[jfrench9]

Summary

Moves Pillow to 13.0.0, which resolves the open Pillow Dependabot alerts.

Dependabot's own update fails to resolve: fastembed (through 0.9.0, the latest release) caps pillow<13.0. We use only fastembed's TextEmbedding, which does not touch PIL, so a [tool.uv] override-dependencies lifts the cap. The direct floor rises to pillow>=13.0.0 with it. Pillow reaches us only through fastembed and arelle; nothing in the codebase imports PIL directly.

Remove the override once a fastembed release lifts the cap (qdrant/fastembed#830 is open for it).

Changes

• pyproject.toml: pillow>=13.0.0; override-dependencies = ["pillow>=13.0.0"] under [tool.uv]
• uv.lock: pillow 12.3.0 → 13.0.0 (no other package moves)

Testing

• just test-code clean (ruff, format, basedpyright)
• search, arelle, SEC adapter, serialization, and memory tests: 1494 passed, 9 skipped
• Smoke test on Python 3.14 with Pillow 13.0.0: fastembed 0.9.0 TextEmbedding("BAAI/bge-small-en-v1.5") embeds (384-dim); arelle 2.44.7 imports

🤖 Generated with Claude Code

[github-actions]

Change classification: standard — only dependency manifests, lockfiles, documentation, release notes or generated output changed.

Under the change standard a standard change is gated by the required test check alone; no secondary review is required. Recorded by the change-classification job.