[cdbartholomew]

Routine dependency maintenance for uv.lock.

Closes Dependabot alerts #2190 #2196 #2197 #2233 #2234 #2235 #2236 #2237 #2238 #2239

• certifi 2025.10.5 → 2026.10.19 (GHSA-6q48-6c7w-9gw2)
• pillow 12.3.0 → 13.0.0 (GHSA-462x-pgg6-55fp, GHSA-58r4-6rv3-gfh8, GHSA-65qm-jvmh-6pqg, GHSA-8g5g-8vmr-9782, GHSA-c6hw-5grf-ff96, GHSA-p4wg-p73j-c528, GHSA-pchr-8j38-3x4p, GHSA-q45j-58j2-45rg, GHSA-vx6w-vv9f-6gvg)

The lock was regenerated with uv lock --upgrade-package for certifi, pillow only; nothing else was re-resolved apart from what those upgrades require.

Pillow moves across a major version (12 → 13; all fixes are only in 13.0.0). Nothing in this repository imports PIL directly; see the verification notes below for the two consumers that do.

Verification

• uv build (hindsight-api-slim): OK
• uv sync --frozen --all-extras --no-extra local-llm --index-strategy unsafe-best-match: OK (the local-llm extra's llama-cpp-python source build does not compile on the local machine, independent of this change)
• Pillow has no direct importers in hindsight_api; it comes in through pdfplumber 0.11.9 and python-pptx 1.0.2, both used by the markitdown file parser. PIL.Image, pdfplumber, pptx, markitdown and hindsight_api.engine.parsers.markitdown all import cleanly against pillow 13.0.0.
• pytest tests/test_markitdown_parser.py tests/test_file_retain.py tests/test_aiohttp_session.py: 56 passed. The full suite runs in the test-api job.