fix(security): bump Pillow to 12.3.0, fixes 5 disclosed CVEs (#517)

docker/Dockerfile

@@ -365,7 +365,7 @@ RUN --mount=type=cache,target=/root/.cache/pip \
     /opt/venv/bin/pip install --upgrade "pip==26.1.2" && \
     /opt/venv/bin/pip install --upgrade "wheel==0.47.0" "setuptools==78.1.1" "jaraco.context==6.1.0" && \
     /opt/venv/bin/pip install \
-        Pillow==12.2.0 \
+        Pillow==12.3.0 \
         numpy==1.26.4 \
         opencv-python-headless==4.10.0.84 \
         "huggingface-hub[hf_xet,hf_transfer]==0.36.2" \

docker/feature-manifest.json

@@ -4,7 +4,7 @@
   "pythonVersion": { "amd64": "3.12", "arm64": "3.11" },
   "basePackages": [
     "numpy==1.26.4",
-    "Pillow==12.2.0",
+    "Pillow==12.3.0",
     "opencv-python-headless==4.10.0.84",
     "huggingface-hub[hf_xet,hf_transfer]==0.36.2"
   ],

packages/ai/python/requirements-gpu.txt

@@ -12,7 +12,7 @@ paddlepaddle-gpu==3.0.0
 mediapipe>=0.10.21
 onnxruntime-gpu==1.20.1
 numpy==1.26.4
-Pillow==12.2.0
+Pillow==12.3.0
 opencv-python-headless==4.10.0.84
 codeformer-pip==0.0.4
 

packages/ai/python/requirements.txt

@@ -12,7 +12,7 @@ paddlepaddle>=3.0.0,<3.1.0
 mediapipe>=0.10.21
 onnxruntime==1.20.1
 numpy==1.26.4
-Pillow==12.2.0
+Pillow==12.3.0
 opencv-python-headless==4.10.0.84
 codeformer-pip==0.0.4