[BBYU26]

This week's security advisories, in one place. The required dependencies check has been red on main and on every open PR since 17-10. This PR clears all of it. 3.148.7-alpha, based on main. The calendar stack (#959 and up) will be rebased on top of it, and #959 drops its own copy of the certificate fix.

What it fixes

• Pillow 12.3.0 → 13.0.0 (the image library the document helper uses for photos).
  • pip-audit reports CVE-2026-112395, -112397, -112400, -112404, -112895, -112896, -112897 and -112899.
  • GitHub lists about 40 more advisories, published from 17-10. Two are critical, among them heap overflows in the FlashPix and JPEG decoders.
  • Every one is fixed only in 13.0.0. There is no 12.x after 12.3.0.
• certifi → 2026.10.19 (PYSEC-2026-4320 / GHSA-6q48-6c7w-9gw2), plus rustls-webpki 0.103.16 and webpki-roots / webpki-root-certs 1.0.10 (RUSTSEC-2026-0381/0382/0383). These remove trust in a certificate authority whose signing keys were compromised. Nothing else moves in Cargo.lock.

Two decisions for you

1. fastembed's cap is overridden. fastembed 0.9.0, the latest release, still declares pillow<13 on every Python, although its code runs on 13. The upstream fix, chore(deps): allow pillow 13 qdrant/fastembed#830, is open and unmerged. So:
   • Pillow 13 is pinned through a new sidecar/requirements-override.txt, passed to uv pip compile --override for the base lock and stamped in its header. just requirements-lock checks the stamp.
   • pip's own resolver refuses a lock resolved past the cap, so every lock install now adds --no-deps beside --require-hashes. That covers the base and optional-component installs, pr.yml's locked-deps step and release.yml's python-smoke. Every line is still pinned and hash-checked, and the lock is complete because uv resolved it.
   • just pip-audit audits the hashed locks with --disable-pip instead of installing them. On the old locks it still reports all eight Pillow advisories.
   • Remove the override once a fastembed release allows Pillow 13.
2. Python 3.11 is the new minimum (3.10 reaches end of life this month). Pillow 13 needs it.
   • Windows and Linux bundle Python 3.12.
   • On a Mac, PM uses your Python when it is new enough, and otherwise downloads its own 3.12.
   • So the change reaches only a venv an older PM built on 3.10, which is rebuilt once on the next launch, and source builds on a machine with nothing newer than 3.10.
   • The setup messages now take the version from MIN_PYTHON. The locks lose the 13 package versions that existed only for Python below 3.11.

The alternative to both was to ignore the advisories until fastembed releases. I didn't take it: the JPEG and TIFF decoder bugs are reachable from any photo you drop in.

Hardening, whatever the Pillow version

• A photo is opened only as a photo format (JPEG, PNG, WebP, and HEIC once the OCR component's pi-heif is there), the one its extension names tried first.
  • A TIFF, FlashPix, EPS or any other format renamed .jpg no longer reaches its decoder.
  • A real photo with the wrong ending still reads, such as a PNG saved as .jpg or a JPEG saved as .heic.
• Text recognition only ever gets pixels PM decoded itself. The fallback that handed rapidocr the raw path, which it opens unrestricted, is gone.
• A damaged or half-downloaded photo is now blamed on the file, not on text recognition. Its row says so, and the date and place from its header are kept.

Reviews

• A researcher and a builder each established, independently, that this couldn't be a plain bump: fastembed's cap and Pillow's Python floor block it. A third agent checked both claims against PyPI.
• Review 1 (two lenses):
  • the install and lock path was clean;
  • the hardening kept one medium (a PNG saved as .jpg was refused) and two lows (a cut-off photo blamed on text recognition; What's New said every installer bundles Python).
• Review 2 kept two lows: a JPEG saved as .heic without pi-heif was refused, and the photo note overstated what was lost. Both are fixed. The HEIC fix was mutation-checked.
• Every lock change was compared with PyPI's hashes, and every licence was re-entered by hand after reading the wheel:
  • Pillow: MIT-CMU plus permissive bundled natives, byte-identical to 12.3.0's on Linux and macOS;
  • certifi: MPL-2.0, unchanged.

Checks

The full just check passes end to end, deny and pip-audit included. Fresh Python 3.11, 3.12 and 3.14 venvs install the base lock with the app's flags plus --no-deps and pass the sidecar tests with fastembed required. In those venvs fastembed embeds with the default model, and markitdown converts a PNG and a PDF. The OCR lock installs on top, and with pi-heif installed a real HEIC opens.

Live test for you

On the next launch of a dev or release build, PM should rebuild its document helper's environment once, because the locks changed. Then:

• drop a JPEG, a PNG, an iPhone HEIC (with photo text recognition on) and a PDF;
• check that each reads as before;
• check that a TIFF renamed .jpg shows "PM could not read this image…".

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.