fix: Update pytest to 9.0.3 to address CVE-2025-71176

[cursor]

Security Fix: CVE-2025-71176

This PR addresses a security vulnerability in pytest by updating it from version 7.1.1 to 9.0.3.

Vulnerability Details

CVE-2025-71176 - Insecure Temporary Directory Vulnerability

• Severity: Medium (CVSS 6.8)
• Affected Version: pytest through 9.0.2
• Issue: pytest on UNIX systems relies on predictable directory names with the /tmp/pytest-of-{user} pattern, which allows local users to:
  • Cause denial of service
  • Potentially gain privileges via symlink attacks and TOCTOU (Time-Of-Check-Time-Of-Use) races

Fix Details

The vulnerability was patched in pytest 9.0.3 (released April 7, 2026). The fix prevents symlink attacks by detecting and rejecting symlinks in the temporary directory path.

Changes Made

1. Updated pytest: 7.1.1 → 9.0.3 in pyproject.toml
2. Updated version: 4.6.0 → 4.7.0 in pyproject.toml
3. Regenerated lock files:
   • poetry.lock - Updated with pytest 9.0.3 and all dependencies
   • Pipfile and Pipfile.lock - Regenerated from poetry.lock

Testing

• ✅ All 38 unit tests pass with pytest 9.0.3
• ✅ No breaking changes detected
• ✅ Compatible with existing codebase

Notes

• pytest is a development dependency used for testing
• This update does not affect production code or runtime behavior
• The security issue only affects local development environments where tests are run

References

• CVE-2025-71176 Details
• pytest PR #14343 - Fix for CVE-2025-71176
• pytest Release 9.0.3

  

[Copilot]

Pull request overview

Updates the project’s test tooling to remediate a pytest security issue by upgrading pytest and regenerating dependency lockfiles.

Changes:

• Bump pytest from 7.1.1 to 9.0.3 in Poetry dev-dependencies.
• Increment project version to 4.7.0.
• Regenerate poetry.lock, Pipfile, and Pipfile.lock to reflect the new dependency resolution.

Reviewed changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated 2 comments.

File	Description
pyproject.toml	Bumps project/package version and updates pytest dev dependency to 9.0.3.
poetry.lock	Regenerated lock with pytest 9.0.3 and updated dependency graph/metadata.
Pipfile	Regenerated pipenv manifest used for scanning (pinned dependency list + Python requirement).
Pipfile.lock	Regenerated pipenv lock including updated hashes, markers, and Python full version requirement.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

version is formatted inconsistently with the rest of this TOML file (most keys use key = "value"). Consider changing this to version = "4.7.0" to match name = ..., description = ..., etc.

Suggested change

	version="4.7.0"
	version = "4.7.0"

[Copilot]

Pinning python_full_version to an exact patch release (3.13.13) makes pipenv install brittle for anyone on a different 3.13.x patch level. Consider removing python_full_version (keeping python_version = "3.13") or loosening it to avoid unnecessary install failures.

Suggested change

python_full_version = "3.13.13"