fix(deps): bump Pillow 12.2.0 -> 12.3.0 to clear OSV-Scan CVEs

[devin-ai-integration]

Relevant issues

Fixes #33091

Linear ticket

Pre-Submission checklist

• I have added meaningful tests
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment @greptileai to re-request a review after pushing changes)

Screenshots / Proof of Fix

The ci dependency group pinned Pillow==12.2.0, which OSV flags for 5 advisories (4 High, 1 Medium) fixed in 12.3.0, so osv-scan failed on every PR. The fork PR #33089 that tried to fix it was blocked by guard-fork-dependencies because it modified uv.lock; that change has to come from a branch in the canonical repo, which is what this PR does

Both runs use the exact scanner and invocation from .github/workflows/osv-scan.yml (osv-scanner v2.3.8, --config osv-scanner.toml -L uv.lock)

Before, on the base uv.lock (pillow 12.2.0):

$ osv-scanner scan source --config osv-scanner.toml -L uv.lock
Total 1 package affected by 5 known vulnerabilities (0 Critical, 4 High, 1 Medium, 0 Low, 0 Unknown) from 1 ecosystem.
5 vulnerabilities can be fixed.
| https://osv.dev/PYSEC-2026-2253 | 7.5 | PyPI | pillow | 12.2.0 | 12.3.0 | uv.lock |
| https://osv.dev/PYSEC-2026-2254 | 7.5 | PyPI | pillow | 12.2.0 | 12.3.0 | uv.lock |
| https://osv.dev/PYSEC-2026-2255 | 7.5 | PyPI | pillow | 12.2.0 | 12.3.0 | uv.lock |
| https://osv.dev/PYSEC-2026-2256 | 7.5 | PyPI | pillow | 12.2.0 | 12.3.0 | uv.lock |
| https://osv.dev/PYSEC-2026-2257 | 4.5 | PyPI | pillow | 12.2.0 | 12.3.0 | uv.lock |
$ echo $?
1

After, on this branch's uv.lock (pillow 12.3.0, commit 8c791bb):

$ osv-scanner scan source --config osv-scanner.toml -L uv.lock
Scanned .../uv.lock file and found 417 packages
No issues found
$ echo $?
0

Type

🐛 Bug Fix
🚄 Infrastructure

Changes

Bumped Pillow from 12.2.0 to 12.3.0 in the ci dependency group of pyproject.toml and regenerated uv.lock with uv lock --upgrade-package pillow. The lock diff is pillow-only; running with the CI-pinned uv (0.10.9) keeps every other package untouched, and uv lock --check passes so the test-linting / test-mcp lock checks stay green

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

Link to Devin session: https://app.devin.ai/sessions/2f4ec55a1f594bb3a8881944db1fab36

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[greptile-apps]

Greptile Summary

This PR bumps Pillow from 12.2.0 to 12.3.0 in the ci dependency group of pyproject.toml and regenerates uv.lock accordingly, clearing security advisories that were causing osv-scan to fail on every PR.

• pyproject.toml: single-line change in the ci extras pin from Pillow==12.2.0 to Pillow==12.3.0.
• uv.lock: all Pillow wheel entries (sdist + platform wheels) replaced with 12.3.0 hashes; exclude-newer timestamp advances by ~2 days to the lock-regeneration time. No other packages are touched.

Confidence Score: 5/5

Safe to merge — the change is an isolated CI-dependency-group version bump with no production code or public API changes.

Both changed files are limited to updating the Pillow version from 12.2.0 to 12.3.0 in the CI extras group. The lock file confirms only Pillow wheel entries and the exclude-newer timestamp changed; all other packages are untouched. The fix is correctly scoped and the before/after OSV-scan output in the PR description demonstrates the advisories are cleared.

No files require special attention.

Important Files Changed

Filename	Overview
pyproject.toml	Bumps Pillow pin in the ci dependency group from 12.2.0 to 12.3.0; no other changes.
uv.lock	Regenerated lock file: Pillow entries replaced with 12.3.0 wheels/hashes, and exclude-newer timestamp advanced by ~2 days to match lock-regeneration time; no other packages changed.

_{Reviews (1): Last reviewed commit: "fix(deps): bump Pillow 12.2.0 -> 12.3.0 ..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[devin-ai-integration]

Closing as redundant: #33093 already bumped Pillow 12.2.0 -> 12.3.0 and merged into litellm_internal_staging, which clears the osv-scan CVEs. Thanks @yucheng-berri

[codspeed-hq]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing litellm_bump_pillow_12_3_0_osv (8c791bb) with litellm_internal_staging (e6d916b)}