* chore(deps): match ComfyUI's Pillow, aiohttp and numpy floors (#604)
PromptManager never fights ComfyUI on versions: the floors follow its
requirements.txt and Dependabot no longer raises them. The full suite passes on
Pillow 10.1.0 and aiohttp 3.11.8; numpy was tested at 1.26.4, the first with
Python 3.12 wheels. A test that left response bodies unread hung the aiohttp
client before 3.11.11, so it reads them now.
* test(thumbnails): the stalled store call test runs without the probe (#603)
note_failure() wakes the probe, which finds the healthy test folder again at
once, so the next lookup could do store I/O and the test failed intermittently.
- Add code-quality.yml: Black formatting check, flake8 linting, bandit
security scan
- Add dependabot.yml: weekly updates for pip deps and GitHub Actions
- Add requirements-dev.txt: single source of truth for CI dependencies
- Harden test.yml: add permissions, pip caching, use requirements-dev.txt
- Add Black/flake8/bandit config to pyproject.toml (line-length=88)
Vito