[dargmuesli]

Fixes all open security alerts in this repo.

Dependency fixes:

• mistune 2.0.0rc1 to 3.4.0 (6 high + 8 moderate advisories, fixed in 3.3.0). The v3 API removed the legacy Markdown(AstRenderer) class, so parse_protocol was migrated to the v3 token API: mistune.Markdown() with renderer=None returns the token tree, heading level moved to attrs.level, inline text nodes use raw. The existing test suite (test_post_protocol) covers this and passes.
• pytest pin was >=8.3.3,<9, which blocked the fix for GHSA-6w46-j5rx-g56g (fixed in 9.0.3); relaxed to >=8.3.3, now on 9.1.1
• pillow 11.0.0 to 13.0.0 (transitive via matplotlib; 3 critical + several high/moderate advisories)
• jinja2 3.1.4 to 3.1.6, fonttools 4.54.1 to 4.67.0 (moderate)
• matplotlib 3.9.2 to 3.11.2 (current 3.x, has wheels for 3.13)

CI:

• the workflow previously only ran on push, so pull requests had no checks at all (always green). It now also runs on pull_request, so this and future PRs are gated by the existing tests, pre-commit and docker build jobs.

All 68 tests pass locally (uv sync and pytest).