[FabioLeitao]

Summary

• The public floor stays pillow>=12.3.0. Streamlit <=1.66.0 declares pillow<13, so raising that floor makes pip install data-boar[grc-dashboard] unsatisfiable. [tool.uv] override-dependencies installs Pillow 13.0.0 only in the uv lock. Remove the override when Streamlit widens the cap.
• certifi is locked at 2026.10.19. The directed upgrade also locked pypdf 6.21.1, starlette 1.8.0, pre-commit 4.7.0, ast-serialize 0.13.1, and truststore 0.10.5. filelock stays 3.32.7. No pin was loosened.
• CHANGELOG.md and docs/TOPOLOGY.md record that a pip install of [grc-dashboard] stays on Pillow 12.x until Streamlit widens the cap.

Test plan

• ./scripts/check-all.sh exit 0 with an empty XDG_CONFIG_HOME and uv 0.11.2 (3334 passed).
• tests/test_grc_dashboard_plotly_smoke.py::test_dashboard_apptest_renders_example_report ran app/dashboard.py under Streamlit 1.66.0 and Pillow 13.0.0.
• PNG round-trip, pillow-heif opener, and GET /health 200.
• uv export matches requirements.txt and pylock.toml under uv 0.11.2.
• pip install --dry-run of data-boar[grc-dashboard] in a venv outside the repo resolved pillow 12.3.0.
• Dependency audit and OSV dependency scan on this PR.

Supersedes #2112

Closes #2116
Public floor stays pillow>=12.3.0. Pillow 13 enters only through the uv lock override (operator decision).