From 57999570b651363726cba7607666871cda0361fa Mon Sep 17 00:00:00 2001
From: Vito Sansevero <vito.sansevero@gmail.com>
Date: Sun, 1 Nov 2026 08:10:45 -0800
Subject: [PATCH] chore(deps): match ComfyUI's Pillow, aiohttp and numpy floors
 (#604)

PromptManager never fights ComfyUI on versions: the floors follow its
requirements.txt and Dependabot no longer raises them. The full suite passes on
Pillow 10.1.0 and aiohttp 3.11.8; numpy was tested at 1.26.4, the first with
Python 3.12 wheels. A test that left response bodies unread hung the aiohttp
client before 3.11.11, so it reads them now.
---
 .github/dependabot.yml | 5 +++++
 pyproject.toml         | 2 +-
 requirements-dev.txt   | 8 ++++----
 requirements.txt       | 2 +-
 tests/test_api_core.py | 2 ++
 5 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ec57ad7b..5f45ca92 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -17,6 +17,11 @@ updates:
       prefix: "deps(pip)"
       include: "scope"
     rebase-strategy: "auto"
+    # These floors follow ComfyUI's requirements.txt, never the newest release.
+    ignore:
+      - dependency-name: "Pillow"
+      - dependency-name: "aiohttp"
+      - dependency-name: "numpy"
     # Optional: group non-breaking updates to reduce PR noise
     groups:
       python-minor-and-patch:
diff --git a/pyproject.toml b/pyproject.toml
index 7a065ad3..befbeaad 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ description = "A powerful ComfyUI custom node that extends the standard text enc
 version = "3.4.1"
 license = {file = "LICENSE"}
 requires-python = ">=3.12"
-dependencies = ["watchdog>=2.1.0", "Pillow>=8.0.0"]
+dependencies = ["watchdog>=2.1.0", "Pillow>=10.1.0"]
 
 [build-system]
 requires = ["setuptools>=84.2.1"]
diff --git a/requirements-dev.txt b/requirements-dev.txt
index 6db215e2..325ba00a 100644
--- a/requirements-dev.txt
+++ b/requirements-dev.txt
@@ -1,11 +1,11 @@
-# Runtime dependencies
+# Runtime dependencies (Pillow, aiohttp and numpy floors match ComfyUI requirements.txt)
 watchdog>=6.0.0
-Pillow>=12.3.0
-aiohttp>=3.14.5
+Pillow>=10.1.0
+aiohttp>=3.11.8
 
 # Tests and coverage
 coverage>=7.16.2
-numpy>=2.2.6  # WD14 engine tests
+numpy>=1.25.0  # WD14 engine tests
 
 # Code quality
 black==26.10.1
diff --git a/requirements.txt b/requirements.txt
index 550aff47..ec9a3a77 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,4 +1,4 @@
 # Runtime dependencies for PromptManager.
 # aiohttp, numpy and torch come from ComfyUI itself and are not listed here.
 watchdog>=2.1.0               # Output directory monitoring
-Pillow>=8.0.0                # Image metadata extraction and thumbnails
+Pillow>=10.1.0               # Image metadata extraction and thumbnails
diff --git a/tests/test_api_core.py b/tests/test_api_core.py
index 96f17862..087fa3c9 100644
--- a/tests/test_api_core.py
+++ b/tests/test_api_core.py
@@ -796,6 +796,7 @@ class TestRevalidatedCachingBehindMiddlewares(CoreRoutesTestCase):
             self.assertEqual(resp.status, 200, path)
             self.assertEqual(resp.headers.get("Content-Encoding"), "gzip", path)
             self.assertEqual(resp.headers["Cache-Control"], "no-cache", path)
+            await resp.read()  # aiohttp before 3.11.11 hangs on an unread body
             again = await self.client.request(
                 "GET",
                 path,
@@ -806,6 +807,7 @@ class TestRevalidatedCachingBehindMiddlewares(CoreRoutesTestCase):
             )
             self.assertEqual(again.status, 304, path)
             self.assertEqual(again.headers["Cache-Control"], "no-cache", path)
+            await again.read()
 
 
 # ── instance helpers ──────────────────────────────────────────────────