fix(deps): require secure Pillow release

[paul-cch]

Summary

• Raise the minimum supported Pillow version from 10.0 to 12.2.0.
• Record the dependency security maintenance in the Unreleased changelog.

Why

The old lower bound allowed installations to retain Pillow releases affected by current image-processing advisories. Pillow 12.2.0 is the lowest release that clears the full current advisory set reviewed for this dependency:

• GHSA-pwv6-vv43-88gr
• GHSA-r73j-pqj5-w3x7
• GHSA-wjx4-4jcj-g98j
• GHSA-5xmw-vc9v-4wf2
• GHSA-whj4-6x5x-4v2j
• GHSA-cfh3-3jmp-rvhc

Pillow 12.2.0 supports Python 3.10 and newer. WalBridge already requires Python 3.11 or newer, so this does not raise the project's Python requirement.

Validation

• Fresh Python 3.11 virtual environment resolved Pillow 12.3.0 and PyObjC Quartz 12.2.1 from requirements.txt; pip check passed.
• Full unit suite passed, 73 tests.
• CLI flow suite passed, 8 tests.
• Ruff, Bash syntax, and ShellCheck passed.
• Quartz import and display detection passed on macOS.
• Both Swift tools compiled successfully.
• The installer deployed into a temporary home and produced the expected package, binaries, and LaunchAgent files. Local launchctl calls were neutralized to avoid changing the live user session.
• Structured Codex autoreview reported no accepted or actionable findings.

Risk

Low. The change only rejects older Pillow versions. Fresh installs already resolve a newer compatible release.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1f3876e0ac

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Enforce the Pillow floor in the installer path

For the production path recommended by the README (bash install.sh), this new requirement is never applied: install.sh only accepts any interpreter where import PIL succeeds (lines 140 and 165) and then writes that interpreter into the LaunchAgent. Users who already have Pillow 10.x/11.x and rerun the installer will still be accepted and continue processing wallpapers with the vulnerable Pillow version, so this dependency floor only protects environments that manually run pip install -r requirements.txt.

Useful? React with 👍 / 👎.

[paul-cch]

Landed as 26bdc274437cf2721c0ece3cdce135cd30059f30.

Validation completed before merge:

• Fresh resolution on Python 3.11: python3.11 -m venv <temp>/venv, python -m pip install --upgrade pip ruff, python -m pip install -r requirements.txt, and python -m pip check. The manifest resolved Pillow 12.3.0 and PyObjC Quartz 12.2.1.
• Full tests: python -m unittest discover -s tests -p 'test_*.py' -v, 73 passed.
• CLI flow tests: python -m unittest discover -s tests -p 'test_main_flow.py' -v, 8 passed.
• Python lint: ruff check --select F configs/wallpaper-colors/wcsync configs/wallpaper-colors/wallpaper_colors.py tests.
• Shell checks: the repository's full bash -n and shellcheck -S error command sets from CI.
• macOS boundary: Quartz imported successfully, display detection returned one display, and both Swift tools compiled with their production frameworks.
• Installer smoke: WTS_INSTALL_HOME=<temp>/install-home bash install.sh deployed the expected Python package, app binaries, and five LaunchAgent files. Local launchctl calls were replaced with /usr/bin/true, so this proof did not alter the live user session.
• Structured autoreview completed with the default Codex reviewer. Result: no accepted or actionable findings.

GitHub proof:

• PR CI passed all seven jobs: https://github.com/paul-cch/WalBridge/actions/runs/29375170856
• Exact-head main CI passed all seven jobs, including the unmodified macOS installer and Swift runtime smoke: https://github.com/paul-cch/WalBridge/actions/runs/29375246639

Public Model Identifier Gate: PASS. The exact diff, tests, CI logs, PR body, proof comment, and tracked artifacts contained no blocking identifiers or unknown generated artifacts.