[Aparnap2]

What changed

Two files, dependency-only:

File	Change
pyproject.toml	pillow>=12.3.0 → pillow>=13.0.0 (1 line)
uv.lock	pillow 12.3.0 → 13.0.0

Base main@254c4b92dddf59a758a133c1edbf7618dcc011b2 · commit b0eeff2 · branch fix/pillow-cve-remediation.

No parser behaviour, fixture, business logic, CI workflow, or other dependency changed.

The advisories

pip-audit on the committed lock reported 8 known vulnerabilities in 1 package — all pillow 12.3.0, all fixed in 13.0.0:

CVE-2026-112895  CVE-2026-112400  CVE-2026-112397  CVE-2026-112896
CVE-2026-112897  CVE-2026-112395  CVE-2026-112404  CVE-2026-112899

The job is advisory rather than required, but it is red on main and on every PR, which erodes the signal of a green run.

Why both halves were required

security.yml audits the lock (uv export --frozen), so re-locking alone would turn the scanner green while the declared minimum stayed known-vulnerable for anyone resolving from pyproject.toml without the lock — and would let a future uv lock --upgrade (or a Dependabot PR touching another package) re-select 12.3.0. The floor therefore moves too.

Verification

Dependency graph — pillow 12.3.0 → 13.0.0 is the only version change in the entire lock; no package added, none removed, every other resolved version identical. uv pip check: All installed packages are compatible (29 packages).

Advisory — uvx pip-audit -r <new export> → No known vulnerabilities found, exit code 0.

Compatibility — requires-python = ">=3.12"; Pillow 13 requires >=3.11; CI runs Python 3.12. reportlab 5.0.1 requires pillow>=9.0.0 with no upper bound. liteparse 2.14.4 has no dependencies, so it cannot conflict. Resolution succeeded with no constraint backtracking.

Python suite — uv run pytest tests/unit -q → 67 passed, identical to the pre-change baseline I ran first on pillow 12.3.0 (67 passed). All 14 corpus-generator tests pass, including test_render_is_byte_deterministic. ruff check . → All checks passed. mypy packages scripts/ci → Success: no issues found in 11 source files.

Go — go test ./... -count=1 → 41 packages ok, 0 failures against real PostgreSQL (claimops_app, rolsuper=f, rolbypassrls=f, so RLS is genuinely enforced). go test -race -count=1 ./... → clean, no data races. go vet ./..., go build ./... → clean.

The corpus was NOT regenerated — and it does not need to be

git diff -- fixtures/parser_eval/ is empty, and TestVerifyCorpus_RealFixtures passes.

I additionally measured the risk rather than assuming it. A prior audit warned that Pillow 13's HarfBuzz/-O2 text-rasterization change and a textbbox underflow fix could alter the rasterised cases (CASE-039/042/044) and force corpus requalification. I regenerated all 45 cases with the corpus's own seed (29) into a scratch directory under Pillow 13 and compared against the committed manifest:

committed cases : 45
regenerated     : 45
IDENTICAL sha256: 45/45
DIFFERENT       : 0
case_id order identical: True
transforms identical  : True

The committed corpus is byte-reproducible under Pillow 13.0.0. The feared delta does not materialise, so no corpus requalification is triggered and the frozen artefact stays frozen. The scratch output was not committed and the repo fixtures were never touched.

Not run / unavailable

Mockoon contract tests (gate GET /v1/policies/POL-001 returns 404), localgcp GCS/Pub/Sub, the GCW emulator, and the Groq live-LLM matrix are unavailable in this environment and self-skip — they are not passing coverage and are unaffected by this change.

Status

Dependency-only, isolated from PR #179. Not authorized to merge — opened as a draft for review. No branch-protection change, no deployment. Release status NOT QUALIFIED; this clears a supply-chain advisory and nothing else — docs/KNOWN_LIMITATIONS.md is unchanged and no release gate is closed by it.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 585f5265-66b5-4ff2-b5bd-5c3c3dd6275c

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}