build(deps): bump pillow-heif from 1.5.0 to 1.7.0 in /climweb/requirements

[dependabot]

Bumps pillow-heif from 1.5.0 to 1.7.0.

Release notes

Sourced from pillow-heif's releases.

v1.7.0

Added

• Reading and writing nominal diffuse white luminance HDR metadata: nominal_diffuse_white_luminance key in info dictionary. #468
• py.typed marker, the package type annotations are now visible to type checkers. #475

Changed

• libheif was updated from the 1.23.2 to 1.23.3 version. #470
• libde265 was updated from the 1.1.1 to 1.1.2 version. #471

Fixed

• Out-of-bounds read in encode() when stride was smaller than the image row width. (GHSA-ccw6-q225-c975) Thanks to @​arpitjain099 for finding this!
• TypeError when saving an image whose info dictionary contains non-string keys. #475

v1.6.0

Added

• Reading and writing HDR metadata: content_light_level, mastering_display_colour_volume, ambient_viewing_environment keys in info dictionary. #456
• Python 3.15 and 3.15t wheels added.

Changed

• libheif was updated from the 1.23.1 to 1.23.2 version. #466

Fixed

• Use-after-free when a numpy array or the data memoryview outlived the HeifFile it was created from. #453
• Conflicting license metadata: removed the GPLv2 classifier, the package license is BSD-3-Clause; bundled library licenses in wheels are described in LICENSES_bundled.txt, which was updated to match the current libraries. #455

Changelog

Sourced from pillow-heif's changelog.

[1.7.0 - 2026-09-06]

Added

• Reading and writing nominal diffuse white luminance HDR metadata: nominal_diffuse_white_luminance key in info dictionary. #468
• py.typed marker, the package type annotations are now visible to type checkers. #475

Changed

• libheif was updated from the 1.23.2 to 1.23.3 version. #470
• libde265 was updated from the 1.1.1 to 1.1.2 version. #471

Fixed

• Out-of-bounds read in encode() when stride was smaller than the image row width. (GHSA-ccw6-q225-c975) Thanks to @​arpitjain099 for finding this!
• TypeError when saving an image whose info dictionary contains non-string keys. #475

[1.6.0 - 2026-08-31]

Added

• Reading and writing HDR metadata: content_light_level, mastering_display_colour_volume, ambient_viewing_environment keys in info dictionary. #456
• Python 3.15 and 3.15t wheels added.

Changed

• libheif was updated from the 1.23.1 to 1.23.2 version. #466

Fixed

• Use-after-free when a numpy array or the data memoryview outlived the HeifFile it was created from. #453
• Conflicting license metadata: removed the GPLv2 classifier, the package license is BSD-3-Clause; bundled library licenses in wheels are described in LICENSES_bundled.txt, which was updated to match the current libraries. #455

Commits

• f65a9ac v1.7.0
• a327768 feat: py.typed marker; fix the mypy errors it exposes (#475)
• b7d8f39 fix: out-of-bounds read in encode() when stride is smaller than the row (#474)
• cb0edae chore(deps): update pypa/cibuildwheel action to v4.2.1 (#472)
• 9a25554 chore(deps): update dependency strukturag/libheif to v1.23.3 (#470)
• fb3a384 ci: let renovate update every bundled library version reference (#473)
• 14c0c24 chore(deps): update dependency strukturag/libde265 to v1.1.2 (#471)
• 1460a21 feat: read and write nominal diffuse white luminance (ndwt) (#468)
• e7b4151 [pre-commit.ci] pre-commit autoupdate (#469)
• 5695650 bump version to 1.7.0.dev0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)