fix: resolve all open Dependabot security alerts (#317)

* fix: resolve all open Dependabot security alerts

- Bump pillow 12.2.0 -> 12.3.0 in template/requirements.txt,
  python/poetry.lock, and chart_data_extractor/poetry.lock
  (25 alerts: heap OOB writes, decompression bomb bypasses, DoS)
- Update js-yaml to 3.15.0 / 4.3.0 (GHSA-52cp-r559-cp3m,
  GHSA-h67p-54hq-rp68: quadratic merge-key DoS)
- Update brace-expansion to 1.1.16 (GHSA-3jxr-9vmj-r5cp)
- Force esbuild >=0.28.1 via pnpm override (GHSA-g7r4-m6w7-qqqr);
  vite 7.3.5 and tsup 8.5.1 both pin ^0.27.0, so an override is
  required. Verified tsup build and vitest transform still work.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: bump poetry to 2.1.1 in .tool-versions to match lock-version 2.1

python/poetry.lock and chart_data_extractor/poetry.lock are now both
lock-version 2.1, which Poetry 1.8.5 cannot install deterministically
(it silently re-resolves). The chart_data_extractor lock was already
lock-version 2.1 on main, so charts CI was already affected; pinning
2.1.1 (the binary that generated both locks in this PR) fixes both.
Verified with `poetry check --lock` and `poetry install --dry-run` in
both packages. All poetry commands used in CI (install, install --with
dev, build, run, config pypi-token, publish --skip-existing) are
unchanged in Poetry 2.x.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: mishushakov

.changeset/pillow-12-3-security.md

@@ -0,0 +1,5 @@
+---
+"@e2b/code-interpreter-template": patch
+---
+
+Bump `pillow` to 12.3.0 to address multiple security vulnerabilities (heap out-of-bounds writes, decompression bomb bypasses, and DoS issues fixed in 12.3.0)

.tool-versions

@@ -1,2 +1,2 @@
 python 3.10
-poetry 1.8.5
+poetry 2.1.1

chart_data_extractor/poetry.lock

@@ -22,5 +22,10 @@
   },
   "engines": {
     "pnpm": ">=9.0.0 <10"
+  },
+  "pnpm": {
+    "overrides": {
+      "esbuild@<0.28.1": ">=0.28.1"
+    }
   }
 }