[matrixise]

Summary

Groups the Dependabot security updates into a single PR. Each Dependabot PR bumped only one package, so pip-audit in CI kept failing on the vulnerabilities fixed by the others: the PRs blocked each other.

Package	From	To	Advisories
certifi	2026.7.22	2026.10.23	GHSA-6q48-6c7w-9gw2 (critical, compromised emSign CAs)
pillow	12.3.0	13.0.0	GHSA-5x8w-8jj5-q52h, GHSA-v9pv-5gc8-w2m6 (critical) and ~20 others
djangorestframework	3.18.1	3.18.3	GHSA-33wh-fxxf-88vv, GHSA-3547-9m27-7rxg, GHSA-xw6w-gcfp-cf8m
filelock	4.0.3	4.2.6	GHSA-v4x8-3wr5-3wq8 and ~15 local-user advisories
msgpack	1.2.2	1.2.4	GHSA-j586-36cw-2gc2 (no Dependabot PR was opened)
uv (dev)	0.12.19	0.13.6	GHSA-hq85-5cpj-mr62

Pillow 13 is a major bump, but Pillow is only a transitive dependency (Wagtail / Willow); the project never imports PIL directly.

Forcing uv >= 0.13.6

Every uv pin is bumped to 0.13.6 (mise.toml, Dockerfile, uv-pre-commit hook rev, dev dependency lower bound), and [tool.uv] required-version = ">=0.13.6" makes older uv binaries refuse to run on the project, both in CI (setup-uv reads it) and locally. Developers must upgrade uv (mise install, uv self update or brew upgrade uv).

Supersedes #253, #254, #255, #256, #257.

Test plan

• uv run pip-audit: no known vulnerabilities
• manage.py test pythonie --settings=pythonie.settings.tests: OK
• prek hooks pass
• CI green
• After deploy, check image upload and renditions in the Wagtail admin (Pillow 13)

🤖 Generated with Claude Code