[SemiKyle]

Bump Pillow so the open Pillow alerts on inferencex-e2e/uv.lock close.

• pillow (transitive): 12.3.0 to 13.0.0 in inferencex-e2e/uv.lock. This closes the 39 open Pillow alerts on that file (13.0.0 is the first patched version for all of them). Release notes: https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/13.0.0.rst
• Made with uv 0.12.18 and uv lock --upgrade-package pillow, with the repo's own exclude-newer = "PT12H". No other package version changes. The [options] line and the torch marker changes come from uv 0.12.18, the same as in fix(security): dependency sweep for critical and high alerts #4439.
• Pillow 13 needs Python 3.11 or later. The project requires Python 3.12 (requires-python and .python-version).
• The repo does not import PIL directly.
• Pillow 13.0.0 is 7 days old (uploaded 2026-10-16 22:15 UTC). Lock URLs point to pypi.org and files.pythonhosted.org, and the Pillow 13 hashes match PyPI.

Not changed: the 39 Pillow alerts on the root uv.lock are stale. That file was removed in #3525.

Note: #4439 also edits inferencex-e2e/uv.lock (GitPython). The two PRs touch different package entries, but whichever merges second may need a small lock rebase.

[claude]

I reviewed this lockfile bump and didn't find any bugs. Because it is a major-version jump (Pillow 12 to 13) and the lock also carries some unrelated changes from the newer uv version, a human look would still be worthwhile.

What was reviewed:

• All 69 new sdist/wheel URLs point to files.pythonhosted.org and are pillow-13.0.0 artifacts. Pillow is pulled in only through matplotlib, and requires-python >=3.12 meets Pillow 13's Python 3.11 minimum.
• [options] exclude-newer now holds uv's placeholder value, and exclude-newer-span = "PT12H" still matches pyproject.toml.
• The two torch variant entries no longer have per-dependency sys_platform markers. These look redundant with the entries' resolution-markers, but they are not related to Pillow.

Extended reasoning...

The change touches only inferencex-e2e/uv.lock. It moves the transitive pillow dependency (pulled in by matplotlib) from 12.3.0 to 13.0.0. It also includes two incidental changes from uv: the exclude-newer placeholder and dropped platform markers on torch dependencies. No application code, auth or other security-sensitive logic changes, but this is dependency supply-chain content whose hashes cannot be checked against PyPI from here. The whole repo is covered by a CODEOWNERS wildcard for the core team, and the bump crosses a major version, so I deferred rather than approved.