From 80f4e2a8046ab767ab431233eecf575e6e4d508e Mon Sep 17 00:00:00 2001 From: Static Date: Thu, 6 Aug 2026 18:44:46 -0400 Subject: [PATCH] deps: take pytest 9.0.3 for the tmpdir advisory, and pytest-asyncio with it CVE-2025-71176 (GHSA-6w46-j5rx-g56g, CVSS 6.8): pytest through 9.0.2 on UNIX uses predictable /tmp/pytest-of-{user} directories, so a local user can cause a denial of service or possibly escalate. Fixed in 9.0.3. pytest-asyncio 1.1.0 pins pytest<9, so the two move together or neither does. 1.4.0 is the first release that accepts pytest 9. 239 passed, 5 skipped on Linux under the new pins, unchanged from 8.4.1. Co-Authored-By: Claude Opus 5 --- requirements-dev.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/requirements-dev.txt b/requirements-dev.txt index 612535d..25d696b 100644 --- a/requirements-dev.txt +++ b/requirements-dev.txt @@ -1,5 +1,5 @@ # Development and security policy test dependencies. Never ship this file. -pytest==8.4.1 -pytest-asyncio==1.1.0 +pytest==9.0.3 +pytest-asyncio==1.4.0 PyYAML==6.0.2 cryptography==50.0.0