security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-45hq-cxwh-f6vc	pillow	None	12.0.0	12.3.0		confirmed

Not Included

• Deferred by batch limit: 152 advisories. They will be considered by future runs.
• Other deferred scanner findings: 716.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	al.essio.dev/pkg/shellescape	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	atomicgo.dev/cursor	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	atomicgo.dev/keyboard	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	atomicgo.dev/schedule	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/Masterminds/semver/v3	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/boyter/gocodewalker	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/charmbracelet/colorprofile	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/charmbracelet/fang	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/charmbracelet/lipgloss/v2	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/charmbracelet/x/ansi	Non-CVE alert is not handled by dependency remediation.
...	...	706 additional items omitted from PR body. See workflow artifacts for full details.

---

Note

Low Risk
Template-only lockfile updates for a known Pillow advisory; the large kernel jump in one template is dependency resolution only but worth a quick smoke test of that sample app.

Overview
Addresses GHSA-45hq-cxwh-f6vc by pinning resolved Pillow from 12.0.0 to 12.3.0 in the browser-use and openagi-computer-use sample templates’ uv.lock files (lock revision incremented where applicable).

For openagi-computer-use, the lockfile also moves the resolved kernel package from 0.23.0 to 0.92.0 and updates the locked project metadata so kernel is required at >=0.35.0 (was >=0.22.0 in the lock). No application source changes—only dependency resolution artifacts for those templates.

^{Reviewed by Cursor Bugbot for commit 79d3723. Bugbot is set up for automated code reviews on this repo. Configure here.}

[ulziibay-kernel]

Verified the bump against the advisory's first patched version; rebuilt on current main and confirmed the toolchain lock/build is clean. CI green.