fix(ci): bump pillow to 12.3.0 to resolve osv-scan CVEs

[yamaceay]

Relevant issues

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment @greptileai to re-request a review after pushing changes)

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

Screenshots / Proof of Fix

osv-scan was failing on every PR with 5 CVEs against pillow 12.2.0 (PYSEC-2026-2253 through PYSEC-2026-2257), all fixed in 12.3.0.

Type

🐛 Bug Fix
🚄 Infrastructure

Changes

Bumped Pillow from 12.2.0 to 12.3.0 in pyproject.toml and ran uv lock --upgrade-package pillow to update uv.lock.

[greptile-apps]

Greptile Summary

This PR bumps Pillow from 12.2.0 to 12.3.0 in the ci extras of pyproject.toml and regenerates uv.lock to address published security advisories that were causing osv-scan failures on every CI run.

• pyproject.toml: single-line version pin change in the ci extras group.
• uv.lock: Pillow wheel hashes replaced with 12.3.0 entries; exclude-newer reset from a fixed timestamp to the epoch (delegating the cutoff to exclude-newer-span = \"P3D\"); several transitive dependency platform markers broadened — all produced automatically by uv lock --upgrade-package pillow.

Confidence Score: 5/5

Safe to merge — the change is a targeted CI-only dependency bump with matching lock file hashes verified against PyPI.

The only substantive change is a one-line version pin in pyproject.toml; Pillow 12.3.0 is the correct patched version confirmed by upstream release notes. The broader uv.lock churn (marker simplifications, exclude-newer reset) is auto-generated by uv and carries no runtime risk since package versions and hashes are still fully pinned. The sole observation is the exclude-newer policy shift, which may affect future re-resolution determinism but does not affect the current locked state.

No files require special attention; the lock file exclude-newer change is worth a quick confirmation that the team intentionally moved from a fixed timestamp to a rolling 3-day exclusion window.

Important Files Changed

Filename	Overview
pyproject.toml	Pillow version pin in the ci extras bumped from 12.2.0 to 12.3.0; no other changes.
uv.lock	Pillow wheel hashes updated to 12.3.0; exclude-newer reset to epoch (relying on exclude-newer-span = "P3D") and several package dependency markers broadened — all auto-generated by uv.

_{Reviews (1): Last reviewed commit: "fix(ci): bump pillow to 12.3.0 to resolv..." | Re-trigger Greptile}

[greptile-apps]

exclude-newer changed from a pinned timestamp to the epoch

The original value "2026-07-08T23:20:11.959202Z" pinned resolution to packages published before that date, giving deterministic re-resolution. The new value "0001-01-01T00:00:00Z" effectively disables the absolute cutoff and relies entirely on exclude-newer-span = "P3D" (packages released within the last 3 days). If anyone re-runs uv lock in the future, the effective cutoff will shift with the current date rather than staying fixed, which can pull in packages that weren't available when the lock file was originally generated. Intentional if the team has moved to rolling 3-day exclusions, but worth confirming this is the desired policy change rather than an artifact of the upgrade command.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[codspeed-hq]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing yamaceay:litellm_fix_ci_e2e_dev_pillow (87db659) with litellm_internal_staging (c2141b1)}