Merge branch 'fix/bump-pytest-9.0.3-v2'

CHANGELOG.md

@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 Dates are omitted for releases predating this file; see the git tags for exact timing.
 
+## [2.10.9] - 2026-07-21
+
+### Security
+
+- **Bumped the pinned dev/test dependency `pytest` from 9.0.2 to 9.0.3** to clear the
+  vulnerable tmpdir-handling advisory GHSA-6w46-j5rx-g56g (affects pytest < 9.0.3;
+  Dependabot alert #1). Development-scope test runner only — no runtime dependency change.
+  Both `pyproject.toml` and `uv.lock` are updated; the full test suite passes under 9.0.3.
+
 ## [2.10.8] - 2026-07-21
 
 ### Fixed

pyproject.toml

@@ -74,7 +74,7 @@ testpaths = [
 dev = [
     "ty==0.0.17",
     "ruff==0.15.1",
-    "pytest==9.0.2",
+    "pytest==9.0.3",
     "pytest-cov==7.0.0",
     "pytest-timeout>=2.4.0",
 ]