Bump the pip group across 1 directory with 2 updates#311
Bump the pip group across 1 directory with 2 updates#311dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the pip group with 2 updates in the /template directory: [pillow](https://github.com/python-pillow/Pillow) and [nltk](https://github.com/nltk/nltk). Updates `pillow` from 12.2.0 to 12.3.0 - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@12.2.0...12.3.0) Updates `nltk` from 3.9.4 to 3.10.0 - [Release notes](https://github.com/nltk/nltk/releases) - [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog) - [Commits](nltk/nltk@3.9.4...v3.10.0) --- updated-dependencies: - dependency-name: pillow dependency-version: 12.3.0 dependency-type: direct:production dependency-group: pip - dependency-name: nltk dependency-version: 3.10.0 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
the
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — straightforward dependency version bump.
Extended reasoning...
Overview
This PR bumps two Python dependencies in template/requirements.txt: pillow (12.2.0 → 12.3.0) and nltk (3.9.4 → 3.10.0). It is a single-file, two-line diff with no code logic changes.
Security risks
Pillow's 12.3.0 release notes are documentation/testing/dependency-update focused, not driven by a CVE in this bump specifically (prior CVEs were already addressed in earlier 12.x releases). No new attack surface is introduced by a version bump alone, and this file only affects the sandbox execution template environment, not production auth/data-handling code.
Level of scrutiny
This is a template dependency manifest used to build the code-interpreter sandbox image — appropriate scrutiny is low: confirm the version bump is legitimate and doesn't break the pinned dependency set, which it does not (no other lines changed, versions are compatible pins).
Other factors
No prior reviews or comments exist on this PR. The change is mechanical, matches the established Dependabot/renovate grouped-bump pattern already used elsewhere in this repo's history, and touches no CODEOWNER-restricted or security-sensitive code path.
Bumps the pip group with 2 updates in the /template directory: pillow and nltk.
Updates
pillowfrom 12.2.0 to 12.3.0Release notes
Sourced from pillow's releases.
... (truncated)
Commits
bb1d8e812.3.0 version bumpe63fc48Add release notes for SBOM and performance improvements (#9747)13b701bAdd release notes for #96795564ca7List methodsa0920fdSpeed up ImageChops operations (#9738)07e9a6cSpeed upImage.filter()(#9736)a94578cSpeed upImage.getchannel(),Image.merge(),Image.putalpha()and `Image...53e02c4Speed upImage.fill(),Image.linear_gradient()and `Image.radial_gradient...af03747Speed upImage.resample()(#9739)5c9ca56Speed upalpha_composite,matrix,negative,quantize(#9740)Updates
nltkfrom 3.9.4 to 3.10.0Release notes
Sourced from nltk's releases.
... (truncated)
Changelog
Sourced from nltk's changelog.
... (truncated)
Commits
bd49f90allow escaped brackets in Tree.fromstring (#3694)27b8ad6don't crash chomsky_normal_form on terminals with siblings (#3693)52227d2Use os.name for Windows path handling (#3605)06c0e2cAvoid RIBES zero division on empty inputs (#3604)a167389Treat missing unzip output as stale (#3607)c94c967Fix EOF empty document bug in IEER corpus reader (#3648)94a259cEnforce restrictive primitive type checking in pathsec wrappers (#3692)5ac475dfix(security): isolate Stanford Java options and clean temp files (#3683)986f26eci(deps): bump the github-actions group with 3 updates (#3691)f26b375fix(security): prevent pickle RCE in TransitionParser model loading (CWE-502)...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.