From 3ab6676bfd7578df8f172eed1d8dc82531dd25e0 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Fri, 23 Oct 2026 18:40:22 +0000
Subject: [PATCH] fix(security): upgrade Pillow to 13.0.0

Upgrade Pillow dependency constraint to >=13.0.0,<14.0.0 to remediate critical security vulnerabilities across pyproject.toml, requirements.txt, python_env.yaml, and poetry.lock.

Co-authored-by: lgcorzo <46710567+lgcorzo@users.noreply.github.com>
---
 poetry.lock      | 2 +-
 pyproject.toml   | 2 ++
 python_env.yaml  | 2 +-
 requirements.txt | 2 +-
 4 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/poetry.lock b/poetry.lock
index 86bbdb0..5484544 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -8511,4 +8511,4 @@ testing = ["coverage[toml]", "zope.event", "zope.testing"]
 [metadata]
 lock-version = "2.1"
 python-versions = ">=3.12,<3.13"
-content-hash = "b9dd7e4e82271c5f69b56f9a7667d4247bdf18715d61e0bc6e9154606f1a5938"
+content-hash = "7e81aa81e8fbdb0cb066a18cadfb7681932125c6391683d3dbb6a9fb53408bb3"
diff --git a/pyproject.toml b/pyproject.toml
index 22c88c5..44fd3e8 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -50,6 +50,8 @@ dependencies = [
     "tornado (>=6.5.8,<7.0.0)",
     # explicitly define secure version for transitive dependency aiohttp
     "aiohttp (>=3.14.4,<4.0.0)",
+    # explicitly define secure version for transitive dependency Pillow
+    "pillow (>=13.0.0,<14.0.0)",
 ]
 
 [project.scripts]
diff --git a/python_env.yaml b/python_env.yaml
index c5648ff..7a37e3c 100644
--- a/python_env.yaml
+++ b/python_env.yaml
@@ -136,7 +136,7 @@
         "pandas==2.3.3",
         "pandera==0.20.4",
         "pathspec==1.1.1",
-        "pillow==12.3.0",
+        "pillow==13.0.0",
         "platformdirs==4.11.0",
         "plotly==5.24.1",
         "plyer==2.1.0",
diff --git a/requirements.txt b/requirements.txt
index d1c7ee5..8efc7cb 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -133,7 +133,7 @@ packaging==26.2 ; python_version == "3.12"
 pandas==2.3.3 ; python_version == "3.12"
 pandera==0.20.4 ; python_version == "3.12"
 pathspec==1.1.1 ; python_version == "3.12"
-pillow==12.3.0 ; python_version == "3.12"
+pillow==13.0.0 ; python_version == "3.12"
 platformdirs==4.11.0 ; python_version == "3.12"
 plotly==5.24.1 ; python_version == "3.12"
 plyer==2.1.0 ; python_version == "3.12"