[Security] Dependabot: pillow (high) #428

#jules

Vulnerable dependency: pillow

• Highest severity: high

• Open alerts: 4

• GHSA-p4wg-p73j-c528 Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
  manifest: poetry.lock, fixed in: 13.0.0

• GHSA-p4wg-p73j-c528 Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
  manifest: requirements.txt, fixed in: 13.0.0

• GHSA-462x-pgg6-55fp Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)
  manifest: poetry.lock, fixed in: 13.0.0

• GHSA-462x-pgg6-55fp Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)
  manifest: requirements.txt, fixed in: 13.0.0

Remediation steps

1. Upgrade pillow to at least the fixed version(s) listed above in every manifest/lockfile.
2. Regenerate lockfiles and run the test suite.
3. Open a PR; the Dependabot alerts should auto-close after merge.