chore(deps-dev): bump pillow from 12.1.1 to 12.2.0#3111
Conversation
Bumps [pillow](https://github.com/python-pillow/Pillow) from 12.1.1 to 12.2.0. - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@12.1.1...12.2.0) --- updated-dependencies: - dependency-name: pillow dependency-version: 12.2.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — routine Dependabot bump of the dev-only pillow dependency from 12.1.1 to 12.2.0 in uv.lock.
What was reviewed
- The diff touches only the
pillowentry inuv.lock; sdist/wheel URLs and hashes all point to pypi.org for 12.2.0. pillowis a dev-group dependency (pillow>=12.0inpyproject.toml), so the constraint is satisfied and no runtime/published dependency changes.- Minor-version upgrade with no other packages re-resolved.
Extended reasoning...
Overview
This is a standard Dependabot PR bumping pillow from 12.1.1 to 12.2.0. The only changed file is uv.lock: the package version, sdist, and wheel entries for pillow are replaced with the 12.2.0 artifacts from the official PyPI registry. No other package entries in the lockfile were modified, and pyproject.toml is untouched.
Security risks
Minimal. Pillow is a development-group dependency (pillow>=12.0 under the dev dependencies in pyproject.toml), not a runtime dependency of the published mcp package, so end users are unaffected. All artifact URLs point to files.pythonhosted.org with pinned SHA-256 hashes, which uv verifies at install time. The 12.2.0 release also includes upstream security-hardening changes (calloc checks, security release notes), so the bump is directionally positive from a security standpoint.
Level of scrutiny
Low. This is a mechanical lockfile-only minor version bump generated by Dependabot, exactly the category of change (dependency bumps) that is safe to approve without human review. The project's own guidance notes not to raise dependency floors for CVEs alone; this PR does not change the floor at all — it only advances the locked version within the existing >=12.0 constraint.
Other factors
The bug hunting system found no issues, and there are no prior reviews or comments on the PR timeline. CI (tests across 3.10–3.14 on Ubuntu/Windows) will exercise the new pillow version in the dev environment, providing a further safety net for any behavioral regressions.
Bumps pillow from 12.1.1 to 12.2.0.
Release notes
Sourced from pillow's releases.
... (truncated)
Commits
3c41c0912.2.0 version bumpcdaa29eCheck calloc return value (#9527)585b2f5Check calloc return valueecf011eCheck all allocs in the Arrow tree (#9488)cf6de8cReject non-numeric elements inside list coords (#9526)ffdcedeUpdate 12.2.0 release notes (#9522)7929d77Added security release notes (#149)c4f7aa5Added security release notes22cdb5fMove variable declaration inside define (#9525)fc15b3bResize tall images vertically first (#9524)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.