_envfrom 12.2.0 to 12.3.0, reflected inuv.lockonly—no changes topyproject.tomlor application code.12.3.0 is a minor release with image-processing performance improvements, security-related release notes, and removal of non-image ImageCms modes (unlikely to affect typical websearch usage unless that API was relied on).
Reviewed by Cursor Bugbot for commit fd00d2c. Bugbot is set up for automated code reviews on this repo. Configure here.