[JE-Chen]

Clears the open Dependabot security alerts (/security/dependabot) that a dependency update can fix today.

Changes

• What: cleared the Dependabot security alerts that an update can fix
  today.
  • pyproject.toml, dev.toml: pillow==12.3.0 becomes
    pillow==12.3.0; python_version < '3.11' and
    pillow==13.0.0; python_version >= '3.11' (41 advisories, critical
    among them GHSA-v9pv-5gc8-w2m6 and GHSA-5x8w-8jj5-q52h). Pillow 13 needs
    Python ≥3.11, so 3.10 keeps the newest release it can install. The pdf
    extra's security floor moves from pypdf>=6.16.1 to pypdf>=6.21.4, the
    first release without the 6.20–6.21 advisories.
  • uv.lock: pillow 13.0.0 on 3.11+, pypdf 6.19.0 → 6.21.4, and
    dnspython 2.8.0 → 2.9.0 on 3.11+ (it needs 3.11 too). The dnspython
    floor is a [tool.uv] constraint-dependencies entry in pyproject.toml;
    it changes only the lock.
  • .github/requirements/publish.txt: setuptools 84.0.0 → 84.2.1,
    certifi 2026.7.22 → 2026.10.23; publish.in records the cut-off
    --exclude-newer 2026-10-25, still a 7-day wait.
  • Third_Party_License.md names the Pillow versions now pinned.
• How: each lock regenerated with its recorded command plus -P for the
  patched packages only; every other pin is kept. pypdf 6.21.4
  (2026-10-28) is the first fixed release and is newer than the cut-off.
• Not changed: autocontrol-lsp/vscode/package-lock.json keeps
  minimatch 5.1.9 (GHSA-g3hv-75wg-m249, fixed only in 11.0.1). It comes from
  vscode-languageclient, and every release through 11.0.0 calls
  Minimatch#makeRe(), which minimatch 11 removed.
• Test: test_arm64_dependency_markers.py read exactly one Pillow line
  and failed on the split. It now reads every line of a package and checks
  that none names the platform (sys_platform, platform_machine,
  platform_system, os_name); a Python-version marker passes. A new case
  checks that pattern, and putting the arm64 marker on Pillow still fails it.
• Evidence: the full headless suite (python -m pytest, as in
  dev.yml) in a Python 3.12 environment with Pillow 13.0.0, pypdf 6.21.4
  and dnspython 2.9.0: 16711 passed, 191 skipped, and the one failure was
  that test, fixed here (its file, the dev.toml parity and publish lock tests:
  32 passed).
• Downstream: TestPioneer and WebRunner lock Pillow through
  je_auto_control; they move to 13.0.0 once a release carries this pin.
• Open items: Progress.md, "minimatch 11 在 VS Code 擴充套件".

Commits

• 7a7953e fix(deps): patch the dependencies named in Dependabot security alerts

Update log: docs/updates U-20261101-17.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 4 complexity · 0 duplication

Metric	Results
Complexity	4
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud