[P2][deps][security] pillow 12.3.0 and certifi 2026.7.22 fail Dependency audit and OSV scan on main #2116

Problem

Dependency audit and OSV dependency scan fail on every PR since 2026-10-21 00:35Z (advisory database update). main was green at the #2113 merge (2026-10-20 15:33Z); the lock on main has not changed.

Locked versions on main (uv.lock):

• pillow 12.3.0 — 9 advisories, all fixed in 13.0.0 (CVE-2026-112395, -112397, -112400, -112404, -112895, -112896, -112897, -112899, plus the matching GHSA entries; highest OSV severity 9.2)
• certifi 2026.7.22 — PYSEC-2026-4320, fixed in 2026.10.19

Neither check is a required status check on main, so merges are not blocked, but every open PR carries two red checks that are not its own.

Scope (one PR)

• Raise the floor in pyproject.toml: pillow>=13.0.0; re-lock certifi to >= 2026.10.19. Pins only tighten.
• Include the 5 pending bumps from deps(uv): bump the uv-minor-patch group across 1 directory with 5 updates #2112 so it closes with the PR: pypdf 6.20.1, starlette==1.8.0 (exact pin), pre-commit 4.7.0, ast-serialize 0.13.0, truststore 0.10.5.
• pillow 12 -> 13 is a major bump: check pillow-heif compatibility and the PDF/image/report code paths that import PIL.
• Regenerate uv.lock, requirements.txt and pylock.toml with uv 0.11.2 (the version CI pins); do not use a newer uv.

Acceptance criteria

• Dependency audit and OSV dependency scan pass.
• ./scripts/check-all.sh exit 0 with an empty XDG_CONFIG_HOME.
• test_requirements_txt_matches_uv_export and test_pylock_toml_matches_uv_export pass with uv 0.11.2.
• A test (or an existing one cited) covers a PIL image path and the starlette 1.8 request path touched by the API.
• No pin is loosened; the filelock major ignore stays.