[rhein1]

Summary

• update the AnyDoc conformance-only Pillow pin from 12.3.0 to patched 13.0.0
• regenerate the hash-locked Python 3.13 requirements file while retaining the existing package pins
• update the conformance runtime dependency assertion to keep the fixture manifest contract synchronized

Security impact

GitHub Dependabot reports current critical/high Pillow advisories in this requirements root, including GHSA-8g5g-8vmr-9782 (CVE-2026-112403); the first patched version is 13.0.0. The dependency is conformance-only and grants no hosted, provider, payment, publication, deployment, trust, or memory authority.

References:

• GHSA-8g5g-8vmr-9782
• https://github.com/python-pillow/Pillow/releases/tag/13.0.0

Validation

• npm run check --prefix examples/anydoc-document-evidence: passed
• python -m pip install --dry-run --require-hashes -r examples/anydoc-document-evidence/conformance/requirements.txt: passed; verified hash lock and selected Pillow 13.0.0
• git diff --check: passed
• review/conformance Node tests were not fully runnable in this isolated checkout because the existing @firecrawl/anydoc@0.1.7 package is not installed; 32 non-adapter tests passed and 4 adapter tests failed closed with parser_dependency_missing. No package was installed.

This draft remains unmerged pending hosted checks and independent review.