fix(deps): bump pillow to 12.3.0 for VULN-88808

[shuningc]

Summary

• Remediate VULN-88808: FITS GZIP decompression bomb in Pillow ≤12.1.1 (fix in 12.2.0+).
• poetry.lock: pillow 11.3.0 → 12.3.0 (transitive; no pyproject change).

Test plan

• poetry check
• Installed pillow 12.3.0; poetry run pytest tests/ (1988 passed, 10 skipped)

Jira

VULN-88808

[etserend]

Code Review — AI-Assisted Feedback

Reviewed by Claude Code (Claude Opus), automated review to assist human reviewers.

Verdict: Approve with comments

Lock-only security bump. One Python version floor change worth confirming below.

---

P2 — pillow 12.x raises Python floor to >=3.10 (Claude Code)

File/Section: poetry.lock (pillow package entry)
Issue: pillow 12.x drops Python 3.9 support — python-versions moves from >=3.9 to >=3.10. If the project still supports Python 3.9, the resolver would fail or silently skip pillow for 3.9 users under the crewai/all extras.
Evidence: Diff shows -python-versions = ">=3.9" → +python-versions = ">=3.10" in the pillow lock entry.
Recommended fix: Confirmed non-blocking — project requires python = "^3.11,<3.15" which already satisfies the new floor. No action needed.

---

Reviewer	Model	Key Contribution
Claude Code	Claude Opus	Flagged Python version floor change in pillow 12.x