chore(deps): bump pillow from 11.2.1 to 11.3.0

[dependabot]

Bumps pillow from 11.2.1 to 11.3.0.

Release notes

Sourced from pillow's releases.

11.3.0

https://pillow.readthedocs.io/en/stable/releasenotes/11.3.0.html

Deprecations

• Deprecate fromarray mode argument #9018 [@​radarhere]
• Deprecate saving I mode images as PNG #9023 [@​radarhere]

Documentation

• Added release notes for #9041 #9042 [@​radarhere]
• Add release notes for #8912 and #8969 #9019 [@​radarhere]
• ImageFont does not handle multiline text #9000 [@​radarhere]
• Updated Ubuntu CI targets #8988 [@​radarhere]
• Update MinGW package names #8987 [@​H4M5TER]
• Updated docstring #8943 [@​radarhere]
• Mention that tobytes() with the raw encoder uses Pack.c #8878 [@​radarhere]
• Refactor docs Makefile #8933 [@​hugovk]
• Add template for quarterly release issue #8932 [@​aclark4life]
• Add list of third party plugins #8910 [@​radarhere]
• Update redirected URL #8919 [@​radarhere]
• Docs: use sentence case for headers #8914 [@​hugovk]
• Docs: remove unused Makefile targets #8917 [@​hugovk]
• Remove indentation from lists #8915 [@​radarhere]
• Python 3.13 is tested on Arch #8894 [@​radarhere]
• Move XV Thumbnails to read only section #8893 [@​aclark4life]
• Updated macOS tested Pillow versions #8890 [@​radarhere]

Dependencies

• Add AVIF to wheels using only aomenc and dav1d AVIF codecs for reduced size #8858 [@​fdintino]
• Use same AVIF URL when fetching dependency #8871 [@​radarhere]
• Update dependency mypy to v1.16.1 #9026 [@renovate[bot]]
• Update libpng to 1.6.49 #9014 [@​radarhere]
• Update dependency cibuildwheel to v3 #9010 [@renovate[bot]]
• Updated libjpeg-turbo to 3.1.1 #9009 [@​radarhere]
• Update dependency mypy to v1.16.0 #8991 [@renovate[bot]]
• Updated libpng to 1.6.48 #8940 [@​radarhere]
• Updated Ghostscript to 10.5.1 #8939 [@​radarhere]
• Updated harfbuzz to 11.2.1 #8937 [@​radarhere]
• Updated libavif to 1.3.0 #8949 [@​radarhere]
• Update dependency cibuildwheel to v2.23.3 #8931 [@renovate[bot]]
• Updated harfbuzz to 11.1.0 #8904 [@​radarhere]

Testing

• Add match parameter to pytest.warns() #9038 [@​hugovk]
• Increase pytest verbosity #9040 [@​radarhere]
• Improve SgiImagePlugin test coverage #8896 [@​radarhere]
• Update ruff pre-commit ID #8994 [@​radarhere]

... (truncated)

Commits

• 89f1f46 11.3.0 version bump
• f2de251 Updated check script paths (#9052)
• 84855d1 Raise FileNotFoundError when opening an empty path (#9048)
• 204d11d Raise FileNotFoundError when opening an empty path
• 2b39f75 Handle IPTC TIFF tags with incorrect type (#8925)
• e7a53ba Do not update palette for L mode GIF frame (#8924)
• c22230b Use save parameters as encoderinfo defaults (#9001)
• da10ed1 Add support for iOS (#9030)
• be2b4e7 Fix qtables and quality scaling (#8879)
• d4162f8 Updated return type
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
pip/pillow	11.3.0	🟢 7.6	Details Check Score Reason Code-Review 🟢 8 Found 13/16 approved changesets -- score normalized to 8 Security-Policy 🟢 10 security policy file detected Maintained 🟢 10 30 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices 🟢 5 badge detected: Passing License 🟢 9 license file detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 10 no binaries found in the repo Signed-Releases ⚠️ -1 no releases found Fuzzing 🟢 10 project is fuzzed Vulnerabilities 🟢 10 0 existing vulnerabilities detected Packaging 🟢 10 packaging workflow detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• pyproject.toml

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[chatgpt-codex-connector]

💡 Codex Review

glimpser/app/static/js/templates.js

Lines 833 to 836 in 76dd14b

	const raw = cell.dataset.raw || cell.textContent;
	cell.dataset.raw = raw;
	if (!term) {
	cell.innerHTML = raw;

Avoid re-inserting caption text via innerHTML

The new highlight logic assigns cell.textContent back into cell.innerHTML. If any caption contains HTML-like characters (e.g., user-provided text with <img onerror=...> or <script>), this converts previously safe text into executable markup once the filter runs. That creates an XSS vector triggered by typing in the captions search (or clearing it, which calls highlight with an empty term). Consider keeping text nodes (or escaping) and only wrapping matches in <mark> via DOM APIs so raw caption strings are never interpreted as HTML.

---

glimpser/app/static/js/templates.js

Lines 941 to 943 in 76dd14b

	confirmBtn.addEventListener("click", onConfirm, { once: true });
	cancelBtn?.addEventListener("click", hide, { once: true });
	closeBtn?.addEventListener("click", hide, { once: true });

Clean up confirm handler when modal is canceled

Each call to confirmDeleteCamera attaches a new click handler to the confirm button, but that handler is only removed if the user confirms. If the modal is opened and then canceled/closed, the handler remains; opening the modal again adds another one. When the user eventually confirms, all pending handlers fire, causing duplicate DELETE requests and repeated DOM removals. This shows up when a user cancels once (or clicks outside the modal) before confirming later.

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".