[andremun]

The lockfile contains Pillow 12.3.0, which has known image decoding, memory safety, and Ghostscript vulnerabilities. Require Pillow >=13.0.0 for fresh installations and update the lockfile to 13.0.0. Add the security update to the release notes.

Compatibility: Additive. Pillow is the only package record changed in the lockfile. ISA algorithms, numerical dependency series, public interfaces, and persisted schemas remain unchanged.

Validation on Python 3.12:

• All 1,137 strict tests pass with warnings treated as errors and 92.84% coverage, including plotting and exports.
• pip-audit reports 37 vulnerabilities before the update and none afterward across all 80 locked packages, with no skipped packages.
• Ruff, strict mypy, and Black checks pass.
• The documentation build checks all 42 pages, 74 option fields, local links, and anchors.
• Poetry lock validation, dependency consistency, source and wheel builds, and git diff checks pass.
• Built wheel metadata includes Requires-Dist: pillow (>=13.0.0).

GitHub reports 41 alerts on the default branch at push time. That count is separate from the pip-audit result above. GitHub's alert status needs to be checked after merging.

Advisories include CVE-2026-112398 and CVE-2026-112900.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.46%. Comparing base (6abbe2b) to head (9488c46).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #370   +/-   ##
=======================================
  Coverage   91.46%   91.46%           
=======================================
  Files          28       28           
  Lines        5919     5919           
  Branches      736      736           
=======================================
  Hits         5414     5414           
  Misses        325      325           
  Partials      180      180           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.