[gouwens]

Pillow 13.0 fixes security vulnerabilities and requires Python >=3.11 (12.x needs >=3.10, 11.x >=3.9), so this raises the package floor from 3.9 to 3.11.

Changes

• requires-python = ">=3.11", and uv.lock regenerated: it now resolves a single pillow 13.0.0 instead of 11.3.0 / 12.3.0 / 13.0.0 split by Python version.
• pillow>=13.0 added to dependencies. Pillow is not imported directly (it arrives via scikit-image → imageio); listing it makes the security floor apply to pip install ccf-streamlines, not just to this repo's lock.
• Ruff target-version is now py311, which enables B905. The five zip() calls it flags all pair equal-length sequences, so they take strict=True (2 in src/, 3 in tests/).
• CI test matrix: 3.9 → 3.11 (3.13 unchanged).
• docs/source/guide.rst install note and two stale 3.9 references in CLAUDE.md updated.

Testing

• Python 3.11: uv run pytest → 366 passed, 36 skipped; Pillow reports 13.0.0.
• Python 3.11, real-data tier (-m real_data): 36 passed.
• Python 3.14: 366 passed, 36 skipped, 253 warnings — all from pynrrd's own datetime.utcnow() call (nrrd/writer.py:148), deprecated on 3.14, not from this change.
• ruff check and ruff format --check clean.
• Not run locally: Python 3.13 (CI covers it) and the Sphinx docs build.

Notes

• Dropping 3.9/3.10 is breaking for users on those versions; the version in pyproject.toml is still 1.2.0 and may want a bump at release.
• A local, gitignored .python-version pinned to 3.9 will be rejected by uv after this merges; uv python pin 3.11 fixes it.

🤖 Generated with Claude Code