fix(deps): bump pillow, nltk, and langchain-core for multiple CVEs (backport #6272) (#6362)

## Summary

Bump minimum version constraints for pillow, nltk, and langchain-core to
address multiple CVEs:

| Package | Old Constraint | New Constraint | CVE(s) |
|---|---|---|---|
| `pillow` | `>=12.2.0` | `>=12.3.0` | CVE-2026-42311: PSD arbitrary
code execution; CVE-2026-55379: BDF font DoS; CVE-2026-55380: GD image
DoS; CVE-2026-54060: font file memory allocation DoS |
| `nltk` | `>=3.9.4` | `>=3.10.0` | CVE-2026-54293: path traversal in
`nltk.data.load()`; CVE-2026-12243: path traversal via URL-encoded
separators |
| `langchain-core` | (none) | `>=0.3.85` | CVE-2026-44843: insecure
deserialization via overly broad object allowlists |

## Test plan

- [x] `uv run pre-commit run --all-files` — all checks passed
- [ ] Verify updated package versions resolve in clean install<hr>This
is an automatic backport of pull request #6272 done by
[Mergify](https://mergify.com).

---------

Signed-off-by: Charlie Doern <cdoern@redhat.com>
Co-authored-by: Eleanor Hu <145939433+EleanorWho@users.noreply.github.com>
Co-authored-by: Charlie Doern <cdoern@redhat.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: 4 people

pyproject.toml

@@ -95,13 +95,13 @@ starter = [
     "langdetect",
     "matplotlib",
     "mcp>=1.23.0",
-    "nltk>=3.9.4",
+    "nltk>=3.10.0",                                   # CVE-2026-54293/CVE-2026-12243: path traversal in nltk.data.load()
     "numpy",
     "ollama",
     "opentelemetry-exporter-otlp-proto-http",
     "opentelemetry-sdk",
     "pandas",
-    "pillow>=12.2.0",
+    "pillow>=12.3.0",                                 # CVE-2026-42311: PSD RCE; CVE-2026-55379/55380/54060: font/GD DoS
     "psycopg2-binary",
     "pymilvus[milvus-lite]>=2.4.10",
     "pymongo",