Repository navigation
build(deps-dev): Bump pillow from 12.3.0 to 13.0.0 in /servers/engine - #1820
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [pillow](https://github.com/python-pillow/Pillow) from 12.3.0 to 13.0.0. - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@12.3.0...13.0.0) --- updated-dependencies: - dependency-name: pillow dependency-version: 13.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![evaos-code-review-bot[bot]](https://avatars.githubusercontent.com/in/4184532?s=60&v=4){kind=small}
There was a problem hiding this comment.
Walkthrough
PR: #1820 - build(deps-dev): Bump pillow from 12.3.0 to 13.0.0 in /servers/engine
Head: 4d8f0d0d2ed845b8a6c2b2af2d5238dc3c47c92f into main. Review event: COMMENT.
Estimated review effort: 1/5 (~10 min)
Changed Files
| File | Status | Churn | Purpose | Risk |
|---|
Review Signal
No validated inline findings.
Dropped findings before posting: 0. High-severity findings: 0.
Maintainer Analysis
Changed behavior:
- Updates locked Pillow from 12.3.0 to 13.0.0 and lockfile revision from 3 to 5; only servers/engine/uv.lock changes.
Affected invariants:
- Pillow remains a development dependency; declared Python support remains >=3.11,<3.13.
Evidence:
- Reviewed the complete base-to-head diff.
- Inspected servers/engine/pyproject.toml, .github/workflows/ci.yml, and relevant QA image-processing callers and test source.
Limitations:
- No tests, builds, dependency installation, or Unity smoke checks were run.
- Package contents, artifact hashes, upstream API changes, and live CI results were not independently verified.
No-finding rationale: No concrete regression was substantiated from the lockfile diff and inspected repository source. A major-version bump alone does not establish a defect.
Risk Taxonomy
No finding categories.
Validation and Proof
1 required validation/proof recommendation(s) selected from changed files.
- required: Unity editor or Play Mode smoke - WorldOS repo profile implies Unity runtime risk. Proof: Unity editor smoke; Play Mode log; scene/prefab screenshot or recording.
Proof status: missing - 1 required validation/proof recommendation(s) missing from PR metadata.
Related Context
Related issues/PRs: #9901, #9850, #9750, #9751, #9849, #9940, #9924, #10223.
Pre-merge checklist
- Inline comments target current RIGHT-side diff lines.
- No secret-like content survived into posted inline comments.
- REQUEST_CHANGES is only used when eligible P0/P1 findings survive validation.
- Required behavior proof is present or not applicable.
Reviewed by NeonDiff · gpt-6.1-sol
Bumps pillow from 12.3.0 to 13.0.0.
Release notes
Sourced from pillow's releases.
... (truncated)
Commits
293218a13.0.0 version bump262e8e4Update release notes for Pillow 13.0.0 (#10223)af56aceValidate TIFF tag values against libtiff's own field definition before TIFFSe...570df03Validate TIFF tag values against libtiff's own field definition before TIFFSe...53318b5Take libtiff scanline geometry tags from the image, not tiffinfo/exif (#10226)0a87417Bound retained TIFF tag data by stream size (#10225)11582e5Fix heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO (#10224)8501adcFix testec5f1cbTake libtiff scanline geometry tags from the image, not tiffinfo/exif4b63dffShare TIFF tag data budget across framesDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)