[lstein]

Summary

This clears all 82 open Dependabot alerts (pip and npm), including every critical and high one.

• Pillow 12.2.0 → 13.0.0: about 40 decoder memory-safety and DoS advisories, 5 of them critical (FPX/JPEG heap overflows, TIFF write overflow, Ghostscript argument injection, and others), many of them reachable from Image.open(). Pillow 13 requires Python ≥3.11, so Python 3.10 support is dropped. 3.10 reached end of life this month; the launcher and Docker already use 3.11 or later. CI now tests 3.11 and 3.14 and lints on 3.11, and the docs, READMEs and the deprecated installers' version checks say 3.11.
• starlette 1.10.0 (the floor is now >=1.3.1 for the urlencoded form limits fix) and fastapi 0.162.
• urllib3 2.8.0, certifi 2026.10.23, cryptography 50.0.2, anyio 4.14.2, fsspec 2026.9.0, filelock 4.2.4, werkzeug 3.1.9, torch 2.14.1.
• setuptools 66.1.1 → 84.2.1: the setuptools<67 runtime pin is removed.
  • clip-anytorch still does from pkg_resources import packaging, and setuptools 81+ no longer ships pkg_resources. The new encoders.import_openai_clip() puts in a temporary stand-in while clip imports, under a lock because indexing and search can build encoders at the same time.
  • The Dockerfiles and the deprecated installers download the CLIP weights through this helper.
• Docs toolchain: mkdocs 1.6.1, mkdocs-material 9.8.0, pymdown-extensions 12.3. The fixed mkdocs-material needs mkdocs 1.6, so the mkdocs<1.6 live-reload workaround is lifted; I checked that mkdocs serve rebuilds and reloads when a file changes.
• npm: npm audit fix for the dev-only Jest/ESLint tree; npm audit now reports 0 vulnerabilities.

Test plan

• pytest tests: 1345 passed (the reviewer also ran it with -W error::DeprecationWarning: 1347 passed)
• npm test: 1019 passed; ruff, eslint and prettier are clean
• A script checked each open pip alert's fixed version against uv.lock: all pass
• Real server on a real album: page load, image serving, Range → 206, text search
• New tests for import_openai_clip(); the reviewer's two-thread race repro passes after the lock was added
• Docker image build (not run locally)

🤖 Generated with Claude Code