chore(deps-dev): bump pillow from 12.1.1 to 12.3.0#3140
Conversation
Bumps [pillow](https://github.com/python-pillow/Pillow) from 12.1.1 to 12.3.0. - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@12.1.1...12.3.0) --- updated-dependencies: - dependency-name: pillow dependency-version: 12.3.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — routine Dependabot bump of the dev-only pillow dependency (12.1.1 → 12.3.0) touching only uv.lock.
What was reviewed:
- Confirmed pillow lives in the dev dependency group (
pillow>=12.0in pyproject.toml), so this doesn't affect the published package's runtime dependencies. - Verified the lockfile change only swaps the pillow 12.1.1 sdist/wheel entries for 12.3.0, with all URLs and hashes pointing to pypi.org.
- Checked the 12.3.0 release notes: the only removal (non-image ImageCms modes) doesn't affect this SDK's test-only use of pillow.
Extended reasoning...
Overview
This PR is a Dependabot-generated bump of pillow from 12.1.1 to 12.3.0, changing only uv.lock. The lockfile diff replaces the pillow package entry (version, sdist, and wheels) — no other packages or resolution changes are included.
Security risks
Minimal. Pillow is a dev-group dependency (pillow>=12.0 in [dependency-groups].dev), so it is not shipped with the published mcp wheel and only affects local development and CI. All new artifact URLs point to files.pythonhosted.org with pinned sha256 hashes, which is the expected shape for a uv lockfile update. Pillow 12.3.0 is a newer upstream release that includes security-related fixes, so moving forward is if anything a net positive for the dev environment.
Level of scrutiny
Low. This is a mechanical lockfile-only dev-dependency bump following the repo's established Dependabot pattern (the same kind of change as the recent pillow bump already merged on main). The version constraint in pyproject.toml is unchanged and 12.3.0 satisfies >=12.0. The only API removal in 12.3.0 (non-image ImageCms modes) is irrelevant to the SDK's test usage of pillow. Per repo guidelines, dependency floors are not being raised — only the locked version moves.
Other factors
The bug hunting system found no issues, and the PR timeline has no outstanding reviewer comments. CI (tests across 3.10–3.14 with the locked resolution) will exercise the new pillow version directly, providing a concrete safety net if anything in the tests were incompatible.
Bumps pillow from 12.1.1 to 12.3.0.
Release notes
Sourced from pillow's releases.
... (truncated)
Commits
bb1d8e812.3.0 version bumpe63fc48Add release notes for SBOM and performance improvements (#9747)13b701bAdd release notes for #96795564ca7List methodsa0920fdSpeed up ImageChops operations (#9738)07e9a6cSpeed upImage.filter()(#9736)a94578cSpeed upImage.getchannel(),Image.merge(),Image.putalpha()and `Image...53e02c4Speed upImage.fill(),Image.linear_gradient()and `Image.radial_gradient...af03747Speed upImage.resample()(#9739)5c9ca56Speed upalpha_composite,matrix,negative,quantize(#9740)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.