chore(deps): lock Pillow 13 without raising the public floor

CHANGELOG.md

@@ -6,6 +6,8 @@ Human-readable summary of user-facing changes. **Detailed release notes:** [docs
 
 Migration notes on the **`1.8.0-rc`** working line (no new semver cut):
 
+- **Pillow 13 in the uv lock (#2116):** `uv.lock` installs Pillow 13. `pip install data-boar[grc-dashboard]` stays on Pillow 12.x until Streamlit widens its `pillow<13` cap (Streamlit <=1.66.0). The public floor remains `pillow>=12.3.0`.
+
 - **Hybrid license required (#2042):** enforced mode rejects a token that has no `dbmldsa_sig` (`hybrid_claim_required`) and rejects verification when the packaged ML-DSA anchor is missing (`missing_mldsa_anchor`). Ed25519-only licenses from 1.7.4 must be reissued before an enforced 1.8 deployment. `licensing.mode: open` is unchanged.
 - **Dev issuer hybrid (#2043):** `scripts/issue_dev_license_jwt.py` attaches `dbmldsa_sig` with a DEV ML-DSA-65 key (`DATA_BOAR_LICENSE_ISSUER_MLDSA_PRIVATE_KEY_PEM_FILE`). It refuses the packaged anchor private key. An unset key is ephemeral and does not match the packaged anchor.
 

docs/TOPOLOGY.md

@@ -10,7 +10,7 @@ Textual description of modules, classes, and main functions and how they connect
 
 - **main.py** — CLI: `main()` parses `--config`, `--web`, `--port`, optional `--tenant`, `--technician`; loads config via `config.loader.load_config`; if not `--web`, creates `AuditEngine(config)`, runs `start_audit(tenant_name=..., technician_name=...)`, then `generate_final_reports()`; if `--web`, runs uvicorn with `api.routes.app` on given port.
 - **api/routes.py** — FastAPI app: startup loads config and creates `AuditEngine`. API routes: POST `/scan` (optional body `{ "tenant": "...", "technician": "..." }`), `/start`; GET `/status`, `/report`, `/list`; GET `/reports/{session_id}`; PATCH `/sessions/{session_id}` (body `{ "tenant": "..." }` to set/clear tenant), PATCH `/sessions/{session_id}/technician` (body `{ "technician": "..." }` to set/clear technician). POST `/scan_database` accepts optional `tenant` and `technician`. Web dashboard (Jinja2): GET `/` (dashboard with optional tenant/technician inputs and progress chart), GET `/reports` (reports list with tenant/technician columns), GET `/config`, POST `/config` (config editor). Static: `/static` → `api/static`. Optional maturity POC: `POST /{locale}/assessment`, `GET /{locale}/assessment/export` when enabled.
-- **app/dashboard.py** — Optional Streamlit GRC executive view (`streamlit run app/dashboard.py` after `uv sync --extra grc-dashboard`). Reads report JSON (`DATA_BOAR_GRC_JSON` or the example under `schemas/`). Distinct from the Jinja dashBOARd in **api/routes.py**.
+- **app/dashboard.py** — Optional Streamlit GRC executive view (`streamlit run app/dashboard.py` after `uv sync --extra grc-dashboard`). Reads report JSON (`DATA_BOAR_GRC_JSON` or the example under `schemas/`). Distinct from the Jinja dashBOARd in **api/routes.py**. A pip install of `[grc-dashboard]` stays on Pillow 12.x until Streamlit widens its `pillow<13` cap; the uv lock installs Pillow 13 (#2116).
 
 ---
 

docs/TOPOLOGY.pt_BR.md

@@ -10,7 +10,7 @@ Descrição textual dos módulos, classes e funções principais e como eles se
 
 - **main.py** — CLI: `main()` analisa `--config`, `--web`, `--port`, opcionalmente `--tenant`, `--technician`; carrega config via `config.loader.load_config`; se não for `--web`, cria `AuditEngine(config)`, executa `start_audit(...)` e `generate_final_reports()`; se `--web`, executa uvicorn com `api.routes.app` na porta informada.
 - **api/routes.py** — App FastAPI: na inicialização carrega config e cria `AuditEngine`. Rotas da API: POST `/scan`, `/start`; GET `/status`, `/report`, `/list`, `/reports/{session_id}`; PATCH `/sessions/{session_id}` e `/sessions/{session_id}/technician`. POST `/scan_database` aceita tenant e technician opcionais. Dashboard web (Jinja2): GET `/` (dashboard com inputs opcionais de tenant/technician e gráfico de progresso), GET `/reports`, GET/POST `/config`. Estáticos: `/static` → `api/static`. POC de maturidade (opcional): `POST /{locale}/assessment`, `GET /{locale}/assessment/export`.
-- **app/dashboard.py** — Visão executiva GRC em Streamlit (`streamlit run app/dashboard.py` após `uv sync --extra grc-dashboard`). Lê JSON do relatório (`DATA_BOAR_GRC_JSON` ou o exemplo em `schemas/`). Distinta do dashBOARd Jinja em **api/routes.py**.
+- **app/dashboard.py** — Visão executiva GRC em Streamlit (`streamlit run app/dashboard.py` após `uv sync --extra grc-dashboard`). Lê JSON do relatório (`DATA_BOAR_GRC_JSON` ou o exemplo em `schemas/`). Distinta do dashBOARd Jinja em **api/routes.py**. Quem instala o extra `[grc-dashboard]` via pip fica no Pillow 12.x até o Streamlit ampliar o limite `pillow<13`; o `uv.lock` instala o Pillow 13 (#2116).
 
 ---