LCORE-3161: bump Pillow 12.1.1 → 12.3.0 (CVE-2026-59205)

[platex-rehor-bot]

Description

Bumps Pillow from 12.1.1 to 12.3.0 to fix CVE-2026-59205 — controlled native heap corruption in ImageCms.ImageCmsTransform.apply when the output image mode does not match the transform's declared output mode.

Changes:

• Added explicit Pillow>=12.3.0 constraint in pyproject.toml (transitive dep from llama-stack/sentence-transformers)
• Updated uv.lock with Pillow 12.3.0 PyPI wheel hashes (cp312 + cp313)
• Updated .konflux/requirements.hashes.wheel.txt with Pillow 12.3.0 RHOAI 3.5 wheel hashes (x86_64 + aarch64)

Type of change

• CVE fix
• Bump-up dependent library

Tools used to create PR

• Generated by: Claude Code (Claude Opus 4.6)

Related Tickets & Documents

• Closes LCORE-3161
• Related: LCORE-3160 (same CVE fix in rag-content)

Checklist before requesting a review

• I have performed a self-review of my code.
• PR has passed all pre-merge test jobs.
• If it is a core feature, I have added thorough tests.

Testing

• Dependency-only change (no code changes). Verified that:
  • pyproject.toml constraint is syntactically correct
  • uv.lock hashes match PyPI JSON API for Pillow 12.3.0
  • .konflux/requirements.hashes.wheel.txt hashes match RHOAI 3.5 index for Pillow 12.3.0
  • CI will validate the full dependency resolution

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 453a6175-765b-4d4b-9bc9-5adf2cce5fb8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

✨ Simplify code

• Create PR with simplified code

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[tisnik]

/ok-to-test

[platex-rehor-bot]

Rebased on top of the latest release/0.5 (picked up Konflux references update and cherry picker config changes). All GitHub Actions CI is re-running. Konflux build needs /ok-to-test to re-trigger.

[platex-rehor-bot]

/ok-to-test