[flowcool]

Behavior

Fix the 64 open Dependabot alerts in the documentation lock and label-tool requirements. Upgrade Pillow to 13.0.0, regenerate the complete Sphinx lock for Python 3.10, and add the two configured Sphinx extensions to the canonical input. Enable weekly grouped pip update PRs and an HTML documentation CI check.

Run image tests with Pillow 13 and the source/configuration tests with stable ESPHome 2026.10.0 in separate CI jobs. ESPHome 2026.10.0 still requires Pillow 12.3.0; upgrading it alone cannot remove that upstream pin. Adapt the API-wait harness to extract the new deferred argument type and use C++20. No firmware package or deployed system changes.

Verification

• Both environments pass dependency consistency checks. pip-audit --disable-pip --no-deps -r docs/requirements.txt -r examples/multi-device/label_maker/requirements.txt: 28 packages, no known vulnerabilities. All 64 original advisory ranges exclude the new pins.
• Image/tool discovery passes: 130 tests; 7 optional host-renderer skips and 3 ESPHome-dependent classes run separately. The latter pass all 15 scenarios on ESPHome 2026.10.0 (API boot, soil filters, package precedence).
• Generic label and all 7 fleet images are byte-identical before/after Pillow upgrade; substitutions are identical.
• sphinx-build -E -W --keep-going -b html docs/source tmp/docs-after passes without warnings on Python 3.10. Configured intersphinx fetches now have a 10-second timeout.
• Standalone ESPHome configuration and both public API/MQTT examples validate on 2026.10.0, using isolated synthetic inputs. No compile, upload or fleet action.
• Changed YAML parses. git -c core.whitespace=cr-at-eol diff --cached --check passes; existing CRLF in the documentation lock is preserved.

AI assistance

Codex implemented and checked this change. The author inspected the ESPHome implementation changes, dependency metadata, semantic diff, test results, image output and audit results.

Review

Pullfrog is the sole reviewer under the current operator policy. CI and a completed review of the current head are required before merge.

Recovery

Revert this source change through a PR to V2R1. Scope: local tooling, documentation and CI only.

Tracking: infra-3rr.83.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: flowcool/Smart&#95;Plant
• Branch: fix/dependabot-python
• File: .coderabbit.yaml
• Commit: 9571255
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: a3b323a0-54d4-4b82-b5ba-41731669e20a

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}