[aikido-autofix]

Description

Upgrade pytest to fix local privilege escalation and denial of service vulnerabilities in temporary directory handling.

Motivation and Context

Fixes #(issue)

Security Impact — CVE vulnerabilities fixed by this PR:

✅ 1 CVE resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2025-71176	MEDIUM	[pytest] through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, which allows local users to cause a denial of service or possibly gain privileges.

Fix Details / Technical Implementation (detailed write-up of what was changed and why):

🤖 Remediation details

Fix CVE-2025-71176: upgrade pytest to patched version ≥ 9.0.3

Short summary

This PR remediates a security vulnerability in pytest by raising its declared lower bound in both dependency sections of the root pyproject.toml. The lockfile uv.lock was regenerated to reflect the new resolved version. Because pytest ≥ 9.0.3 requires Python ≥ 3.10, the project's requires-python was also narrowed from >=3.8 to >=3.10 to eliminate marker forks that would have left vulnerable pytest versions pinned for Python 3.8/3.9 splits.

pytest

pytest is declared as a direct dependency in two places in pyproject.toml: [project.optional-dependencies] dev (previously >=7.0.0) and [dependency-groups] dev (previously >=8.3.5). Both lower bounds were raised to >=9.0.3 to satisfy the patched version floor. The initial lock attempt failed because pytest ≥ 9.0.3 drops support for Python < 3.10, causing the resolver to produce unsatisfiable marker forks for the Python 3.8 and 3.9 splits still covered by requires-python = ">=3.8"; leaving those forks in place would have kept vulnerable pytest versions active on those Python versions. Narrowing requires-python to >=3.10 collapsed the forks, and uv lock resolved a single pytest instance at 9.2.0 across all supported Python versions.

Version changes

Package	From	To	Why updated
pytest	8.3.5 / 8.4.0 (marker forks)	9.2.0	Direct CVE fix (CVE-2025-71176)
pytest-asyncio	0.24.0 / 1.1.0 (marker forks)	1.4.1.post1	Transitive lockfile refresh after requires-python narrowing
pluggy	1.5.0 / 1.6.0 (marker forks)	1.6.0	Transitive lockfile refresh after requires-python narrowing
coverage	7.6.1 / 7.8.2 (marker forks)	7.8.2	Transitive lockfile refresh after requires-python narrowing
mypy	1.14.1 / 1.16.0 (marker forks)	1.16.0	Transitive lockfile refresh after requires-python narrowing
typing-extensions	4.13.2 / 4.14.0 (marker forks)	4.14.0	Transitive lockfile refresh after requires-python narrowing
urllib3	2.2.3 / 2.4.0 (marker forks)	2.4.0	Transitive lockfile refresh after requires-python narrowing
pytest-cov	5.0.0 / 6.1.1 (marker forks)	6.1.1	Transitive lockfile refresh after requires-python narrowing

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Code refactoring
• Performance improvement
• Test update

How Has This Been Tested?

Test Commands:

uv run pytest  # or specific test command

Test Configuration:

• OS: [e.g., macOS 14.0, Ubuntu 22.04]
• Python version(s): [e.g., 3.8, 3.11, 3.13]
• easylimit version: [e.g., 0.3.2 + changes]

Checklist

• My code follows the project's code style (checked with ruff check and ruff format --check)
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My commit messages follow Conventional Commits specification
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes (uv run pytest)
• I have checked my code passes type checking (uv run mypy src/)
• I have updated the CHANGELOG.md (if applicable)
• I have updated version number if this is a release PR (src/easylimit/init.py only)
• My changes maintain backwards compatibility OR I've documented breaking changes
• I have tested on multiple Python versions (if applicable)

Additional Notes

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9a72b0d3-98f5-41e4-8ff5-9253d72df219

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn