[devin-ai-integration]

Summary

Pillow 13.0.0 fixes CVE-2026-112900 (EPS filename passed to Ghostscript), CVE-2026-112403 (overflow in lossless JPEG thumbnails), CVE-2026-112393 (overflow when saving TIFF to a BytesIO buffer) and two JPEG/FPX overflows. Pillow isn't a direct dependency of the CDK; it comes in through unstructured, pdf2image, pytesseract and python-pptx. The lock stayed on 12.3.0 because none of those packages set a minimum Pillow version, Pillow 13 drops Python 3.10, and the CDK supports >=3.10.

This PR declares pillow as an optional dependency with a different constraint per Python version, and adds it to the file-based and vector-db-based extras:

pillow = [
  { version = ">=13.0.0", python = ">=3.11", optional = true },
  { version = ">=12.3.0,<13.0.0", python = "<3.11", optional = true },  # no patched release for 3.10
]

• Connectors resolve their dependencies from the CDK wheel's metadata, so after the next CDK release, any connector on Python 3.11+ that re-locks gets Pillow >=13.0.0. Python 3.10 has no patched Pillow release and stays on 12.x.
• pillow is added to the deptry DEP002 ignore list because the CDK never imports it.
• The lock was regenerated with Poetry 2.5.1, the same version that generated the lock on main. No other package versions changed; the remaining lock diff is Poetry reordering marker expressions.

How exposed the connectors were

In practice the exposure is low. Connector images (python-connector-base) don't ship gs (Ghostscript) or olefile. The CDK's unstructured parser only handles PDF, DOCX, PPTX and MD, and never calls thumbnail(), draft(), or saves TIFF to memory. This PR is mainly about scanner hygiene and defense in depth.

Test plan

• poetry check --lock passed.
• poetry install --all-extras on Python 3.12 gives PIL.__version__ == "13.0.0".
• poetry run deptry ., ruff check and ruff format --check passed.
• pytest unit_tests/sources/file_based: 295 passed, 1 failed. The failure (test_parse_start_date[date_only_ab_datetime_parse_fallback], an aware vs. naive datetime comparison) also happens on main and is unrelated to this change.

Follow-ups

After release, re-lock the file-based sources (s3, gcs, google-drive, sftp-bulk, sharepoint, onedrive) and the vector DB destinations. sharepoint and onedrive are still on CDK 6.x.

Requested by Oleksandr Bazarnov (Baz (@bazarnov)) and Patrick Nilan (Patrick Nilan (@pnilan)) in Slack.

Link to Devin session: https://app.devin.ai/sessions/983c13c1277044d599fbf2aa459e2982
Open in Devin Desktop: https://app.devin.ai/desktop/session/983c13c1277044d599fbf2aa459e2982?variant=devin

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

👋 Greetings, Airbyte Team Member!

Here are some helpful tips and reminders for your convenience.

💡 Show Tips and Tricks

Testing This CDK Version

You can test this version of the CDK using the following:

# Run the CLI from this branch:
uvx 'git+https://github.com/airbytehq/airbyte-python-cdk.git@devin/1793725734-pillow-13#egg=airbyte-python-cdk[dev]' --help

# Update a connector to use the CDK from this branch ref:
cd airbyte-integrations/connectors/source-example
poe use-cdk-branch devin/1793725734-pillow-13

PR Slash Commands

Airbyte Maintainers can execute the following slash commands on your PR:

• /autofix - Fixes most formatting and linting issues
• /poetry-lock - Updates poetry.lock file
• /test - Runs connector tests with the updated CDK
• /prerelease - Triggers a prerelease publish with default arguments
• /poe build - Regenerate git-committed build artifacts, such as the pydantic models which are generated from the manifest JSON schema in YAML.
• /poe <command> - Runs any poe command in the CDK environment

📚 Show Repo Guidance

Helpful Resources

• CDK API Reference

📝 Edit this welcome message.

[github-actions]

PyTest Results (Fast)

6 306 tests  ±0   6 285 ✅ +1   6m 57s ⏱️ +32s
    1 suites ±0      21 💤  - 1 
    1 files   ±0       0 ❌ ±0 

Results for commit 2b565d0. ± Comparison against base commit 664e4dc.

♻️ This comment has been updated with latest results.

[github-actions]

PyTest Results (Full)

6 309 tests   6 287 ✅  9m 20s ⏱️
    1 suites     22 💤
    1 files        0 ❌

Results for commit 2b565d0.

♻️ This comment has been updated with latest results.