security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-45hq-cxwh-f6vc	pillow	None	12.0.0	12.3.0		confirmed

Not Included

• Deferred by batch limit: 145 advisories. They will be considered by future runs.
• Other deferred scanner findings: 7.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	json-schema	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	float	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	hashes	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	typebox	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	runtime	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/godbus/dbus/v5	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	authlib	Missing CVE/GHSA identifier required for Socket fix planning.

---

Note

Low Risk
Lockfile-only dependency patch in template projects; no runtime code changes.

Overview
Bumps the pinned pillow dependency from 12.0.0 to 12.3.0 in the uv.lock files for the browser-use and openagi-computer-use Python templates, addressing GHSA-45hq-cxwh-f6vc.

There are no application or manifest source changes beyond refreshed lockfile entries (hashes and wheel URLs for the new release).

^{Reviewed by Cursor Bugbot for commit 92aa8f2. Bugbot is set up for automated code reviews on this repo. Configure here.}

[ulziibay-kernel]

Verified the bump against the advisory's first patched version; rebuilt on current main and confirmed the toolchain lock/build is clean. CI green.