security: bump GitPython, Pillow, urllib3 to CVE-clean versions

[mvillmow]

Summary

Bumps three transitively-pinned libraries to their lowest CVE-clean versions. Trivy scans of images built with aider-chat==0.86.2 reported 7 HIGH-severity CVEs across these three libraries.

• gitpython 3.1.46 → 3.1.49 (CVE-2026-42215, -42284, -44243, -44244)
• pillow 12.1.1 → 12.2.0 (CVE-2026-42311)
• urllib3 2.6.3 → 2.7.0 (CVE-2026-44431)

Closes #5139
Closes #5140
Closes #5141

Files touched

The pins live in pip-tools / uv pip compile-generated lockfiles, not in pyproject.toml. Edited in place:

• requirements.txt
• requirements/common-constraints.txt
• requirements/requirements-browser.txt
• requirements/requirements-dev.txt
• requirements/requirements-help.txt

Quirks / things for the maintainer to double-check

• uv was not available in our environment, so the lockfiles were updated by hand rather than regenerated. The 3 changed pins are simple version-string swaps — no hashes are present in the existing lockfiles, so no hash regeneration was needed. Still, please run uv pip compile --no-strip-extras --constraint=requirements/common-constraints.txt --output-file=tmp.requirements.txt requirements/requirements.in (and the equivalent for the other .in files) locally to confirm no transitive resolution drift before merging.
• All bumps within same major release line; expected drop-in.

Verification

• aider --version smoke-tested in downstream consumer.

Downstream context

Reported by the HomericIntelligence/AchaeanFleet team. We've worked around it locally by force-overriding the pins post-install, but a native upstream fix removes the need for that workaround everywhere.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}