diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0c48d04..b3c9688 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 Dates are omitted for releases predating this file; see the git tags for exact timing.
 
+## [2.10.9] - 2026-07-21
+
+### Security
+
+- **Bumped the pinned dev/test dependency `pytest` from 9.0.2 to 9.0.3** to clear the
+  vulnerable tmpdir-handling advisory GHSA-6w46-j5rx-g56g (affects pytest < 9.0.3;
+  Dependabot alert #1). Development-scope test runner only — no runtime dependency change.
+  Both `pyproject.toml` and `uv.lock` are updated; the full test suite passes under 9.0.3.
+
 ## [2.10.8] - 2026-07-21
 
 ### Fixed
diff --git a/pyproject.toml b/pyproject.toml
index a648205..dd7d348 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -74,7 +74,7 @@ testpaths = [
 dev = [
     "ty==0.0.17",
     "ruff==0.15.1",
-    "pytest==9.0.2",
+    "pytest==9.0.3",
     "pytest-cov==7.0.0",
     "pytest-timeout>=2.4.0",
 ]