fix(deps): bump pillow, nltk, and langchain-core for multiple CVEs (#6272)

## Summary

Bump minimum version constraints for pillow, nltk, and langchain-core to
address multiple CVEs:

| Package | Old Constraint | New Constraint | CVE(s) |
|---|---|---|---|
| `pillow` | `>=12.2.0` | `>=12.3.0` | CVE-2026-42311: PSD arbitrary
code execution; CVE-2026-55379: BDF font DoS; CVE-2026-55380: GD image
DoS; CVE-2026-54060: font file memory allocation DoS |
| `nltk` | `>=3.9.4` | `>=3.10.0` | CVE-2026-54293: path traversal in
`nltk.data.load()`; CVE-2026-12243: path traversal via URL-encoded
separators |
| `langchain-core` | (none) | `>=0.3.85` | CVE-2026-44843: insecure
deserialization via overly broad object allowlists |

## Test plan

- [x] `uv run pre-commit run --all-files` — all checks passed
- [ ] Verify updated package versions resolve in clean install

Signed-off-by: Eleanor Hu <ehu@redhat.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
(cherry picked from commit 2189b3e)

# Conflicts:
#	pyproject.toml
#	uv.lock

Author: EleanorWho

pyproject.toml

@@ -8,8 +8,38 @@ fallback_version = "0.4.6"
 [tool.uv]
 required-version = ">=0.7.0"
 constraint-dependencies = [
+<<<<<<< HEAD
     "pyasn1>=0.6.4",  # CVE-2026-30922, CVE-2026-59885: DoS via unbounded recursion
     "starlette>=1.0.1",                # CVE-2026-48710
+=======
+    "aiohttp>=3.14.0",                # CVE-2026-34993: CookieJar.load() RCE
+    "authlib>=1.6.11",                 # CVE-2026-41425 + 7 more: account takeover, JWE padding oracle, sig bypass
+    "cryptography>=48.0.1",            # CVE-2026-39892: buffer overflow; CVE-2026-34073: DNS constraint bypass
+    "fonttools>=4.60.2",
+    "gitpython>=3.1.47",               # Command injection via Git options bypass
+    "h11>=0.16.0",
+    "idna>=3.15",
+    "joserfc>=1.6.8",
+    "langgraph-checkpoint>=4.1.1",
+    "langgraph-sdk>=0.3.15",
+    "langsmith>=0.8.18",
+    "lxml>=6.1.0",                     # CVE-2026-41066: XML entity expansion with default resolve_entities=True
+    "msgpack>=1.2.1",
+    "pillow>=12.3.0",                  # CVE-2026-42311: PSD RCE; CVE-2026-55379/55380/54060: font/GD DoS
+    "protobuf>=5.29.6",               # CVE-2025-4565 + CVE-2026-0994: parsing vulnerabilities
+    "pyasn1>=0.6.3",                   # CVE-2026-30922: DoS via unbounded recursion
+    "pydantic-settings>=2.14.2",
+    "python-engineio>=4.13.2",
+    "python-multipart>=0.0.31",        # CVE-2026-40347: header injection; CVE-2026-42561: DoS via oversized headers
+    "python-socketio>=5.16.2",         # CVE-2025-61765: RCE via pickle deserialization
+    "requests>=2.34.2",
+    "setuptools<81",                   # milvus-lite imports pkg_resources; setuptools 81+ removes it
+    "starlette>=1.3.1",                # CVE-2026-48710
+    "tornado>=6.5.6",
+    "urllib3>=2.7.0",                  # CVE-2026-44432: DoS via excessive decompression; CVE-2026-44431: cross-origin redirect header leak
+    "transformers>=4.57.2,<5.0.0",     # CVE-2026-1839 fix only in 5.x; ogx doesn't use Trainer; 5.x breaks HybridCache imports
+    "werkzeug>=3.1.6",                 # CVE-2025-66221 + 2 more: safe_join() device name bypass
+>>>>>>> 2189b3e4 (fix(deps): bump pillow, nltk, and langchain-core for multiple CVEs (#6272))
 ]
 
 [project]
@@ -64,7 +94,60 @@ dependencies = [
 
 [project.optional-dependencies]
 client = [
+<<<<<<< HEAD
     "llama-stack-client==0.4.6",
+=======
+    "ogx-client>=1.1.3", # Optional for library-only usage
+]
+openclient = [
+    "ogx-open-client>=1.0.2",
+]
+starter = [
+    "aiohttp",
+    "anthropic>=0.105.2",
+    "autoevals",
+    "boto3>=1.43.18",
+    "chardet",
+    "chromadb-client",
+    "datasets>=4.0.0",
+    "docling-slim[service-client]>=2.103.0",  # AsyncDoclingServiceClient added in 2.103.0
+    "einops",
+    "elasticsearch>=8.16.0,<9.0.0",
+    "emoji",
+    "faiss-cpu",
+    "fire",
+    "fireworks-ai<=0.17.16",
+    "google-genai>=1.69.0,<2",
+    "langdetect",
+    "markitdown[all]",
+    "matplotlib",
+    "nltk>=3.10.0",                                      # CVE-2026-54293/CVE-2026-12243: path traversal in nltk.data.load()
+    "numpy",
+    "ollama",
+    "pandas",
+    "pillow",
+    "pgvector>=0.3.0",
+    "pymilvus[milvus-lite]>=2.4.10",
+    "pymongo",
+    "pypdf>=6.13.3",
+    "pythainlp",
+    "qdrant-client",
+    "redis>=8.0.0",
+    "requests",
+    "safetensors",
+    "scikit-learn",
+    "scipy",
+    "sentence-transformers>=5.5.1",
+    "sentencepiece",
+    "sqlite-vec",
+    "together>=2",
+    "tokenizers",
+    "torch",
+    "tqdm",
+    "tree_sitter",
+    "unstructured-client>=0.25.0",
+    "weaviate-client>=4.16.5",
+>>>>>>> 2189b3e4 (fix(deps): bump pillow, nltk, and langchain-core for multiple CVEs (#6272))
 ]
 
 [dependency-groups]
@@ -113,14 +196,22 @@ type_checking = [
     "lm-format-enforcer",
     "mcp",
     "ollama",
+<<<<<<< HEAD
     "llama-stack-client==0.4.6",
+=======
+    "langchain-openai>=1.2.2",
+    "langchain-core>=0.3.85",                            # CVE-2026-44843: insecure deserialization
+    "langgraph",
+    "ogx-open-client>=1.0.2",
+>>>>>>> 2189b3e4 (fix(deps): bump pillow, nltk, and langchain-core for multiple CVEs (#6272))
 ]
 # These are additional dependencies required for running unit tests beyond the
 # shared `test` dependency group.
 unit = [
     "anthropic",
     "databricks-sdk",
     "sqlite-vec",
+<<<<<<< HEAD
     "ollama",
     "llama-stack-client==0.4.6",
     "aiosqlite",
@@ -131,6 +222,29 @@ unit = [
     "chardet",
     "sqlalchemy",
     "sqlalchemy[asyncio]>=2.0.41",
+=======
+    "together",
+    "unstructured-client>=0.25.0",
+]
+# These are the core dependencies required for running integration tests. They are shared across all
+# providers. If a provider requires additional dependencies, please add them to your environment
+# separately. If you are using "uv" to execute your tests, you can use the "--group" flag to specify extra
+# dependencies.
+test = [
+    {include-group = "test-common"},
+    "autoevals",
+    "chromadb>=1.0.15",
+    "datasets>=4.0.0",
+    "elasticsearch>=8.16.0, <9.0.0",
+    "google-genai>=1.69.0,<2",
+    "langchain-core>=0.3.85",                            # CVE-2026-44843: insecure deserialization
+    "langchain-openai>=1.2.2",
+    "langgraph",
+    "milvus-lite>=2.5.0; platform_machine == 'x86_64' or platform_machine == 'aarch64' or platform_machine == 'arm64'",
+    "pymilvus>=2.6.2",
+    "qdrant-client",
+    "requests",
+>>>>>>> 2189b3e4 (fix(deps): bump pillow, nltk, and langchain-core for multiple CVEs (#6272))
     "torch>=2.6.0",
     "torchvision>=0.21.0",
     "fairscale",