deps(pip): update pillow-heif requirement from >=1.3.0 to >=1.4.0

[dependabot]

Updates the requirements on pillow-heif to permit the latest version.

Changelog

Sourced from pillow-heif's changelog.

[1.4.0 - 2026-06-10]

Changed

• libheif was updated from the 1.21.2 to 1.23.0 version. #426
• libde265 was updated from the 1.0.16 to 1.1.0 version. #426
• libx265 was updated from the 4.1 to 4.2 version. #426
• Minimum required libheif version is 1.19.0. #416

Removed

• options.ALLOW_INCORRECT_HEADERS option. Starting with libheif 1.22.0, libheif itself rejects images whose decoded size does not match the ispe header. #426

Fixed

• sRGB NCLX color profile (BT.709 primaries) is now written by default during encoding when no color information was provided, to avoid color shifts in viewers. #407

[1.3.0 - 2026-02-27]

Added

• Pixel aspect ratio (pasp) read/write support. #408
• No-GIL (free-threaded Python) support. #405

Fixed

• Integer overflow in encode path buffer validation leading to heap out-of-bounds read. (CVE-2026-28231, GHSA-5gjj-6r7v-ph3x) Thanks to @​kaizawa97 for finding this!

[1.2.1 - 2026-02-18]

Fixed

• macOS: crash when cv2 and pillow_heif both bundle libx265 #403

[1.2.0 - 2026-01-23]

Changed

• libheif was updated from the 1.20.2 to 1.21.2 version. #399
• Dropped Python 3.9 support. #402
• PREFERRED_DECODER must now always be a valid, available decoder ID, or an exception will be raised. (libheif change)

Fixed

• PREFERRED_DECODER is now correctly taken into account when decoding depth and aux images. #399

[1.1.1 - 2025-09-30]

Changed

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)