[unlockdigital]

Merge the Pillow security branch into Unlock Digital's main, preserving its existing reader UI, native recording controls and desktop model-loading changes. The local trial merge is clean and changes only the six security-patch files. The complete web tree matches fork main; the API tree matches the tested security branch.

The patch pins Pillow 13.0.0 and compatible FastEmbed 0.9.1, requires published Pillow wheels carrying the OpenJPEG backport, adds ten bounded generated regression cases, updates dependency notices and pins the browser jobs to supported Ubuntu 24.04. Advisory links: GHSA-wqgw-9xfh-qf2g, GHSA-78g4-xqwv-q3g8.

Validation for the fork combination:

• Clean local merge; existing fork commits and all web files preserved; API tree identical to tested security head 0534492.
• Combined-fork local validation passed: clean Node 22 install, 234 unit tests, production build, production/full dependency audits with zero findings, all six generated Chromium regressions, public-fixture boundary and its four guard tests.
• The security branch has passed all four CI jobs. The fork PR runs its own four jobs against the verified combined merge tree; those results gate the merge.
• Schema, application data contracts and hosted deployment remain unchanged by this source merge.

The owner explicitly authorized merging this security work into the fork after successful verification. Upstream PR #18 retains its focused patch and its separate Lab review/merge process.