From 8b89ebe0e058c72fd5c13c1aa12d75b7bec95a6c Mon Sep 17 00:00:00 2001 From: pauldhawk Date: Sat, 19 Sep 2026 15:56:40 -0500 Subject: [PATCH] Bump pytest to fix Dependabot alert #19 (vulnerable tmpdir handling) Pytest <9.0.3 relies on predictable /tmp/pytest-of-{user} directory names, which upstream advisory GHSA-24qm-fmxv-6h9p flags as a local DoS/privilege risk on shared Unix systems. pytest>=9.0.3 requires Python 3.10+, so the constraint is split by python_version to keep 3.8/3.9 support in the dev dependency group. Co-Authored-By: Claude Sonnet 5 --- pyproject.toml | 3 ++- uv.lock | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index aaf54d6..d6c3a39 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -31,7 +31,8 @@ states = "us.cli.states:main" [dependency-groups] dev = [ 'ruff', - 'pytest', + 'pytest>=9.0.3; python_version >= "3.10"', + 'pytest; python_version < "3.10"', 'pytz', "ty>=0.0.38", ] diff --git a/uv.lock b/uv.lock index 7626600..a3e9713 100644 --- a/uv.lock +++ b/uv.lock @@ -515,7 +515,8 @@ requires-dist = [{ name = "jellyfish" }] [package.metadata.requires-dev] dev = [ - { name = "pytest" }, + { name = "pytest", marker = "python_full_version < '3.10'" }, + { name = "pytest", marker = "python_full_version >= '3.10'", specifier = ">=9.0.3" }, { name = "pytz" }, { name = "ruff" }, { name = "ty", specifier = ">=0.0.38" },