[Edwardvaneechoud]

What

Closes the remaining Dependabot alert on pillow in kernel_runtime/poetry.lock.

The fixes exist only in Pillow 13.0.0, which requires Python 3.11. Because kernel_runtime supports Python 3.10, the lock kept a second pillow 12.3.0 entry for 3.10. Dependabot flags that entry, so the alert stayed open after #853.

Changes

• kernel_runtime/pyproject.toml: limit the test extra's matplotlib (Pillow's only dependent) to python >= 3.11. The published kernel images run Python 3.12 and don't install the test extra, so the images don't change.
• kernel_runtime/poetry.lock: re-locked. The only change is that pillow 12.3.0 is dropped and 13.0.0 stays.
• Kernel version bumped to 0.6.4: kernel_runtime version and __version__, the images.py pins, and the regenerated kernel_image_manifest.json. 0.6.3 is already on Docker Hub, so a lock change without a bump fails the kernel release guard.

Testing

• pip-audit on the new kernel lock: no known vulnerabilities.
• tools/check_kernel_version_sync.py: pins in sync at 0.6.4.
• poetry check --lock passes for kernel_runtime.
• pytest tools/tests (18 passed) and pytest flowfile_core/tests/kernel -m "not kernel and not docker_integration" (26 passed).

---

Generated by Claude Code

[netlify]

✅ Deploy Preview for flowfile-wasm canceled.

Name	Link
🔨 Latest commit	c4a262e
🔍 Latest deploy log	https://app.netlify.com/projects/flowfile-wasm/deploys/6addb77fc5b47f8e0f1099b3

[claude]

Claude finished @Edwardvaneechoud's task in 19s —— View job

---

Review of PR #854

Verdict: looks good, with one minor note.

The change does what it says:

• matplotlib in the test extra is now limited to python >= 3.11. It is Pillow's only dependent, so the 3.10-only pillow 12.3.0 lock entry goes away and 13.0.0 stays.
• The kernel version is bumped to 0.6.4 consistently across pyproject.toml, __init__.py, the three images.py pins and the manifest JSON. That is required, because 0.6.3 is already published and a lock change without a bump would fail the kernel release guard.
• The published images run Python 3.12 and don't install the test extra, so their contents don't change.

Minor note

• kernel_runtime/tests/test_artifact_preview.py imports matplotlib directly and has no importorskip. Anyone running the kernel tests on Python 3.10 with --extras test now gets no matplotlib, so those tests fail with ModuleNotFoundError instead of skipping. CI uses 3.11 (test-kernel-integration.yml:46), so it isn't affected. Two small options:
  • Guard those tests with pytest.importorskip("matplotlib").
  • Mention in the pyproject.toml comment or the contributor docs that kernel tests need Python 3.11 or newer.
• The trailing comment on the matplotlib line is a bit long for the repo's one-line-comment convention. It is acceptable here, since the reason isn't obvious from the code.

I ran no tests myself. I read the diff and checked how matplotlib is used in kernel_runtime.