chore(deps)(deps): bump the testing group with 5 updates

[dependabot]

Bumps the testing group with 5 updates:

Package	From	To
pytest	8.3.5	9.1.1
pytest-asyncio	1.3.0	1.4.0
pytest-cov	6.0.0	7.1.0
faker	40.11.0	40.36.0
hypothesis	6.151.10	6.165.2

Updates pytest from 8.3.5 to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

• #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
• #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
• #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
• #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

• #14533: When using --doctest-modules, autouse fixtures with module, package or session scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.

  If this is undesirable, move the fixture definition to a conftest.py file if possible.

  Technical explanation for those interested: When using --doctest-modules, pytest possibly collects Python modules twice, once as pytest.Module and once as a DoctestModule (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the DoctestModule collects a fixture, it is now visible to it only, and not to the Module. This means that both need to register the fixtures independently.

Deprecations (removal in next major release)

• #10819: Added a deprecation warning for class-scoped fixtures defined as instance methods (without @classmethod). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use @classmethod decorator instead -- by yastcher.

  See 10819 and 14011.

• #12882: Calling request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.

  See dynamic-fixture-request-during-teardown for details.

• #13409: Using non-~collections.abc.Collection iterables (such as generators, iterators, or custom iterable objects) for the argvalues parameter in @pytest.mark.parametrize <pytest.mark.parametrize ref> and metafunc.parametrize <pytest.Metafunc.parametrize> is now deprecated.

  These iterables get exhausted after the first iteration, leading to tests getting unexpectedly skipped in cases such as running pytest.main() multiple times, using class-level parametrize decorators, or collecting tests multiple times.

  See parametrize-iterators for details and suggestions.

• #13946: The private config.inicfg attribute is now deprecated. Use config.getini() <pytest.Config.getini> to access configuration values instead.

  See config-inicfg for more details.

• #14004: Passing baseid to ~pytest.FixtureDef or nodeid strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.

... (truncated)

Commits

• cf470ec Prepare release version 9.1.1
• e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
• 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
• 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
• b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
• 9a567e0 [automated] Update plugin list (#14617) (#14618)
• ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
• 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
• 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
• 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
• Additional commits viewable in compare view

Updates pytest-asyncio from 1.3.0 to 1.4.0

Release notes

Sourced from pytest-asyncio's releases.

pytest-asyncio v1.4.0

1.4.0 - 2026-05-26

Deprecated

• Overriding the event_loop_policy fixture is deprecated. Use the pytest_asyncio_loop_factories hook instead. (#1419)

Added

• Added the pytest_asyncio_loop_factories hook to parametrize asyncio tests with custom event loop factories.

  The hook returns a mapping of factory names to loop factories, and pytest.mark.asyncio(loop_factories=[...]) selects a subset of configured factories per test. When a single factory is configured, test names are unchanged.

  Synchronous @pytest_asyncio.fixture functions now see the correct event loop when custom loop factories are configured, even when test code disrupts the current event loop (e.g., via asyncio.run() or asyncio.set_event_loop(None)). (#1164)

Changed

• Improved the readability of the warning message that is displayed when asyncio_default_fixture_loop_scope is unset (#1298)
• Only import asyncio.AbstractEventLoopPolicy for type checking to avoid raising a DeprecationWarning. (#1394)
• Updated minimum supported pytest version to v8.4.0. (#1397)

Fixed

• Fixed a ResourceWarning: unclosed event loop warning that could occur when a synchronous test called asyncio.run() or otherwise unset the current event loop after pytest-asyncio had run an async test or fixture. (#724)

Notes for Downstream Packagers

• Added dependency on sphinx-tabs >= 3.5 to organize documentation examples into tabs. (#1395)

pytest-asyncio v1.4.0a2

1.4.0a2 - 2026-05-02

Deprecated

• Overriding the event_loop_policy fixture is deprecated. Use the pytest_asyncio_loop_factories hook instead. (#1419)

Added

• Added the pytest_asyncio_loop_factories hook to parametrize asyncio tests with custom event loop factories.

  The hook returns a mapping of factory names to loop factories, and pytest.mark.asyncio(loop_factories=[...]) selects a subset of configured factories per test. When a single factory is configured, test names are unchanged on pytest 8.4+.

  Synchronous @pytest_asyncio.fixture functions now see the correct event loop when custom loop factories are configured, even when test code disrupts the current event loop (e.g., via asyncio.run() or asyncio.set_event_loop(None)). (#1164)

Changed

• Improved the readability of the warning message that is displayed when asyncio_default_fixture_loop_scope is unset (#1298)
• Only import asyncio.AbstractEventLoopPolicy for type checking to avoid raising a DeprecationWarning. (#1394)

... (truncated)

Commits

• 6e14cd2 chore: Prepare release of v1.4.0.
• 4b900fb Build(deps): Bump codecov/codecov-action from 6.0.0 to 6.0.1
• ab9f632 Build(deps): Bump zipp from 3.23.1 to 4.1.0
• a56fc77 Build(deps): Bump hypothesis from 6.152.6 to 6.152.8
• e8bae9b Build(deps): Bump requests from 2.34.0 to 2.34.2
• fc43340 Build(deps): Bump idna from 3.14 to 3.15
• 762eaf5 Build(deps): Bump jaraco-functools from 4.4.0 to 4.5.0
• b62e222 Build(deps): Bump click from 8.3.3 to 8.4.0
• 9190447 Build(deps): Bump pydantic from 2.13.3 to 2.13.4
• 82a393c ci: Remove unnecessary debug output.
• Additional commits viewable in compare view

Updates pytest-cov from 6.0.0 to 7.1.0

Changelog

Sourced from pytest-cov's changelog.

7.1.0 (2026-03-21)

• Fixed total coverage computation to always be consistent, regardless of reporting settings. Previously some reports could produce different total counts, and consequently can make --cov-fail-under behave different depending on reporting options. See [#641](https://github.com/pytest-dev/pytest-cov/issues/641) <https://github.com/pytest-dev/pytest-cov/issues/641>_.

• Improve handling of ResourceWarning from sqlite3.

  The plugin adds warning filter for sqlite3 ResourceWarning unclosed database (since 6.2.0). It checks if there is already existing plugin for this message by comparing filter regular expression. When filter is specified on command line the message is escaped and does not match an expected message. A check for an escaped regular expression is added to handle this case.

  With this fix one can suppress ResourceWarning from sqlite3 from command line::

  pytest -W "ignore:unclosed database in <sqlite3.Connection object at:ResourceWarning" ...

• Various improvements to documentation. Contributed by Art Pelling in [#718](https://github.com/pytest-dev/pytest-cov/issues/718) <https://github.com/pytest-dev/pytest-cov/pull/718>_ and "vivodi" in [#738](https://github.com/pytest-dev/pytest-cov/issues/738) <https://github.com/pytest-dev/pytest-cov/pull/738>. Also closed [#736](https://github.com/pytest-dev/pytest-cov/issues/736) <https://github.com/pytest-dev/pytest-cov/issues/736>.

• Fixed some assertions in tests. Contributed by in Markéta Machová in [#722](https://github.com/pytest-dev/pytest-cov/issues/722) <https://github.com/pytest-dev/pytest-cov/pull/722>_.

• Removed unnecessary coverage configuration copying (meant as a backup because reporting commands had configuration side-effects before coverage 5.0).

7.0.0 (2025-09-09)

• Dropped support for subprocesses measurement.

  It was a feature added long time ago when coverage lacked a nice way to measure subprocesses created in tests. It relied on a .pth file, there was no way to opt-out and it created bad interations with coverage's new patch system <https://coverage.readthedocs.io/en/latest/config.html#run-patch>_ added in 7.10 <https://coverage.readthedocs.io/en/7.10.6/changes.html#version-7-10-0-2025-07-24>_.

  To migrate to this release you might need to enable the suprocess patch, example for .coveragerc:

  .. code-block:: ini

  [run] patch = subprocess

  This release also requires at least coverage 7.10.6.

• Switched packaging to have metadata completely in pyproject.toml and use hatchling <https://pypi.org/project/hatchling/>_ for building. Contributed by Ofek Lev in [#551](https://github.com/pytest-dev/pytest-cov/issues/551) <https://github.com/pytest-dev/pytest-cov/pull/551>_ with some extras in [#716](https://github.com/pytest-dev/pytest-cov/issues/716) <https://github.com/pytest-dev/pytest-cov/pull/716>_.

• Removed some not really necessary testing deps like six.

... (truncated)

Commits

• 66c8a52 Bump version: 7.0.0 → 7.1.0
• f707662 Make the examples use pypy 3.11.
• 6049a78 Make context test use the old ctracer (seems the new sysmon tracer behaves di...
• 8ebf20b Update changelog.
• 861d30e Remove the backup context manager - shouldn't be needed since coverage 5.0, ...
• fd4c956 Pass the precision on the nulled total (seems that there's some caching goion...
• 78c9c4e Only run the 3.9 on older deps.
• 4849a92 Punctuation.
• 197c35e Update changelog and hopefully I don't forget to publish release again :))
• 14dc1c9 Update examples to use 3.11 and make the adhoc layout example look a bit more...
• Additional commits viewable in compare view

Updates faker from 40.11.0 to 40.36.0

Release notes

Sourced from faker's releases.

Release v40.36.0

See CHANGELOG.md.

Release v40.35.0

See CHANGELOG.md.

Release v40.34.0

See CHANGELOG.md.

Release v40.33.2

See CHANGELOG.md.

Release v40.33.1

See CHANGELOG.md.

Release v40.33.0

See CHANGELOG.md.

Release v40.32.0

See CHANGELOG.md.

Release v40.31.0

See CHANGELOG.md.

Release v40.30.0

See CHANGELOG.md.

Release v40.29.0

See CHANGELOG.md.

Release v40.28.1

See CHANGELOG.md.

Release v40.28.0

See CHANGELOG.md.

Release v40.27.0

See CHANGELOG.md.

Release v40.26.0

See CHANGELOG.md.

Release v40.25.0

See CHANGELOG.md.

Release v40.24.1

See CHANGELOG.md.

Release v40.24.0

See CHANGELOG.md.

... (truncated)

Changelog

Sourced from faker's changelog.

v40.36.0 - 2026-07-24

• Fix: correct uk_UA bban_format to 6 digits + 19 letters so iban() generates valid Ukrainian IBANs (#2417). Thanks @​CedricConday.

v40.35.0 - 2026-07-22

• Fix: add correct bban_format so ru_RU iban() generates valid Russian IBANs (#2416). Thanks @​CedricConday.

v40.34.0 - 2026-07-22

• Fix: correct BBAN length so da_DK iban() generates valid Danish IBANs (#2409). Thanks @​CedricConday.

v40.33.2 - 2026-07-22

• Validate positive=True against a non-positive max_value in pydecimal (#2428). Thanks @​Sreekant13.

v40.33.1 - 2026-07-22

• Make uuid1() and uuid7() reproducible under a fixed seed (#2427). Thanks @​vidigoat.

v40.33.0 - 2026-07-22

• Add alphanumeric CNPJ support for pt_BR via flag (#2402). Thanks @​moohbr.

v40.32.0 - 2026-07-20

• Add allowed_path_traversal_elements option to file_path() (#2397). Thanks @​Ayushmann13479.
• Fix Windows file_path depth=3 test regex. Thanks @​fcurella.

v40.31.0 - 2026-07-14

• Fix: correct BBAN length so pt_BR iban() generates valid Brazilian IBANs (#2410). Thanks @​CedricConday.

v40.30.0 - 2026-07-14

• Fix: generate valid Belgian bank codes in nl_BE iban() (#2412). Thanks @​CedricConday.

v40.29.0 - 2026-07-14

• Fix: generate valid Spanish CCC control digits in es_ES iban() (#2404). Thanks @​CedricConday.

v40.28.1 - 2026-07-01

• Fix: compute valid ISO 7064 Mod 11,10 check digit for de_DE vat_id (#2403). Thanks @​CedricConday.

v40.28.0 - 2026-07-01

• Add es_MX automotive license plate provider (#2393). Thanks @​r1cksync.

v40.27.0 - 2026-06-30

... (truncated)

Commits

• 62d5a6a Bump version: 40.35.0 → 40.36.0
• 09c254a 📝 Update CHANGELOG.md
• ce45ebd fix(uk_UA): correct bban_format to 6 digits + 19 letters so iban() is valid (...
• 8ad78a6 Merge pull request #2434 from joke2k/joke2k-security-md
• ce3d3b1 Add SECURITY.md to the manifest file
• ac535cf Revise security policy for clarity and updates
• 4b7d4d7 💄 Lint code
• 2e83f45 Bump version: 40.34.0 → 40.35.0
• b1caba1 📝 Update CHANGELOG.md
• 706aaca 💄 Lint code
• Additional commits viewable in compare view

Updates hypothesis from 6.151.10 to 6.165.2

Release notes

Sourced from hypothesis's releases.

Hypothesis for Python - version 6.152.9

This release substantially improves our internal distribution for generating integers. This release has the most visible effect on "integers()", but may incidentally improve other strategies which draw integers internally.

Our integers distribution had two problems. First, it had jagged discontinuities at certain values where we switched sampling approaches. Second, it used a different distribution for bounded and unbounded ranges, which resulted in "st.integers()" and "st.integers(-264, 264)" producing very different distributions despite being semantically similar.

We now use a smooth distribution for both "st.integers()" and "st.integers(a, b)", which fixes both of these issues. This should substantially improve our testing power in certain cases.

The only way this release should be user-visible is that it finds more bugs! If this release is user-visible in other ways - for example, because it is slower, or produces a worse distribution in some cases - please open an issue.

The canonical version of these notes (with links) is on readthedocs.

Hypothesis for Python - version 6.152.8

This release drops support for end-of-life Django 4.2.

The canonical version of these notes (with links) is on readthedocs.

Hypothesis for Python - version 6.152.7

This patch improves our type hints for ".filter()" to work with "typing.TypeGuard". For example:

from typing import TypeGuard

from hypothesis import strategies as st

def is_str(x: object) -> TypeGuard[str]: return isinstance(x, str)

s = st.from_type(object).filter(is_str)

previously: SearchStrategy[object]

now: SearchStrategy[str]

reveal_type(s)

The canonical version of these notes (with links) is on readthedocs.

Hypothesis for Python - version 6.152.6

This patch adds a shrinking pass that tries natural text

... (truncated)

Commits

• deb4d49 Bump hypothesis version to 6.165.2 and update changelog
• a9eff28 Merge pull request #4842 from HypothesisWorks/claude/invert-everything
• c555e58 Cover the remaining _invert error paths in tests
• f9882a3 Apply review feedback: type ValueHole.value as object, polish docs and tests
• 8dca9e1 Restructure timezones() so its draws can be re-encoded
• 7e309df Invert dictionaries, unique lists with tuple_suffixes, and fixed_dictionaries
• 77ca292 Implement _invert for most remaining strategy combinators
• 5b20755 Bump hypothesis version to 6.165.1 and update changelog
• b4f2e92 Merge pull request #4806 from HypothesisWorks/claude/widening-shrinks
• 9431e20 Apply suggestions from code review
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Assignees

The following users could not be added as assignees: YOUR_GITHUB_USERNAME. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: automerge-candidate, dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

✅ PR reviewable size is within recommended limits

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ❌ 1 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

License Issues

poetry.lock

Package	Version	License	Issue Type
hypothesis	6.165.2	MPL-2.0	Incompatible License

Allowed Licenses: MIT, Apache-2.0, BSD-3-Clause, BSD-2-Clause, ISC

OpenSSF Scorecard

Package	Version	Score	Details
pip/faker	40.36.0	🟢 5.2	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Code-Review ⚠️ 2 Found 6/26 approved changesets -- score normalized to 2 Packaging ⚠️ -1 packaging workflow not detected Security-Policy 🟢 4 security policy file detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
pip/hypothesis	6.165.2	Unknown	Unknown
pip/pytest	9.1.1	Unknown	Unknown
pip/pytest-asyncio	1.4.0	Unknown	Unknown
pip/pytest-cov	7.1.0	Unknown	Unknown

Scanned Files

• poetry.lock
• requirements-dev.txt

[github-actions]

L9 Audit Harness Report

• Generated: 2026-08-10T03:11:57.338142+00:00
• Repo root: /home/runner/work/Cognitive.Engine.Graphs/Cognitive.Engine.Graphs
• Overall result: ✅ PASSED
• Exit code: 0

Step Results

Step	Status	Exit Code	Notes
Architecture Audit	✅ Passed	0
Spec Coverage	✅ Passed	0
Contract Wiring	✅ Passed	0

Architecture Audit Findings

Severity	Count
🔴 CRITICAL	0
🟠 HIGH	0
🟡 MEDIUM	25
🔵 LOW	0

See artifacts/audit_report.md for full details.

Spec Coverage

• ✅ Implemented: 37
• ⚠️ Partial: 9
• ❌ Missing: 0
• Total features: 46

Category	Implemented	Partial	Missing	Total
gates	10	0	0	10
scoring	7	0	0	7
v1.1_node	2	0	0	2
v1.1_edge	2	0	0	2
v1.1_action	0	2	0	2
v1.1_scoring	1	1	0	2
action_handler	0	6	0	6
gds_algorithm	5	0	0	5
research_pattern	10	0	0	10

See artifacts/coverage_report.md for full details.

Next Steps

All checks passed. Safe to merge.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud