Repository navigation
chore(deps): bump the uv group across 2 directories with 4 updates - #355
dependabot[bot] wants to merge 1 commit into
Conversation
--- updated-dependencies: - dependency-name: pillow dependency-version: 13.0.0 dependency-type: indirect dependency-group: uv - dependency-name: pillow dependency-version: 13.0.0 dependency-type: direct:production dependency-group: uv - dependency-name: aiohttp dependency-version: 3.14.4 dependency-type: direct:production dependency-group: uv - dependency-name: tornado dependency-version: 6.5.9 dependency-type: direct:production dependency-group: uv - dependency-name: urllib3 dependency-version: 2.8.0 dependency-type: direct:production dependency-group: uv ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
Bot
added
dependencies
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
I reviewed this dependency bump and didn't find any bugs. It includes a major pillow release (12.3.0 to 13.0.0) and the repo's CODEOWNERS covers every path, so a quick look from the owner would still be worthwhile.
What was reviewed:
- Pillow 13 drops Python 3.10. This repo needs 3.11 or newer: chart_data_extractor's
requires-pythonis>=3.11and the template builds frompython:3.13. - chart_data_extractor never imports PIL directly. It only gets pillow through matplotlib, so the API removals in 13.0.0 don't affect its own code.
- The pillow entry in uv.lock is consistent: the version, sdist and wheel URLs are all updated to 13.0.0, with wheels for cp311 through cp315. The other three template pins (aiohttp, tornado, urllib3) are patch or minor bumps.
Extended reasoning...
This Dependabot change edits only template/requirements.txt (four version pins) and chart_data_extractor/uv.lock (the regenerated pillow entry). No source code changes, and it touches no security-sensitive code beyond normal supply-chain risk from new dependency versions. I didn't approve for two reasons. Pillow goes up a major version, and the sandbox image's compatibility with it, through matplotlib and e2b_charts, can only be confirmed by building the template. Also, CODEOWNERS assigns every path in the repo to a single owner.
Bumps the uv group with 1 update in the /chart_data_extractor directory: pillow.
Bumps the uv group with 4 updates in the /template directory: pillow, aiohttp, tornado and urllib3.
Updates
pillowfrom 12.3.0 to 13.0.0Release notes
Sourced from pillow's releases.
... (truncated)
Commits
293218a13.0.0 version bump262e8e4Update release notes for Pillow 13.0.0 (#10223)af56aceValidate TIFF tag values against libtiff's own field definition before TIFFSe...570df03Validate TIFF tag values against libtiff's own field definition before TIFFSe...53318b5Take libtiff scanline geometry tags from the image, not tiffinfo/exif (#10226)0a87417Bound retained TIFF tag data by stream size (#10225)11582e5Fix heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO (#10224)8501adcFix testec5f1cbTake libtiff scanline geometry tags from the image, not tiffinfo/exif4b63dffShare TIFF tag data budget across framesUpdates
pillowfrom 12.3.0 to 13.0.0Release notes
Sourced from pillow's releases.
... (truncated)
Commits
293218a13.0.0 version bump262e8e4Update release notes for Pillow 13.0.0 (#10223)af56aceValidate TIFF tag values against libtiff's own field definition before TIFFSe...570df03Validate TIFF tag values against libtiff's own field definition before TIFFSe...53318b5Take libtiff scanline geometry tags from the image, not tiffinfo/exif (#10226)0a87417Bound retained TIFF tag data by stream size (#10225)11582e5Fix heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO (#10224)8501adcFix testec5f1cbTake libtiff scanline geometry tags from the image, not tiffinfo/exif4b63dffShare TIFF tag data budget across framesUpdates
aiohttpfrom 3.14.3 to 3.14.4Updates
tornadofrom 6.5.8 to 6.5.9Changelog
Sourced from tornado's changelog.
... (truncated)
Commits
75ef8b1Merge pull request #3719 from bdarnell/fixes-6593590cb4test: Hardcode SimpleAsyncHTTPClient in HTTP1xxLimitTestCase9fc5d6dtest: Make tracemalloc optional in httpclient_test555a2eeiostream: Treat connection resets as a clean close in read_until_close3ba622fRelease notes and version bump for 6.5.941eea68test: Fix some test issues only found by our custom tox configab1a778Merge remote-tracking branch 'bdarnell/claude/asynchttpclient-streaming-memor...437ab5fweb: Do not follow symlinks out of the static directory0394513httputil: Apply the argument count limit to query stringsb798f83http1connection: Return after reading the response that follows a 1xxUpdates
urllib3from 2.7.0 to 2.8.0Release notes
Sourced from urllib3's releases.
... (truncated)
Changelog
Sourced from urllib3's changelog.
... (truncated)
Commits
b1d30abRelease 2.8.09016d7eSkiptest_read_chunked_with_trailing_data_does_not_hangfor brotlicffi (#5258)9101f58Fixnox -s docswarning (#5256)cd770b0Merge commit from forkea2ad7bMerge commit from fork0716e31Fix loading unencrypted client keys with a password in pyOpenSSL (#5255)43c68c8Test pickling ofInvalidChunkLength(#5247)308b279Share security policy between GitHub and Read the Docs (#5253)53fa073Add policy on duplicate pull requests (#5252)5f2a6a8Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (#5232)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.