Fix CVE-2026-40192 — bump Pillow to >=12.2.0

[KrrishSR4]

Summary

Pin Pillow to >=12.2.0 to include the security fix for CVE-2026-40192. This prevents a decompression-bomb vulnerability in Pillow (affecting FITS image decoding) that can lead to unbounded memory consumption and denial-of-service (DoS).

What I Changed

• Added Pillow>=12.2.0 to:
  • requirements.txt
  • charts/requirements.txt

Why

Versions 10.3.0 through 12.1.1 of Pillow are vulnerable to decompression-bomb attacks when decoding GZIP-compressed FITS images. Upgrading to 12.2.0 addresses the vulnerability.

Security Impact

• Severity: High (CVE-2026-40192)
• Impact: Prevents unbounded memory growth and potential denial-of-service when processing malicious FITS images.
• Risk: Low — this is a dependency version bump to a security-patched release.

Testing & Validation

• Run the project CI and any local test suites covering image handling and chart generation.
• If dependency lockfiles are used (e.g., pip-tools, Poetry, or pinned requirements.txt hashes), regenerate and verify them as needed.

Notes

• A permissive constraint (>=12.2.0) was used to allow dependency resolution to select compatible newer releases. If a strict pin (==12.2.0) is preferred, I can update the PR.
• If the project vendors or pins transitive dependencies, lockfiles and container images may also need to be updated.

References

• Pillow Security Advisory: https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5xc4v2j
• CVE Entry: https://www.mend.io/vulnerability-database/CVE-2026-40192

Please add me as a contributor to this organization. I would really appreciate the opportunity to contribute more in the future. ❤️