chore(deps): match ComfyUI's Pillow, aiohttp and numpy floors (#604)

PromptManager never fights ComfyUI on versions: the floors follow its
requirements.txt and Dependabot no longer raises them. The full suite passes on
Pillow 10.1.0 and aiohttp 3.11.8; numpy was tested at 1.26.4, the first with
Python 3.12 wheels. A test that left response bodies unread hung the aiohttp
client before 3.11.11, so it reads them now.

.github/dependabot.yml

@@ -17,6 +17,11 @@ updates:
       prefix: "deps(pip)"
       include: "scope"
     rebase-strategy: "auto"
+    # These floors follow ComfyUI's requirements.txt, never the newest release.
+    ignore:
+      - dependency-name: "Pillow"
+      - dependency-name: "aiohttp"
+      - dependency-name: "numpy"
     # Optional: group non-breaking updates to reduce PR noise
     groups:
       python-minor-and-patch:

pyproject.toml

@@ -4,7 +4,7 @@ description = "A powerful ComfyUI custom node that extends the standard text enc
 version = "3.4.1"
 license = {file = "LICENSE"}
 requires-python = ">=3.12"
-dependencies = ["watchdog>=2.1.0", "Pillow>=8.0.0"]
+dependencies = ["watchdog>=2.1.0", "Pillow>=10.1.0"]
 
 [build-system]
 requires = ["setuptools>=84.2.1"]

requirements-dev.txt

@@ -1,11 +1,11 @@
-# Runtime dependencies
+# Runtime dependencies (Pillow, aiohttp and numpy floors match ComfyUI requirements.txt)
 watchdog>=6.0.0
-Pillow>=12.3.0
-aiohttp>=3.14.5
+Pillow>=10.1.0
+aiohttp>=3.11.8
 
 # Tests and coverage
 coverage>=7.16.2
-numpy>=2.2.6  # WD14 engine tests
+numpy>=1.25.0  # WD14 engine tests
 
 # Code quality
 black==26.10.1

requirements.txt

@@ -1,4 +1,4 @@
 # Runtime dependencies for PromptManager.
 # aiohttp, numpy and torch come from ComfyUI itself and are not listed here.
 watchdog>=2.1.0               # Output directory monitoring
-Pillow>=8.0.0                # Image metadata extraction and thumbnails
+Pillow>=10.1.0               # Image metadata extraction and thumbnails

tests/test_api_core.py

@@ -796,6 +796,7 @@ class TestRevalidatedCachingBehindMiddlewares(CoreRoutesTestCase):
             self.assertEqual(resp.status, 200, path)
             self.assertEqual(resp.headers.get("Content-Encoding"), "gzip", path)
             self.assertEqual(resp.headers["Cache-Control"], "no-cache", path)
+            await resp.read()  # aiohttp before 3.11.11 hangs on an unread body
             again = await self.client.request(
                 "GET",
                 path,
@@ -806,6 +807,7 @@ class TestRevalidatedCachingBehindMiddlewares(CoreRoutesTestCase):
             )
             self.assertEqual(again.status, 304, path)
             self.assertEqual(again.headers["Cache-Control"], "no-cache", path)
+            await again.read()
 
 
 # ── instance helpers ──────────────────────────────────────────────────