fix(deps): bump pytest to 9.0.3 + pytest-asyncio to 1.3.0 (CVE-2025-71176)

CVE-2025-71176 (GHSA-6w46-j5rx-g56g) - pytest tmpdir handling vulnerability (symlink TOCTOU). Fixed in pytest 9.0.3 (per pytest-dev/pytest#14343).

pytest-asyncio bumped to 1.3.0 (first release with pytest 9 support, see pytest-dev/pytest-asyncio#1278).

Master + simulator test suites both pass after the bump:
- master pytest: 23/23 in 0.22s
- simulator pytest: 8/8 in 0.07s

Cite: GHSA-6w46-j5rx-g56g
Trace: docs/research/phase-1-shared-infrastructure-execution.md
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: Anandhu Prakash

master/pyproject.toml

@@ -33,8 +33,8 @@ dependencies = [
 [project.optional-dependencies]
 dev = [
     "mypy==1.13.0",
-    "pytest==8.3.3",
-    "pytest-asyncio==0.24.0",
+    "pytest==9.0.3",  # CVE-2025-71176 fix (GHSA-6w46-j5rx-g56g)
+    "pytest-asyncio==1.3.0",  # first release with pytest 9 support
     "pytest-cov==6.0.0",
     "ruff==0.7.4",
 ]

master/uv.lock

@@ -28,8 +28,8 @@ dependencies = [
 [project.optional-dependencies]
 dev = [
     "mypy==1.13.0",
-    "pytest==8.3.3",
-    "pytest-asyncio==0.24.0",
+    "pytest==9.0.3",  # CVE-2025-71176 fix (GHSA-6w46-j5rx-g56g)
+    "pytest-asyncio==1.3.0",  # first release with pytest 9 support
     "pytest-cov==6.0.0",
     "ruff==0.7.4",
 ]