Repository navigation
Update Python dependencies to fix Dependabot alerts - #334
Merged
Merged
Conversation
Upgrade pillow from 12.3.0 to 13.0.0, certifi from 2026.2.25 to 2026.10.19, and virtualenv from 21.14.5 to 21.14.12 in uv.lock. virtualenv 21.14.12 requires packaging >= 26.3 and distlib >= 0.4.3, so uv also moves packaging from 26.0 to 26.3 and distlib from 0.4.0 to 0.4.4. packaging is used at runtime by matplotlib and scikit-image, so the Lambda image picks up the new packaging version as well. No dependency edges changed. Only the five pinned versions above moved. Co-authored-by: Wasim Amiri <wasimxyz@users.noreply.github.com>
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This upgrades three pinned Python packages in
uv.lock. Together they cover 45 open Dependabot alerts.pillowgoes from 12.3.0 to 13.0.0. This covers 39 alerts. Lambda processing uses Pillow through matplotlib, scikit-image, and imageio, and the Hina JPEG export calls it directly.certifigoes from 2026.2.25 to 2026.10.19. This covers 1 alert.requestsuses it.virtualenvgoes from 21.14.5 to 21.14.12. This covers 5 alerts. It is only used in development, through pre-commit.The new
virtualenvneeds newerpackaginganddistlibpackages, souvmoves those as well.packaginggoes from 26.0 to 26.3, anddistlibgoes from 0.4.0 to 0.4.4.packagingis also used at runtime by matplotlib and scikit-image, so the Lambda image gets the newer version too.No dependency edges change. Only these five pinned versions move.
Pillow 13 notes
Pillow 13 is a major release. The breaking change that could touch this code is the
modeargument toImage.fromarray(). Pillow 13 only removes that argument when it changes the data type. The one call in the repo,Image.fromarray(rgb_uint8, mode="RGB")inlambda/src/data_hub_lambda/hina_microscope/image_processing.py, passes auint8array, so it is not affected. Pillow 13 needs Python 3.11 or later, and the Lambda image uses Python 3.12.Testing
uv lock --checkpasses.make py-test-unitpasses: 1,093 tests passed, and the 73 integration tests were deselected because they need Postgres and a running web server. They do not exercise these packages directly.make docker-build-lambdabuilds. Inside the image, Python 3.12.15 imports Pillow 13.0.0, certifi 2026.10.19, packaging 26.3, scikit-image, and imageio. It also saves a JPEG with the sameImage.fromarray(..., mode="RGB")call the Hina export uses.make checkandmake docs-catalogspass.make docs-catalogschanges no snapshot files.Rollout
The Lambda image picks up these versions on its next deploy. The watcher package keeps its version number, because its source code does not change. Lab PCs install the watcher from PyPI, so they do not use this lock file.
No changelog entry is needed because this is a dependency update.