[FlorianPfaff]

Summary

Installing from the default, minimal, all-extras, or development requirements still selects vulnerable Pillow 12.3.0 and certifi 2026.5.20. Recent Dependabot merges updated the three extra-specific requirements files, leaving these four files and the Poetry lockfile behind.

Update the remaining pins and lockfile to Pillow 13.0.0 and certifi 2026.10.19. Also update development virtualenv from 21.14.3 to 21.14.12 to address its upstream high-severity advisories, with the required distlib 0.4.4 and packaging 26.3 dependencies. Synchronize those changed dependencies across the requirements files while retaining unrelated versions.

Upstream fixes: Pillow 13.0.0, certifi, virtualenv launcher, and virtualenv activation.

Validation

• poetry check --lock passes.
• Updated pins agree with a Poetry development/all-extras export; all changed locked artifact filenames and SHA-256 hashes match PyPI metadata.
• PYTHONPATH=src PYRECEST_BACKEND=numpy MPLBACKEND=Agg python -m pytest -q tests/test_evaluation_basic.py::TestEvalationBasics::test_plot_results passes on Python 3.14.
• Additional smoke checks pass for a Matplotlib/Pillow PNG round-trip, HTTPS verification with the patched certifi bundle, and virtualenv creation with bundled pip.
• OSV audit of all unique locked/exported package versions found no additional affected packages beyond the old Pillow and certifi pins. Upstream virtualenv advisories were checked separately because OSV has not indexed all of them.

Upstream limitation

Virtualenv 21.14.12 has an unpatched low-severity temporary-cache symlink issue, requiring opt-in symlink seeding and temporary-cache fallback in a shared directory. No matching configuration was found in this repository; the tested default copy-seeding path is unaffected.

[github-actions]

✅MegaLinter analysis: Success

Descriptor	Linter	Files	Fixed	Errors	Max errors	Warnings	Elapsed time
✅ COPYPASTE	jscpd	yes		no		no	6.7s
✅ JSON	prettier	7	0	0		0	0.54s
✅ JSON	v8r	7		0		0	4.04s
✅ MARKDOWN	markdownlint	69	0	0		0	2.12s
✅ MARKDOWN	markdown-table-formatter	69	0	0		0	0.27s
✅ PYTHON	black	2041	0	0		0	53.46s
✅ PYTHON	isort	2041	2	0		0	2.39s
✅ REPOSITORY	betterleaks	yes		no		no	1.66s
✅ REPOSITORY	checkov	yes		no		no	30.05s
✅ REPOSITORY	git_diff	yes		no		no	0.18s
✅ REPOSITORY	secretlint	yes		no		no	5.85s
✅ REPOSITORY	syft	yes		no		no	3.0s
✅ REPOSITORY	trivy-sbom	yes		no		no	2.55s
✅ YAML	prettier	11	0	0		0	0.87s
✅ YAML	v8r	11		0		0	11.48s
✅ YAML	yamllint	11		0		0	0.76s

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: MAKEFILE_CHECKMAKE. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

• Documentation: Custom Flavors
• Command: npx mega-linter-runner@10.1.0 --custom-flavor-setup --custom-flavor-linters PYTHON_BLACK,PYTHON_ISORT,COPYPASTE_JSCPD,JSON_V8R,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY_SBOM,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

Show us your support by starring ⭐ the repository