From d1a6358325032d3e9199755b0807829d39d500fe Mon Sep 17 00:00:00 2001
From: Prashanth Manthena <prashanth@graphiant.com>
Date: Tue, 21 Apr 2026 14:54:09 -0700
Subject: [PATCH] Bumping up pytest version to 9.0.3 to fix CVE-2025-71176

---
 CHANGELOG.md          | 5 +++++
 SECURITY.md           | 4 ++++
 poetry.lock           | 8 ++++----
 pyproject.toml        | 2 +-
 test-requirements.txt | 2 +-
 5 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 01b07531..b267a137 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,11 @@ All notable changes to the Graphiant SDK Python package will be documented in th
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [Unreleased]
+
+### Security
+- **pytest** (dev / CI): require **≥ 9.0.3** for **CVE-2025-71176** (insecure **`/tmp/pytest-of-{user}`** handling on UNIX; local users could cause **denial of service** or possibly **gain privileges**). See [pytest PR #14279](https://github.com/pytest-dev/pytest/pull/14279).
+
 ## [26.3.3] - 2026-04-10
 
 ### Changed
diff --git a/SECURITY.md b/SECURITY.md
index 6da00b90..6e44b5df 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -22,6 +22,10 @@ We actively support the following versions with security updates:
 
 Tools such as **tox** and **virtualenv** depend on **filelock**. Older **filelock** versions were affected by a **time-of-check–time-of-use (TOCTOU)** issue in **SoftFileLock**, including a race that could allow **symlink attacks** during lock file creation. This package declares **Python ≥ 3.10** and **filelock ≥ 3.20.3** for Poetry dev dependencies so installs resolve **filelock** releases that include the relevant fixes.
 
+### Development tooling (`pytest`)
+
+**pytest** through **9.0.2** on UNIX used predictable **`/tmp/pytest-of-{user}`** paths in ways that allowed **local symlink / TOCTOU attacks**, leading to **denial of service** or possible **privilege escalation** (**CVE-2025-71176**, CVSS 6.8). This repository requires **pytest ≥ 9.0.3** in dev / test requirements and **Poetry** lockfile so CI and contributors resolve a patched release. Upstream references: [pytest PR #14279](https://github.com/pytest-dev/pytest/pull/14279), [CVE-2025-71176](https://www.cve.org/CVERecord?id=CVE-2025-71176).
+
 ## Reporting a Vulnerability
 
 We take security vulnerabilities seriously. If you discover a security vulnerability, please follow these steps:
diff --git a/poetry.lock b/poetry.lock
index 459428a9..abae9212 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -863,14 +863,14 @@ testing = ["covdefaults (>=2.3)", "pytest (>=8.4.2)", "pytest-cov (>=7)", "pytes
 
 [[package]]
 name = "pytest"
-version = "9.0.2"
+version = "9.0.3"
 description = "pytest: simple powerful testing with Python"
 optional = false
 python-versions = ">=3.10"
 groups = ["dev"]
 files = [
-    {file = "pytest-9.0.2-py3-none-any.whl", hash = "sha256:711ffd45bf766d5264d487b917733b453d917afd2b0ad65223959f59089f875b"},
-    {file = "pytest-9.0.2.tar.gz", hash = "sha256:75186651a92bd89611d1d9fc20f0b4345fd827c41ccd5c299a868a05d70edf11"},
+    {file = "pytest-9.0.3-py3-none-any.whl", hash = "sha256:2c5efc453d45394fdd706ade797c0a81091eccd1d6e4bccfcd476e2b8e0ab5d9"},
+    {file = "pytest-9.0.3.tar.gz", hash = "sha256:b86ada508af81d19edeb213c681b1d48246c1a91d304c6c81a427674c17eb91c"},
 ]
 
 [package.dependencies]
@@ -1178,4 +1178,4 @@ typing-extensions = {version = ">=4.13.2", markers = "python_version < \"3.11\""
 [metadata]
 lock-version = "2.1"
 python-versions = ">=3.10"
-content-hash = "9867fd23a46b3c1ce7f1cf28bc4803ce99989436be8a0455ad65643da21eb338"
+content-hash = "c9a3fab2ef71054265989dacc2e1a549abb0b4a4f2136877323b25319b9e795c"
diff --git a/pyproject.toml b/pyproject.toml
index 1c29cff0..0a61b2ba 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -31,7 +31,7 @@ Repository = "https://github.com/Graphiant-Inc/graphiant-sdk-python"
 requires-poetry = ">=2.0"
 
 [tool.poetry.group.dev.dependencies]
-pytest = ">= 7.2.1"
+pytest = ">= 9.0.3"
 pytest-cov = ">= 2.8.1"
 tox = ">= 3.9.0"
 flake8 = ">= 4.0.0"
diff --git a/test-requirements.txt b/test-requirements.txt
index e98555c1..9cb0629a 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -1,4 +1,4 @@
-pytest >= 7.2.1
+pytest >= 9.0.3
 pytest-cov >= 2.8.1
 tox >= 3.9.0
 flake8 >= 4.0.0