From 985a9c240c9aa278404ab35a82e2d2ed005a080f Mon Sep 17 00:00:00 2001
From: Ken Kroenlein <kkroenlein@citrine.io>
Date: Tue, 13 Oct 2026 10:32:12 -0600
Subject: [PATCH] Resolve open Dependabot and code scanning alerts

Pin pytest to 9.0.3 on Python 3.10+ to fix the tmpdir handling
vulnerability. Python 3.9 keeps pytest 8.4.2, because pytest 9
requires Python 3.10.

Set read-only GITHUB_TOKEN permissions on the PR Checks and
Deploy to PyPI workflows.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/deploy.yml    | 3 +++
 .github/workflows/pr-checks.yml | 3 +++
 gemd/__version__.py             | 2 +-
 pyproject.toml                  | 3 ++-
 test_requirements.txt           | 3 ++-
 5 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 0da6be1..156c3ec 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -1,5 +1,8 @@
 name: Deploy to PyPI
 
+permissions:
+  contents: read
+
 on:
   release:
     types: [published]
diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index 004839f..42dd901 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -1,5 +1,8 @@
 name: PR Checks
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     branches:
diff --git a/gemd/__version__.py b/gemd/__version__.py
index 55e4709..3a5935a 100644
--- a/gemd/__version__.py
+++ b/gemd/__version__.py
@@ -1 +1 @@
-__version__ = "2.3.0"
+__version__ = "2.3.1"
diff --git a/pyproject.toml b/pyproject.toml
index 61007f2..9037979 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -52,7 +52,8 @@ dev = [
     "pandas>=2.0.3; python_version<'3.10'",
     "numpy>=2.0.2,<3; python_version>='3.10'",
     "pandas>=2.3.0,<4; python_version>='3.10'",
-    "pytest==8.4.2",
+    "pytest==8.4.2; python_version<'3.10'",
+    "pytest==9.0.3; python_version>='3.10'",
     "pytest-cov==7.0.0",
     "derp==0.1.1",
     "tomli>=2.2.1",
diff --git a/test_requirements.txt b/test_requirements.txt
index c8f0654..7115aba 100644
--- a/test_requirements.txt
+++ b/test_requirements.txt
@@ -4,6 +4,7 @@ numpy==1.24.4; python_version<'3.10'
 pandas==2.0.3; python_version<'3.10'
 numpy>=2.0.2,<=2.1.0; python_version>='3.10'
 pandas==2.3.0; python_version>='3.10'
-pytest==8.4.2
+pytest==8.4.2; python_version<'3.10'
+pytest==9.0.3; python_version>='3.10'
 pytest-cov==7.0.0
 derp==0.1.1