Dependabot flags pytest < 9.0.3 (medium, GHSA-6w46-j5rx-g56g). We are pinned at pytest==6.2.5.
This was deferred from the loader-reorg PR (#384) because pytest 6 -> 9 is a major-version jump that cascades: pytest-asyncio==0.18.3 and pytest-cov==3.0.0 are both too old for pytest 9 and must be upgraded together, and the async test configuration (asyncio_mode=auto) may need adjustment. That is a test-infrastructure upgrade in its own right, not a drop-in bump, so it should be done and verified on its own rather than riding along with the loader changes.
pytest is a test-only dependency (medium severity), so the real-world exposure is low in the meantime.
Work: bump pytest, pytest-asyncio, and pytest-cov together to mutually compatible versions and re-verify the full suite (including the async tests and the testcontainers integration test). A good fit for the uv/pyproject migration ([#382]).
Dependabot flags
pytest < 9.0.3(medium, GHSA-6w46-j5rx-g56g). We are pinned atpytest==6.2.5.This was deferred from the loader-reorg PR (#384) because pytest 6 -> 9 is a major-version jump that cascades:
pytest-asyncio==0.18.3andpytest-cov==3.0.0are both too old for pytest 9 and must be upgraded together, and the async test configuration (asyncio_mode=auto) may need adjustment. That is a test-infrastructure upgrade in its own right, not a drop-in bump, so it should be done and verified on its own rather than riding along with the loader changes.pytest is a test-only dependency (medium severity), so the real-world exposure is low in the meantime.
Work: bump pytest, pytest-asyncio, and pytest-cov together to mutually compatible versions and re-verify the full suite (including the async tests and the testcontainers integration test). A good fit for the uv/pyproject migration ([#382]).