chore(deps): pillow 13.0.0 and certifi 2026.10.19, multidict floor 6.9.1 (pip-audit findings); locks regenerated for these packages only

requirements-typecheck.lock

@@ -42,7 +42,7 @@ basedpyright==1.40.2
     # via -r requirements-typecheck.txt
 bcrypt==5.0.0
     # via -r requirements.lock
-certifi==2026.7.22
+certifi==2026.10.19
     # via
     #   -r requirements.lock
     #   curl-cffi
@@ -160,7 +160,7 @@ paho-mqtt==2.1.0
     # via -r requirements.lock
 passlib==1.7.4
     # via -r requirements.lock
-pillow==12.3.0
+pillow==13.0.0
     # via
     #   -r requirements.lock
     #   matplotlib

requirements.lock

@@ -29,7 +29,7 @@ attrs==26.1.0
     # via aiohttp
 bcrypt==5.0.0
     # via passlib
-certifi==2026.7.22
+certifi==2026.10.19
     # via
     #   -r requirements.txt
     #   curl-cffi
@@ -104,6 +104,7 @@ matplotlib==3.11.2
     # via -r requirements.txt
 multidict==6.9.1
     # via
+    #   -r requirements.txt
     #   aiohttp
     #   yarl
 networkx==3.6.1 ; python_full_version < '3.12'
@@ -138,7 +139,7 @@ paho-mqtt==2.1.0
     # via -r requirements.txt
 passlib==1.7.4
     # via -r requirements.txt
-pillow==12.3.0
+pillow==13.0.0
     # via
     #   -r requirements.txt
     #   matplotlib

requirements.txt

@@ -116,6 +116,10 @@ pyotp>=2.9.0
 # so we don't regress when a downstream loosens its constraint.
 idna>=3.15
 
+# Transitive dep pin (aiohttp, yarl): the floor clears a pip-audit finding
+# (PYSEC-2026-4244) in older releases.
+multidict>=6.9.1
+
 # HTTP client (used for OIDC token exchange)
 httpx>=0.26.0
 
@@ -124,7 +128,7 @@ httpx>=0.26.0
 # same trust store httpx uses — the Windows OS store lacks the Amazon root
 # until CryptoAPI lazily caches it (#2562). Declared explicitly so a future
 # httpx release that drops certifi can't silently break that import.
-certifi>=2024.2.2
+certifi>=2026.10.19
 
 # HTTP client with browser TLS-fingerprint impersonation. Used only for
 # the bambulab.com firmware-download page in services/firmware_check.py:
@@ -168,4 +172,4 @@ httpx>=0.26.0
 # importable for anyone who installs the runtime file alone.
 ruff>=0.8.0
 
-pillow>=12.2.0
+pillow>=13.0.0