[abrichr]

Summary

This PR fixes the one open Dependabot alert in this repository.

Alert	Package	Severity	Advisory	From	To	Manifest
#1	pytest	medium	GHSA-6w46-j5rx-g56g (PYSEC-2026-1845)	8.3.5	9.0.3	uv.lock

Changes

• uv.lock: pytest goes from 8.3.5 to 9.0.3, the first patched release. I used uv lock --upgrade-package 'pytest==9.0.3', which picks the smallest fixed version instead of the newest (9.1.1).
• pyproject.toml: the dev extra now needs pytest>=9.0.3 instead of an unpinned pytest. CI installs with pip install -e ".[dev]" and does not read uv.lock, so this floor stops that path from installing a vulnerable version.

Other lockfile changes that come with this one:

• pytest 9 needs pygments, so the lock adds pygments 2.21.0.
• The lock was out of date with pyproject.toml: it had requires-python = ">=3.9", but the project requires >=3.11. Any relock fixes this. It removes the Python 3.9 and 3.10 wheels and markers, and exceptiongroup with them. Most of the lines in the diff come from this.
• No other package versions change.

Verification

• uv lock --check: the lock now matches pyproject.toml. On main it fails.
• uv run --locked pytest passes 4 tests on Python 3.12 and 3.11. The coverage run (--cov=pydantic_prompt) also passes.
• ./lint.sh, the CI lint step (ruff format, ruff fix, ruff check, mypy), reports "All checks passed!" and "Success: no issues found". Note: ruff check . on its own, without the auto-fixes that lint.sh applies first, already reports 7 findings in pydantic_prompt/core.py and the tests on main. This PR does not touch those files.
• uv build builds the sdist and wheel, and twine check passes.
• pip-audit on the exported lock (all extras and groups) and on the synced environment reports "No known vulnerabilities found". The same check on pytest==8.3.5 reports PYSEC-2026-1845, fixed in 9.0.3.

Notes

The fix/ledger-wave2-2026-10-14 branch may also change this repository. If both branches change uv.lock, the simplest way to resolve the conflict is to take either side and run uv lock again.

🤖 Generated with Claude Code