fix(ci): update audited dependencies

[BANANASJIM]

What

Update the locked Click and Pillow versions used by development and CI.

Why

The dependency audit reported PYSEC-2026-2132 for Click 8.3.1 and eight
PYSEC-2026-* advisories for Pillow 12.2.0.

How

Regenerate only the affected entries with:

uv lock --upgrade-package click --upgrade-package pillow

This updates Click to 8.4.2 and Pillow to 12.3.0 without changing project dependency
constraints or any other locked package.

Test plan

• CI-equivalent pip-audit: no known vulnerabilities found, one existing Pygments advisory ignored
• pixi run check: 3104 passed, 6 skipped, 93.25% coverage
• Pre-push E2E smoke suite: 26 passed

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ddddb3c0-ba12-4a31-b3fa-5b7e5ed878c3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dependency-audit-click-pillow

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}