chore(deps): bump Pillow (security)

[zmobariz]

What changed

• requirements.txt: Pillow==12.2.0 → Pillow==12.3.0
• requirements-dev.txt: no edit needed — it only contains -r requirements.txt plus pyinstaller/reportlab, so it inherits the bump. Dependabot flags it as a second manifest, but both sets of alerts resolve from this one pin change.

No lockfile in this repo (plain pip requirements only).

Alerts cleared (26 open = 13 advisories × 2 manifests)

All fixed in Pillow 12.3.0:

Severity	Advisories
High	CVE-2026-59205 (GHSA-9hw9-ch79-4vh6), CVE-2026-59204 (GHSA-vjc4-5qp5-m44j), CVE-2026-59200 (GHSA-jjj6-mw9f-p565), CVE-2026-59199 (GHSA-6r8x-57c9-28j4), CVE-2026-59197 (GHSA-xj96-63gp-2gmr), CVE-2026-55380 (GHSA-phj9-mv4w-65pm), CVE-2026-55379 (GHSA-45hq-cxwh-f6vc), CVE-2026-54060 (GHSA-5x94-69rx-g8h2), CVE-2026-54059 (GHSA-8v84-f9pq-wr9x), CVE-2026-54058 (GHSA-62p4-gmf7-7g93)
Medium	CVE-2026-59203 (GHSA-pg7v-jwj7-p798), CVE-2026-59198 (GHSA-fj7v-r99m-22gq), CVE-2026-55798 (GHSA-4x4j-2g7c-83w6)

All vulnerable ranges are < 12.3.0 (some with lower bounds); first_patched_version is 12.3.0 for every advisory, and 12.3.0 is the current latest release on PyPI.

Compatibility

Patch-level bump within the same major (12.2.0 → 12.3.0) — no breaking API changes. Code audit: the only PIL usage is from PIL import Image, ImageTk and ImageTk.PhotoImage(file=...) in app.py; no removed constants (Image.ANTIALIAS etc.) anywhere. pip install --dry-run -r requirements.txt resolves cleanly on Python 3.11.

Note: Dependabot's own PR #1 (branch dependabot/pip/pillow-12.3.0) proposes the same bump; merging this PR supersedes it and it can be closed.

https://claude.ai/code/session_01L9MDAmC4eHwaetZXKzmg7n