Harden Pillow dependency floor to patched range for active image parsing CVEs

[Copilot]

Multiple open advisories targeted the project’s Pillow version window, including PSD out-of-bounds writes and FITS GZIP decompression bomb risks. The backend dependency spec allowed vulnerable versions (>=10.4,<12.0) in pyproject.toml.

• Dependency constraint hardening

  • Raised Pillow in pyproject.toml from >=10.4,<12.0 to >=12.2,<13.0, moving resolution to a range that excludes the reported vulnerable versions.

• Dependency source alignment

  • Kept project dependency declarations consistent with the already-patched requirements.txt constraint (Pillow>=12.2,<13.0) to avoid split-resolution behavior across install paths.

# pyproject.toml
dependencies = [
  # ...
  "Pillow>=12.2,<13.0",
  # ...
]

[parkcheolhong]

수정 감사합니다

[Copilot]

Pull request overview

Hardens the backend’s Pillow dependency floor to a patched range to mitigate active image parsing CVEs and prevent divergent dependency resolution between installation methods.

Changes:

• Raised Pillow constraint in pyproject.toml from >=10.4,<12.0 to >=12.2,<13.0.
• Aligned pyproject.toml dependency range with the existing requirements.txt Pillow pin to avoid split-resolution.