chore(security): Python dependency bumps

Pillow 12.2.0 → 12.3.0 — Security upgrade
- 11 CVEs patched, including a command injection in WindowsViewer.get_command() (CVE-2026-55798) via crafted filenames
- OOB reads/writes fixed in Image.paste(), Image.crop(), Image.alpha_composite(), and several format parsers
- New ImageGrab.grab(scale_down=) param for macOS Retina; up to 5.6× perf improvement on some ops

Django >=5.2.15 → >=5.2.16 — security patch, no breaking changes
- CVE-2026-48588: cache_page() could cache responses that set session cookies
- CVE-2026-53877/53878: GDAL heap over-read and DomainNameValidator header injection

sentry-sdk 2.59.0 → 2.66.1 — two behavioural changes to be aware of:
- 2.64.0: stream_gen_ai_spans is now on by default — GenAI spans sent as v2 envelope items. Self-hosted Sentry users should set stream_gen_ai_spans=False until their server supports v2 envelopes
- 2.61.0: String truncation in event payloads is now disabled by default (was silently capping long strings); re-enable with max_value_length=100_000
- Also: sensitive URL components now gated behind send_default_pii=True (aiohttp, boto3, httpx, etc.)

granian 2.7.6 → 2.7.9 — notable fixes, no breaking changes
- 2.7.9: Fixed WSGI threadpool scheduler bug causing resource starvation under long-running requests — important fix for Django in sync mode
- 2.7.7: Fixed memory leak in async application calls

wagtail-thumbnail-choice-block 0.2.0 → 0.3.0 — no breaking changes
- New optional thumbnail_is_one_color parameter; CSS/dark-mode styling fixes

google-cloud-storage 3.12.0 → 3.13.0 — additive async checksum improvements, no breaking changes

APScheduler 3.11.2 → 3.11.3 — fixes DST spring-forward stall for sub-minute jobs, no breaking changes

django-rq 4.1.0 → 4.1.1 — cron webhook support, RQ 2.10+ compat fix, no breaking changes

jq 1.11.0 → 1.12.0 — bundles jq 1.8.2 upstream engine, adds Windows wheels, no breaking changes

Wand 0.7.1 → 0.7.2 — fixes file-object offset sync bug (could silently misread images passed as file objects), no breaking changes

---
requirements/dev.in

pytest-rerunfailures 16.3 → 16.4 — minor breaking: drops pytest 8.1 support
- Minimum is now pytest 8.2 — your pinned pytest==9.1.1 is fine, no action needed
- Adds exponential backoff option and pytest 9.1 subtest rerun support

translate-toolkit 3.19.11 → 3.19.15 — ODF converter improvements, PO performance fixes, no breaking changes

selenium 4.45.0 → 4.46.0 — CDP v150 support, Safari/WebView2 routing fixes, no breaking changes

responses 0.26.1 → 0.26.2 — case-insensitive default header stripping fix, query_param_matcher mutation fix, no breaking changes

wagtail-factories 4.4.0 → 4.5.0 — Wagtail 7.4 compatibility only, no breaking changes

Author: stevejalim

requirements/dev.in

@@ -15,13 +15,13 @@ pytest-django==4.12.0
 pytest-html==4.2.0  # Provides the --html option used to generate the integration test report
 pytest-mock==3.15.1
 pytest-parallel==0.1.1
-pytest-rerunfailures==16.3
-responses==0.26.1
+pytest-rerunfailures==16.4
+responses==0.26.2
 ruff==0.15.18
-selenium==4.45.0
-translate-toolkit==3.19.11
+selenium==4.46.0
+translate-toolkit==3.19.15
 uv==0.11.23
-wagtail-factories==4.4.0
+wagtail-factories==4.5.0
 # Related to moz-l10n-lint, used in CI
 cl-ext.lang==0.1.0
 compare-locales==9.0.5