Bump the uv group across 1 directory with 3 updates

[dependabot]

Bumps the uv group with 3 updates in the /pnl directory: aiohttp, idna and pillow.

Updates aiohttp from 3.13.5 to 3.14.1

Changelog

Sourced from aiohttp's changelog.

3.14.1 (2026-06-07)

Bug fixes

• Fixed a race condition in :py:class:~aiohttp.TCPConnector where closing the connector while a DNS resolution was in-flight could raise :py:exc:AttributeError instead of :py:exc:~aiohttp.ClientConnectionError -- by :user:goingforstudying-ctrl.

  Related issues and pull requests on GitHub: :issue:12497.

• Fixed CancelledError not closing a connection -- by :user:aiolibsbot.

  Related issues and pull requests on GitHub: :issue:12795.

• Tightened up some websocket parser checks -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub: :issue:12817.

• Fixed :class:~aiohttp.CookieJar dropping the host-only flag of cookies when persisted with :meth:~aiohttp.CookieJar.save and reloaded with :meth:~aiohttp.CookieJar.load, so a cookie set without a Domain attribute is again scoped to the exact host that set it after a reload; the absolute expiration deadline is now persisted as well, so a reloaded cookie keeps its original lifetime instead of being rescheduled from the load time. :meth:~aiohttp.CookieJar.load now replaces the jar contents rather than merging onto prior state, and loaded cookies pass through the same acceptance rules as :meth:~aiohttp.CookieJar.update_cookies, so a cookie for an IP-address host is dropped when loaded into a jar created without unsafe=True -- by :user:bdraco.

  Related issues and pull requests on GitHub: :issue:12824.

• Scoped :class:~aiohttp.DigestAuthMiddleware credentials to the origin of the first request it handles, so a redirect to a different origin no longer triggers a digest response computed from the configured credentials; a challenge from another origin is only answered when that origin falls within a protection space advertised by the anchor origin through the RFC 7616 domain directive -- by :user:bdraco.

  Related issues and pull requests on GitHub: :issue:12825.

• Fixed the C HTTP parser not enforcing max_line_size on a request target or response reason phrase that is split across multiple reads; each fragment was checked on its own, so an accumulated line could exceed the limit without raising LineTooLong. The accumulated length is now checked, matching the pure-Python parser -- by :user:bdraco.

  Related issues and pull requests on GitHub:

... (truncated)

Commits

• 9c35d03 Release v3.14.1 (#12864)
• 38b956c [PR #12861/59684b5c backport][3.14] Revert "Drop list compression (#12857)" (...
• 8f31009 [PR #12857/69dff14d backport][3.14] Drop list compression (#12858)
• dfdfa9d [PR #12830/93a2b1c3 backport][3.14] Bound pipelined request queue per connect...
• 0e9cedd [PR #12827/ccf218ab backport][3.14] Numeric ipv4 resolver bypass (#12849)
• a762eda [PR #12831/1ac92dae backport][3.14] Payload close on disconnect (#12843)
• a329a7a [PR #12824/60b85e98 backport][3.14] Preserve host-only cookie scope across Co...
• 4f7480e [PR #12828/13b635d7 backport][3.14] Bounded unread compressed drain (#12845)
• 5ab61bb [PR #12826/36df6c13 backport][3.14] Enforce max_line_size on fragmented reque...
• 3912667 [3.14] Add test that env proxy auth is scoped to the redirect-selected proxy ...
• Additional commits viewable in compare view

Updates idna from 3.13 to 3.15

Changelog

Sourced from idna's changelog.

3.15 (2026-05-12)

• Enforce DNS-length cap on individual labels early in check_label, short-circuiting contextual-rule processing for oversized input while staying compatible with UTS 46 usage.
• Tidy core helpers: hoist bidi category sets to module-level frozensets (avoiding per-codepoint list construction), simplify length checks, and reuse the shared _unicode_dots_re from idna.core in the codec module.
• Use raise ... from err for proper exception chaining and switch internal string formatting to f-strings.
• Allow flit_core 4.x in the build backend.
• Expand the ruff lint set (flake8-bugbear, flake8-simplify, pyupgrade, perflint) and apply the surfaced fixes; pin lint CI to Python 3.14.
• Add Dependabot configuration for GitHub Actions.
• Convert README and HISTORY from reStructuredText to Markdown.
• Reference CVE-2026-45409 for the 3.14 advisory in place of the initial GHSA identifier.

Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for contributions to this release.

3.14 (2026-05-10)

• Removed opportunity to process long inputs into quadratic time by rejecting oversize inputs up-front. Closes a bypass of the CVE-2024-3651 mitigation. [CVE-2026-45409]

Thanks to Stan Ulbrych for reporting the issue.

Commits

• af30a09 Release 3.15
• 30314d4 Pre-release 3.15rc0
• 05d4b21 Merge pull request #237 from kjd/convert-docs-to-markdown
• 2987fdb Convert README and HISTORY from reStructuredText to Markdown
• 59fa800 Merge pull request #236 from kjd/dependabot/github_actions/actions-f3e34333ea
• def6983 Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea
• bbd8004 Merge pull request #234 from StanFromIreland/patch-1
• edd07c0 Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group
• 5557db0 Merge branch 'master' into patch-1
• f11746c Merge pull request #235 from StanFromIreland/patch-2
• Additional commits viewable in compare view

Updates pillow from 12.2.0 to 12.3.0

Release notes

Sourced from pillow's releases.

12.3.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html

Removals

• Remove non-image ImageCms modes #9697 [@​radarhere]

Documentation

• Add release notes for SBOM and performance improvements #9747 [@​radarhere]
• Add security release notes #9741 [@​radarhere]
• Add release notes for Python 3.15 beta wheels #9696 [@​radarhere]
• ImageFont can also be used with ImageText #9597 [@​radarhere]
• Additional guidelines for security reports #9659 [@​wiredfool]
• Fixed typo #9636 [@​radarhere]
• Added CVEs to 12.2.0 release notes #9591 [@​radarhere]
• Revise development support information in README #9583 [@​aclark4life]
• Add INCIDENT_RESPONSE.md #9555 [@​aclark4life]
• Add STRIDE threat model to security docs #9562 [@​aclark4life]
• Add CVEs to 12.2.0 release notes #9556 [@​radarhere]
• Update README with revised security policy #9553 [@​radarhere]
• Update security policy #9552 [@​aclark4life]
• Update macOS tested Python versions #9534 [@​radarhere]

Dependencies

• Update dependency harfbuzz to v14.2.1 #9720 [@renovate[bot]]
• Update dependency mypy to v2 #9653 [@renovate[bot]]
• Update dependency cibuildwheel to v4 #9665 [@renovate[bot]]
• Update github-actions #9655 [@renovate[bot]]
• Update dependency libavif to v1.4.2 #9652 [@renovate[bot]]
• Update dependency lcms2 to v2.19.1 #9651 [@renovate[bot]]
• Update dependency check-jsonschema to v0.37.2 #9650 [@renovate[bot]]
• Update google/oss-fuzz digest to d872252 #9614 [@renovate[bot]]
• Update dependency lcms2 to v2.19 #9609 [@renovate[bot]]
• Update dependency libpng to v1.6.58 - autoclosed #9608 [@renovate[bot]]
• Update dependency harfbuzz to v14 #9610 [@renovate[bot]]
• Update dependency mypy to v1.20.2 #9599 [@renovate[bot]]
• Update github-actions #9611 [@renovate[bot]]
• Update dependency cibuildwheel to v3.4.1 #9607 [@renovate[bot]]
• Move dependency versions to single JSON and enable Renovate #9559 [@​hugovk]
• Updated raqm to 0.10.5 #9557 [@​radarhere]
• Update dependency cibuildwheel to v3.4.0 #9532 [@renovate[bot]]

Testing

• Remove matrix.os from benchmark #9735 [@​radarhere]
• Remove references to libavif patch #9734 [@​radarhere]
• Add benchmark tests #9654 [@​akx]
• Use reshape() instead of setting NumPy array shape directly #9728 [@​radarhere]

... (truncated)

Commits

• bb1d8e8 12.3.0 version bump
• e63fc48 Add release notes for SBOM and performance improvements (#9747)
• 13b701b Add release notes for #9679
• 5564ca7 List methods
• a0920fd Speed up ImageChops operations (#9738)
• 07e9a6c Speed up Image.filter() (#9736)
• a94578c Speed up Image.getchannel(), Image.merge(), Image.putalpha() and `Image...
• 53e02c4 Speed up Image.fill(), Image.linear_gradient() and `Image.radial_gradient...
• af03747 Speed up Image.resample() (#9739)
• 5c9ca56 Speed up alpha_composite, matrix, negative, quantize (#9740)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.