fix(deps): bump pillow, nltk, and langchain-core for multiple CVEs (backport #6272) (#6361)

## Summary

Bump minimum version constraints for pillow, nltk, and langchain-core to
address multiple CVEs:

| Package | Old Constraint | New Constraint | CVE(s) |
|---|---|---|---|
| `pillow` | `>=12.2.0` | `>=12.3.0` | CVE-2026-42311: PSD arbitrary
code execution; CVE-2026-55379: BDF font DoS; CVE-2026-55380: GD image
DoS; CVE-2026-54060: font file memory allocation DoS |
| `nltk` | `>=3.9.4` | `>=3.10.0` | CVE-2026-54293: path traversal in
`nltk.data.load()`; CVE-2026-12243: path traversal via URL-encoded
separators |
| `langchain-core` | (none) | `>=0.3.85` | CVE-2026-44843: insecure
deserialization via overly broad object allowlists |

## Test plan

- [x] `uv run pre-commit run --all-files` — all checks passed
- [ ] Verify updated package versions resolve in clean install<hr>This
is an automatic backport of pull request #6272 done by
[Mergify](https://mergify.com).

---------

Signed-off-by: Charlie Doern <cdoern@redhat.com>
Co-authored-by: Eleanor Hu <145939433+EleanorWho@users.noreply.github.com>
Co-authored-by: Charlie Doern <cdoern@redhat.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: 4 people

pyproject.toml

@@ -8,7 +8,7 @@ fallback_version = "0.4.6"
 [tool.uv]
 required-version = ">=0.7.0"
 constraint-dependencies = [
-    "pyasn1>=0.6.4",  # CVE-2026-30922, CVE-2026-59885: DoS via unbounded recursion
+    "pyasn1>=0.6.3",  # CVE-2026-30922: DoS via unbounded recursion
     "starlette>=1.0.1",                # CVE-2026-48710
 ]
 
@@ -47,7 +47,7 @@ dependencies = [
     "rich",
     "termcolor",
     "tiktoken",
-    "pillow>=12.2.0",
+    "pillow>=12.3.0",                                 # CVE-2026-42311: PSD RCE; CVE-2026-55379/55380/54060: font/GD DoS
     "h11>=0.16.0",
     "python-multipart>=0.0.20",                       # For fastapi Form
     "uvicorn>=0.34.0",                                # server