fix: address Dependabot security alerts and drop EOL Python 3.9

- Bump Pillow floor to >=12.1.1 (fixes CVE out-of-bounds write on PSD
  images, Dependabot #241)
- Raise requires-python to >=3.10 (Pillow 12.1.1 requires it; Python
  3.9 is EOL since Oct 2025)
- Upgrade swiper to 12.1.3 (fixes prototype pollution, Dependabot #222)
- Replace unmaintained react-helmet with react-helmet-async; wrap app
  in HelmetProvider (resolves React 19 peer dependency warning)
- Drop Python 3.9 from CI matrix

Author: cbenning

.github/workflows/test.yml

@@ -33,7 +33,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
 
     steps:
       - uses: actions/checkout@v4

README.md

@@ -95,7 +95,7 @@ If you prefer not to use Docker or want to develop Fussel, you can install it lo
 
 #### Prerequisites
 
-- **Python** 3.9+
+- **Python** 3.10+
 - **uv** - Python package manager ([install](https://docs.astral.sh/uv/getting-started/installation/))
 - **Node.js** v18+ (LTS recommended)
 - **Yarn** 1.22+ (required)

fussel/web/package.json

@@ -8,7 +8,7 @@
     "bulma": "^1.0.4",
     "react": "^19.2.3",
     "react-dom": "^19.2.3",
-    "react-helmet": "^6.1.0",
+    "react-helmet-async": "^3.0.0",
     "react-modal": "^3.16.3",
     "react-photo-album": "^3.4.0",
     "react-responsive-masonry": "^2.7.1",

fussel/web/src/component/App.jsx

@@ -5,7 +5,7 @@ import Collection from "./Collection";
 import NotFound from "./NotFound";
 import { site_data } from "../_gallery/site_data.js"
 import { Routes, Route } from "react-router-dom";
-import { Helmet } from "react-helmet";
+import { Helmet, HelmetProvider } from "react-helmet-async";
 
 export default class App extends Component {
 
@@ -15,6 +15,7 @@ export default class App extends Component {
 
   render() {
     return (
+      <HelmetProvider>
       <div>
         <Helmet>
           <title>{site_data['site_name']}</title>
@@ -38,6 +39,7 @@ export default class App extends Component {
         </Routes>
 
       </div>
+      </HelmetProvider>
     );
   }
 }

fussel/web/src/component/App.test.jsx

@@ -44,11 +44,10 @@ vi.mock('./NotFound', () => ({
 }));
 
 // Mock Helmet
-vi.mock('react-helmet', () => {
-  return {
-    Helmet: ({ children }) => <div data-testid="helmet">{children}</div>
-  };
-});
+vi.mock('react-helmet-async', () => ({
+  HelmetProvider: ({ children }) => <>{children}</>,
+  Helmet: ({ children }) => <div data-testid="helmet">{children}</div>
+}));
 
 describe('App', () => {
   it('should render Helmet with site name', () => {

fussel/web/yarn.lock

@@ -1293,6 +1293,13 @@ indent-string@^4.0.0:
   resolved "https://registry.yarnpkg.com/indent-string/-/indent-string-4.0.0.tgz#624f8f4497d619b2d9768531d58f4122854d7251"
   integrity sha512-EdDDZu4A2OyIK7Lr/2zG+w5jmbuk1DVBnEwREQvBzspBJkCEbRa8GxU1lghYcaGJCnRWibjDXlq779X1/y5xwg==
 
+invariant@^2.2.4:
+  version "2.2.4"
+  resolved "https://registry.yarnpkg.com/invariant/-/invariant-2.2.4.tgz#610f3c92c9359ce1db616e538008d23ff35158e6"
+  integrity sha512-phJfQVBuaJM5raOpJjSfkiD6BpbCE4Ns//LaXl6wGYtUBY83nWS6Rf9tXm2e8VaK60JEjYldbPif/A2B1C2gNA==
+  dependencies:
+    loose-envify "^1.0.0"
+
 is-fullwidth-code-point@^3.0.0:
   version "3.0.0"
   resolved "https://registry.yarnpkg.com/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz#f116f8064fe90b3f7844a38997c0b75051269f1d"
@@ -1584,20 +1591,19 @@ react-dom@^19.2.3:
   dependencies:
     scheduler "^0.27.0"
 
-react-fast-compare@^3.1.1:
+react-fast-compare@^3.2.2:
   version "3.2.2"
   resolved "https://registry.npmjs.org/react-fast-compare/-/react-fast-compare-3.2.2.tgz"
   integrity sha512-nsO+KSNgo1SbJqJEYRE9ERzo7YtYbou/OqjSQKxV7jcKox7+usiUVZOAC+XnDOABXggQTno0Y1CpVnuWEc1boQ==
 
-react-helmet@^6.1.0:
-  version "6.1.0"
-  resolved "https://registry.npmjs.org/react-helmet/-/react-helmet-6.1.0.tgz"
-  integrity sha512-4uMzEY9nlDlgxr61NL3XbKRy1hEkXmKNXhjbAIOVw5vcFrsdYbH2FEwcNyWvWinl103nXgzYNlns9ca+8kFiWw==
+react-helmet-async@^3.0.0:
+  version "3.0.0"
+  resolved "https://registry.yarnpkg.com/react-helmet-async/-/react-helmet-async-3.0.0.tgz#16f31779ea4e4e01827c071b2f15301d074dd570"
+  integrity sha512-nA3IEZfXiclgrz4KLxAhqJqIfFDuvzQwlKwpdmzZIuC1KNSghDEIXmyU0TKtbM+NafnkICcwx8CECFrZ/sL/1w==
   dependencies:
-    object-assign "^4.1.1"
-    prop-types "^15.7.2"
-    react-fast-compare "^3.1.1"
-    react-side-effect "^2.1.0"
+    invariant "^2.2.4"
+    react-fast-compare "^3.2.2"
+    shallowequal "^1.1.0"
 
 react-is@^16.13.1:
   version "16.13.1"
@@ -1654,11 +1660,6 @@ [email protected]:
     cookie "^1.0.1"
     set-cookie-parser "^2.6.0"
 
-react-side-effect@^2.1.0:
-  version "2.1.2"
-  resolved "https://registry.npmjs.org/react-side-effect/-/react-side-effect-2.1.2.tgz"
-  integrity sha512-PVjOcvVOyIILrYoyGEpDN3vmYNLdy1CajSFNt4TDsVQC5KpTijDvWVoR+/7Rz2xT978D8/ZtFceXxzsPwZEDvw==
-
 react@^19.2.3:
   version "19.2.3"
   resolved "https://registry.npmjs.org/react/-/react-19.2.3.tgz"
@@ -1743,6 +1744,11 @@ set-cookie-parser@^2.6.0:
   resolved "https://registry.npmjs.org/set-cookie-parser/-/set-cookie-parser-2.7.2.tgz"
   integrity sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw==
 
+shallowequal@^1.1.0:
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/shallowequal/-/shallowequal-1.1.0.tgz#188d521de95b9087404fd4dcb68b13df0ae4e7f8"
+  integrity sha512-y0m1JoUZSlPAjXVtPPW70aZWfIL/dSP7AFkRnniLCrK/8MDKog3TySTBmckD+RObVxH0v4Tox67+F14PdED2oQ==
+
 shebang-command@^2.0.0:
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/shebang-command/-/shebang-command-2.0.0.tgz#ccd0af4f8835fbdc265b82461aaf0c36663f34ea"
@@ -1850,9 +1856,9 @@ supports-color@^7.1.0:
     has-flag "^4.0.0"
 
 swiper@^12.0.3:
-  version "12.0.3"
-  resolved "https://registry.npmjs.org/swiper/-/swiper-12.0.3.tgz"
-  integrity sha512-BHd6U1VPEIksrXlyXjMmRWO0onmdNPaTAFduzqR3pgjvi7KfmUCAm/0cj49u2D7B0zNjMw02TSeXfinC1hDCXg==
+  version "12.1.3"
+  resolved "https://registry.yarnpkg.com/swiper/-/swiper-12.1.3.tgz#0fd256e6ee043c85c077b0fa48faef7ed6acb051"
+  integrity sha512-XcWlVmkHFICI4fuoJKgbp8PscDcS4i7pBH8nwJRBi3dpQvhCySwsWRYm4bOf/BzKVWkHOYaFw7qz9uBSrY3oug==
 
 symbol-tree@^3.2.4:
   version "3.2.4"

pyproject.toml

@@ -7,7 +7,7 @@ name = "fussel"
 version = "1.0.0"
 description = "A static photo gallery generator"
 readme = "README.md"
-requires-python = ">=3.9"
+requires-python = ">=3.10"
 license = {text = "MIT"}
 authors = [
     {name = "Fussel Contributors"}
@@ -18,15 +18,14 @@ classifiers = [
     "Intended Audience :: End Users/Desktop",
     "License :: OSI Approved :: MIT License",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.9",
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
 ]
 
 dependencies = [
-    "Pillow>=10.4.0",
+    "Pillow>=12.1.1",
     "beautifulsoup4>=4.12.3",
 "python-slugify>=8.0.4",
     "pyyaml>=6.0.2",