What's changed

🛡️ Security fixes

• 🔴 Critical - Upgraded Pillow
  Pillow: Heap buffer overflow in ImagingJpegDecode
  Closure reason: Fixed (#364)
  
  
• 🟠 High - Upgraded tornado
  Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
  Closure reason: Fixed (#15)
  
  
• 🟠 High - Upgraded aiohttp
  aiohttp server lacks an initial request/header timeout
  Closure reason: Fixed (#298)
  
  
• 🟠 High - Upgraded aiohttp
  aiohttp: Multiple instances of excessive or unbounded memory/CPU use
  Closure reason: Fixed (#299)
  
  
• 🟠 High - Upgraded Pillow
  Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
  Closure reason: Fixed (#365)
  
  
• 🟠 High - Upgraded pillow
  Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
  Closure reason: Fixed (#367)
  
  
• 🟠 High - Upgraded Pillow
  Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
  Closure reason: Fixed (#368)
  
  
• 🟠 High - Upgraded Pillow
  Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
  Closure reason: Fixed (#369)
  
  
• 🟠 High - Upgraded Pillow
  Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
  Closure reason: Fixed (#371)
  
  
• 🟠 High - Upgraded Pillow
  Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
  Closure reason: Fixed (#372)
  
  
• 🟠 High - Upgraded graphql-core
  GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule
  Closure reason: Fixed (#457)
  
  
• 🟠 High - Upgraded graphql-core
  GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit
  Closure reason: Fixed (#458)
  
  
• 🟠 High - Upgraded nbconvert
  nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc
  Closure reason: Fixed (#456)
  
  
• 🟠 High - Upgraded msgpack
  MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
  Closure reason: Fixed (#543)
  
  
• 🟠 High - Upgraded oauthlib
  OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow
  Closure reason: Fixed (#591)
  
  
• 🟡 Moderate - Upgraded tornado
  tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)
  Closure reason: Fixed (#14)
  
  
• 🟡 Moderate - Upgraded aiohttp
  AIOHTTP: Secure attribute not enforced for shared cookie
  Closure reason: Fixed (#297)
  
  
• 🟡 Moderate - Upgraded pillow
  Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)
  Closure reason: Fixed (#366)
  
  
• 🟡 Moderate - Upgraded Pillow
  Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit
  Closure reason: Fixed (#370)
  
  
• 🟡 Moderate - Upgraded opentelemetry-api
  OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api
  Closure reason: Fixed (#455)
  
  
• 🟡 Moderate - Upgraded tornado
  Tornado: Quadratic CPU usage when parsing HTTP headers with line folding
  Closure reason: Fixed (#574)
  
  
• 🟡 Moderate - Upgraded tornado
  Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks
  Closure reason: Fixed (#576)
  
  
• 🟡 Moderate - Upgraded joserfc
  joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection
  Closure reason: Fixed (#589)
  
  
• ⚪ Low - Upgraded tornado
  Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`
  Closure reason: Fixed (#13)
  
  
• ⚪ Low - Upgraded ipython
  IPython vulnerable to command injection via set_term_title
  Closure reason: Fixed (#279)
  
  
• ⚪ Low - Upgraded tornado
  Tornado: Open redirect in RedirectHandler via protocol-relative URLs
  Closure reason: Fixed (#575)
  
  

✨ Features

• feat: update the visor client end points by @ansBAkula in #472
• feat: Add visor end points for access from PIM visor client by @ansBAkula in #405

📚 Documentation

• docs: Update contributor section by @iazehaf in #238
• docs: set default theme to dark by @anskfletcher in #67
• docs: Fix API reference docs by @iazehaf in #63
• docs: update corporate logo in centralized and package api documentation by @anskfletcher in #55

🏗️ Build

• build(deps): upgrade pyjwt,authlib,urllib3,virtualenv by @alexciurana in #184
• build(deps): Upgrade anyio >= 4.15 by @alexciurana in #76

♾️ CI

• ci(feat): enable Codecov Test Analytics by @vgelbgras in #454
• ci(refactor): improve ci for documentation by @vgelbgras in #255
• ci(feat): convert saf-cli to moon by @vgelbgras in #234
• ci(feat): convert glow-engine to moon by @vgelbgras in #214
• ci(feat): convert saf product manager by @vgelbgras in #179

🧹 Chores

• chore: update joserfc by @vgelbgras in #411
• chore: update authlib msgpack dnspython fastmcp mcp by @vgelbgras in #386
• chore: update ipython by @vgelbgras in #372