chore(deps): bump pillow, certifi, virtualenv and aiohttp for Dependabot alerts
All Submissions:
- Have you followed the guidelines stated in CONTRIBUTING.md file?
- Have you checked to ensure there aren't any other open Pull Requests for the desired changed?
Type of change
- Bug fix (non-breaking change which fixes an issue) — lockfile security bumps only
Changes To Core Features:
- Have you added an explanation of what your changes do and why you'd like us to include them?
- Have you successfully ran tests with your changes locally?
Description
Moves the locked versions to patched releases for the open Dependabot alerts:
| Package | Before → after | Advisories |
|---|---|---|
| pillow (dev) | 12.3.0 → 13.0.0 | GHSA-8g5g-8vmr-9782 (critical), GHSA-c6hw-5grf-ff96, GHSA-pchr-8j38-3x4p, GHSA-58r4-6rv3-gfh8, GHSA-q45j-58j2-45rg, GHSA-p4wg-p73j-c528, GHSA-65qm-jvmh-6pqg |
| certifi | 2026.7.22 → 2026.10.19 | GHSA-6q48-6c7w-9gw2 (critical) — also in .github/legacy/reflex-0.8.23/uv.lock |
| virtualenv | 21.12.1 → 21.14.7 | GHSA-c947-3pg5-gm8q, GHSA-vxj4-q4g9-crj7, GHSA-5vjq-rrrf-7h2q, GHSA-8rjx-v5ww-45pp |
| aiohttp | 3.14.3 → 3.14.5 (yarl 1.24.5 → 1.25.1) | GHSA-9xw5-w5jj-pvcg |
Release-age exception: pillow 13.0.0 and certifi 2026.10.19 were published inside the 7-day exclude-newer window, so pyproject.toml gets a dated per-package override (2026-10-21T00:00:00Z) for just those two. Remove it once the window passes them (after 2026-10-28); until then those two can't move past that date.
Lock noise: the re-resolution also flips some dependency markers (e.g. psycopg-binary's < 3.15 limit, h11/truststore emscripten markers). These have toggled back and forth in earlier lock bumps (#7424, #7557) and are resolver output, not intentional changes.
Lockfile / tool config only — nothing shipped to users changes, so no news fragment (skip-changelog).
Testing
uv lock --checkpasses; pre-commit clean on changed files.uv run pytest tests/units: 13,093 passed.tests/units/reflex_bench/drivers/test_browser.pycouldn't run locally (the container's Chromium build doesn't match Playwright's expected version) — unrelated.- Pillow-dependent unit tests (
test_image.py,test_serializers.py) pass on Pillow 13; integration media tests left to CI.
https://claude.ai/code/session_01TRVPx1QAeZzhs5QjH48SRj
Generated by Claude Code