From c030000e0816b4dd49f764900e76ace1fae00e64 Mon Sep 17 00:00:00 2001 From: Omer Date: Tue, 5 May 2026 18:30:09 +0000 Subject: [PATCH] fix(deps): pin pytest <9 on Python 3.9 to keep lock satisfiable MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Renovate auto-bumped `pytest==X; python_version < '3.10'` past 9.0 (via #1511 `8.3.5→8.4.2` then #1509 `8.4.2→9.0.3`), which produced an unsatisfiable lock: pytest 9.0.3 requires Python>=3.10 but the marker scopes it to <3.10. `uv sync --locked` resolves all Python versions per requires-python, so the contradiction breaks every PR's lint job. Switch the 3.9 pin to a `>=8.4,<9` range. Renovate's pep621 manager respects version-specifier upper bounds natively, so the `<9` cap is sufficient on its own — no extra renovate.json packageRule needed (an earlier draft tried that, but `matchCurrentValue` only sees the version range, not the PEP 508 marker, so the regex would have been a no-op). --- pyproject.toml | 4 +++- uv.lock | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 42985fd9f..ee0382f84 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -54,10 +54,12 @@ types = [ ] tests = [ # pytest 9 requires Python 3.10+; on 3.9 we stay on the last 8.x line. + # The `<9` upper bound on the 3.9 entry is REQUIRED — without it renovate + # bumps the pin past 9.0 and produces an unsatisfiable lock. Keep it. # CVE-2025-71176 (pytest <9.0.3 tmp-dir predictability) is dev-only and # not fixable on 3.9 — risk is bounded to local CI runners. "pytest>=9.0.3; python_version >= '3.10'", - "pytest==9.0.3; python_version < '3.10'", + "pytest>=8.4,<9; python_version < '3.10'", "pytest-cov>=5", "coverage[toml]>=7.3.1,<8", ] diff --git a/uv.lock b/uv.lock index 698e72850..45a242bab 100644 --- a/uv.lock +++ b/uv.lock @@ -574,7 +574,7 @@ dev = [ ] tests = [ { name = "coverage", extras = ["toml"], specifier = ">=7.3.1,<8" }, - { name = "pytest", marker = "python_full_version < '3.10'", specifier = "==8.4.2" }, + { name = "pytest", marker = "python_full_version < '3.10'", specifier = ">=8.4,<9" }, { name = "pytest", marker = "python_full_version >= '3.10'", specifier = ">=9.0.3" }, { name = "pytest-cov", specifier = ">=5" }, ]