[dependabot]

Bumps the security group with 1 update in the / directory: pillow.

Updates pillow from 12.3.0 to 13.0.0

Release notes

Sourced from pillow's releases.

13.0.0

https://pillow.readthedocs.io/en/stable/releasenotes/13.0.0.html

Removals

• Remove undocumented GifImagePlugin._save_netpbm #9901 [@​akx]
• Remove ExifTags.IFD.Makernote #9850 [@​radarhere]
• Drop support for Python 3.10 #9750 [@​hugovk]
• Remove deprecations for Pillow 13.0.0 #9751 [@​radarhere]

Deprecations

• Deprecate IM image format #9849 [@​radarhere]
• Deprecate ImageQt align8to32() in favour of raw encoder stride #9940 [@​akx]
• Deprecate JpegImageFile.load_djpeg #9924 [@​akx]

Documentation

• Update release notes for Pillow 13.0.0 #10223 [@​hugovk]
• Correct the ImageOps.fit centering corner documentation #10118 [@​FanWu-ai]
• Update Tidelift links #10102 [@​radarhere]
• Correct bullet point syntax in release notes #10069 [@​radarhere]
• Update ImageDraw signatures in docs #10065 [@​ZainnQureshii]
• Update macOS tested Pillow versions #10048 [@​hugovk]
• Add pillow-wmf and pillow-zx-spectrum to third-party plugins list #10037 [@​bitplane]
• Delete CLAUDE.md #10027 [@​hugovk]
• Add pillow-lunasvg to third-party plugins list #10016 [@​Maksim-Burtsev]
• Extend security policy #10018 [@​hugovk]
• Update Color3DLUT description #10004 [@​radarhere]
• Document the internal image distinctness constraints #9752 [@​akx]
• Update macOS tested Pillow versions #10000 [@​radarhere]
• Link security policy in project metadata #9980 [@​hugovk]
• Image.new(): correct docstring and comment about uninitialized memory #9960 [@​akx]
• Add AGENTS.md #9582 [@​aclark4life]
• Add release notes for #8811 #9937 [@​radarhere]
• Fixed typo #9923 [@​radarhere]
• Fixed typo #9922 [@​radarhere]
• C interface is internal #9879 [@​radarhere]
• Correct function references #9895 [@​radarhere]
• Revert move from python-pillow.org to python-pillow.github.io #9830 [@​aclark4life]
• Add additional CVE numbers to 12.3.0 release notes #9777 [@​radarhere]
• Remove remaining :rtype:s from docstrings #9742 [@​akx]
• Update macOS tested Pillow versions #9759 [@​radarhere]

Dependencies

• Update dependency cibuildwheel to v4.3.1 #10175 [@renovate[bot]]
• Update dependency cibuildwheel to v4.3.0 #10132 [@renovate[bot]]
• Update dependency harfbuzz to v14.5.0 #10108 [@renovate[bot]]
• Update github-actions #10111 [@renovate[bot]]

... (truncated)

Commits

• 293218a 13.0.0 version bump
• 262e8e4 Update release notes for Pillow 13.0.0 (#10223)
• af56ace Validate TIFF tag values against libtiff's own field definition before TIFFSe...
• 570df03 Validate TIFF tag values against libtiff's own field definition before TIFFSe...
• 53318b5 Take libtiff scanline geometry tags from the image, not tiffinfo/exif (#10226)
• 0a87417 Bound retained TIFF tag data by stream size (#10225)
• 11582e5 Fix heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO (#10224)
• 8501adc Fix test
• ec5f1cb Take libtiff scanline geometry tags from the image, not tiffinfo/exif
• 4b63dff Share TIFF tag data budget across frames
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

Welcome! 👋 Thanks for your first pull request in this repository.

A maintainer will review it soon. Please make sure:

• Your changes are tested
• Documentation is updated if needed
• The PR description explains what and why

Thanks for contributing!

[lukisch]

CI-Diagnose (Zweitmodell): Rot sind test (3.11), test (3.12), linux-platform-smoke und macos-platform-smoke. Im macOS-Log (Job 120600181965) gibt es genau einen Fehlschlag (1 failed, 259 passed):

tests/test_security_license_contract.py::test_dependency_lockfile_and_upper_bounds_parity → requirements.txt must specify Pillow upper bound (der Test erwartet hart <13.0.0, die Datei enthält nach dem Bump Pillow>=12.3.0,<14.0.0).

Ursache ist also der veraltete Vertragstest, nicht Pillow 13.0.0 selbst. Der Fix liegt in #12 (eine Zeile im Test, Ziel ist dieser Dependabot-Branch). Reihenfolge: zuerst #12 in diesen Branch mergen, danach läuft die CI hier neu. Ich habe am Dependabot-Branch nichts geändert.

---

Generated by Claude Code

[lukisch]

Triage (Cloud-Bot): Der Dependabot-Bump pillow 12.3.0 → 13.0.0 ist rot, und zwar test (3.11), test (3.12), linux-platform-smoke und macos-platform-smoke. lint ist grün. Der Fix liegt als #12 vor (Pillow-Obergrenze im Contract-Test auf <14.0.0). #12 hat den Branch dieses PRs als Base, daher läuft dort keine CI.

Empfehlung: #12 in diesen Branch mergen, dann die CI hier neu laufen lassen. Erst danach freigeben.

---

Generated by Claude Code

[lukisch]

Diagnose: test_dependency_lockfile_and_upper_bounds_parity schlägt fehl, weil der Test noch <13.0.0 für Pillow erwartet, requirements.txt auf diesem Branch aber Pillow>=12.3.0,<14.0.0 enthält. Der Fix ist #12 (Test auf <14.0.0, 1 Zeile, mergeable clean). Empfehlung: #12 mergen, dann hier CI neu starten.

---

Generated by Claude Code

[lukisch]

Triage (cloud bot): Rote Checks (test 3.11/3.12, platform-smoke) = test_security_license_contract.py erwartet Pillow <13.0.0, requirements erlaubt aber <14.0.0. #12 gleicht den Test an (CI grün). Reihenfolge: #12 mergen, dann #11 rebasen/neu laufen lassen. Pillow-13-Bump selbst ist unauffällig.

---

Generated by Claude Code

[lukisch]

CI-Hinweis: Der Pillow-13-Bump scheitert am Vertragstest für die Obergrenze <14.0.0. #12 passt diesen Test an und ist grün (clean). Empfehlung: zuerst #12 mergen, dann diesen Branch aktualisieren. Danach sollten test (3.11/3.12) und die Platform-Smokes erneut laufen.

---

Generated by Claude Code

[lukisch]

Diagnose (Zweitmodell): Alle 4 roten Jobs scheitern an genau einem Test: tests/test_security_license_contract.py::test_dependency_lockfile_and_upper_bounds_parity. Der Vertrag erwartet die alte Pillow-Obergrenze; die Pillow-13-Anhebung verletzt sie. Der Fix liegt bereits in #12 (Obergrenze <14.0.0). Empfehlung: #12 zuerst mergen (oder in diesen Branch übernehmen), dann CI auf #11 neu laufen lassen.

---

Generated by Claude Code