[Rob142857]

Summary

Upgrade sweep (22 Oct 2026) for ImageProcessorPro. Not merged, nothing released. Desktop/CLI tool, no deploy; release is a local PyInstaller build.

From -> to (exact pins)

package	from	to
Pillow	12.3.0	13.0.0 (major)
PyMuPDF	1.28.0	2.0 (major)
customtkinter	5.2.2	6.0.0 (major)
azure-storage-blob	12.30.0	12.31.0
azure-identity	1.25.1	1.26.0
azure-cognitiveservices-vision-computervision (vision-legacy extra)	0.9.0	0.9.1
pyinstaller (build extra)	6.19.0	6.22.3
pytest	9.0.3	9.1.1
pytest-cov	7.0.0	7.1.0
pip-audit	2.10.0	2.10.1
PyYAML 6.0.3, loguru 0.7.3, Flask 3.1.3	already latest	-
actions/checkout	v5	v7
actions/setup-python	v6	v7

Code change: import fitz -> import pymupdf in src/image_processor.py (PyMuPDF 2.0 deprecates the fitz name with a FutureWarning; pymupdf also works on 1.2x).

Derivative output check (the gate for the three majors)

Script ran the real ImageProcessor on 8 generated fixtures (large EXIF-rotated JPEG, portrait PNG, RGBA PNG, CMYK JPEG, gray PNG, WebP, TIFF, 2-page PDF) across 6 configs (JPEG/PNG/WEBP, text watermark, tiled watermark file, both, metadata safe/preserve), old venv (Pillow 12.3.0 + PyMuPDF 1.28.0) vs new venv (13.0.0 + 2.0). Recorded per output: mode, size, decoded-pixel sha256, ICC hash, EXIF presence, file sha256, byte size.
Result: 54 of 54 outputs byte-identical (file sha256 equal), 48/48 process calls ok in both. Nothing deferred.
One caveat found while comparing: ImageCms.createProfile("sRGB") stamps the current time into the profile header, so embedded ICC bytes (and output file hashes) differ between any two processes. That is existing behaviour, not caused by Pillow 13. The comparison zeroed that 12-byte date field in both runs. Worth a follow-up (not done here): derivative file hashes are not reproducible across runs because of it.

Gates

• fresh venv, pip install -r requirements-dev.txt + pyinstaller 6.22.3: ok (Python 3.13.3)
• pytest: 17/17 pass (baseline 17/17)
• GUI smoke: ImageProcessorGUI() builds under customtkinter 6.0.0 and shows the first tab; py_compile of gui_app.py, cli.py, build_app.py ok
• pip-audit --skip-editable: only finding is the venv's own pip 25.0.1 (CI upgrades pip first)
• All pinned packages declare Python >=3.11 or lower, so the 3.11/3.12/3.13 CI matrix stays valid. Only 3.13 was run locally; CI will run 3.11 and 3.12.
• Not verified: an actual PyInstaller build (build_windows.bat). pyinstaller 6.22.3 installs; run the build before cutting a release.
• Note: PyMuPDF 2.0 also installs pymupdf_layout and pymupdf4llm as dependencies (comes from PyMuPDF itself).

Deploy plan

None needed. After merge: rebuild the Windows/macOS app with the build scripts when a release is wanted.

🤖 Generated with Claude Code