Bound the OpenCV major and refresh pinned dependency versions

je_open_cv leaves opencv-python unpinned, so the OpenCV 5.0 release silently
changed cv2 return shapes and broke line/text-region detection for every fresh
install; an explicit `<6` bound stops the next major from doing the same.

Fold in the dependency bumps dependabot proposed against stale bases (pillow
12.3.0, pyobjc 12.2.1, ruff 0.15.22, pytest 9.1.1) and keep the versions the
workflows hardcode in sync with dev_requirements.txt. Pinning the CI tooling
installs also clears the SonarCloud githubactions:S8541/S8544 findings.

Author: JE-Chen

.github/workflows/platform-smoke.yml

@@ -22,6 +22,7 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
+      # NOSONAR githubactions:S8544  # reason: installs the checked-out project itself, there is no upstream version to lock
       - run: python -m pip install -e .
       # The X11 backend connects to a display at import time, so Linux
       # runs need a virtual one.

.github/workflows/quality.yml

@@ -37,9 +37,7 @@ jobs:
           cache: "pip"
 
       - name: Install ruff
-        run: |
-          python -m pip install --upgrade pip
-          pip install ruff
+        run: "pip install --only-binary :all: ruff==0.15.22"
 
       - name: Run ruff
         run: ruff check je_auto_control/
@@ -56,9 +54,7 @@ jobs:
           cache: "pip"
 
       - name: Install bandit
-        run: |
-          python -m pip install --upgrade pip
-          pip install bandit
+        run: "pip install --only-binary :all: bandit==1.9.4"
 
       - name: Run bandit (recursive, skip tests + i18n dicts)
         run: bandit -r je_auto_control/ -c pyproject.toml
@@ -90,7 +86,7 @@ jobs:
           # for any sub-package the snapshot doesn't include
           # (admin, usb, remote_desktop, vision, …).
           pip install -e .
-          pip install ruff==0.15.14 bandit==1.9.4 pytest==9.0.3 pytest-timeout==2.4.0 pytest-rerunfailures==15.1 pytest-cov==7.0.0 PySide6==6.11.1
+          pip install --only-binary :all: ruff==0.15.22 bandit==1.9.4 pytest==9.1.1 pytest-timeout==2.4.0 pytest-rerunfailures==15.1 pytest-cov==7.0.0 PySide6==6.11.1
 
       # Paths come from `testpaths` in pyproject.toml. Do NOT pass an explicit
       # path here: an argument overrides testpaths, which previously meant the
@@ -114,5 +110,7 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
-      - run: pip install -e . mypy
+      # NOSONAR githubactions:S8544  # reason: installs the checked-out project itself, there is no upstream version to lock
+      - run: pip install -e .
+      - run: "pip install --only-binary :all: mypy==2.3.0"
       - run: mypy je_auto_control/api je_auto_control/utils/failure_bundle

.github/workflows/release.yml

@@ -19,7 +19,7 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
-      - run: python -m pip install --upgrade build twine
+      - run: "python -m pip install --only-binary :all: build==1.5.0 twine==6.2.0"
       - name: Verify tag matches package version
         env:
           RELEASE_TAG: ${{ github.ref_name }}

.github/workflows/stable.yml

@@ -135,9 +135,7 @@ jobs:
           python-version: "3.12"
 
       - name: Install build tooling
-        run: |
-          python -m pip install --upgrade pip
-          pip install build twine
+        run: "pip install --only-binary :all: build==1.5.0 twine==6.2.0"
 
       - name: Bump patch version in pyproject.toml
         id: bump

dev_requirements.txt

@@ -15,9 +15,9 @@ python-docx==1.2.0
 python-pptx==1.0.2
 
 # Quality tooling — used by .github/workflows/quality.yml and locally.
-ruff==0.15.14
+ruff==0.15.22
 bandit==1.9.4
-pytest==9.0.3
+pytest==9.1.1
 pytest-timeout==2.4.0
 pytest-rerunfailures==15.1
 pytest-cov>=6.0

pyproject.toml

@@ -15,9 +15,12 @@ requires-python = ">=3.10"
 license-files = ["LICENSE"]
 dependencies = [
     "je_open_cv==0.0.22",
-    "pillow==12.2.0",
-    "pyobjc-core==12.1;platform_system=='Darwin'",
-    "pyobjc==12.1;platform_system=='Darwin'",
+    # je_open_cv leaves opencv-python unpinned; bound the major so a new
+    # OpenCV release cannot silently change cv2 return shapes under us.
+    "opencv-python>=4.8,<6",
+    "pillow==12.3.0",
+    "pyobjc-core==12.2.1;platform_system=='Darwin'",
+    "pyobjc==12.2.1;platform_system=='Darwin'",
     "python-Xlib==0.33;platform_system=='Linux'",
     "mss==10.2.0",
     "defusedxml==0.7.1",