[goldmedal]

What

Resolves four Dependabot alerts in the core Python packages by bumping the flagged dependencies to their first patched versions.

Package	From	To	Advisory	Manifest
idna	3.11	3.18	idna.encode() bypass of CVE-2024-3651 fix	core/wren/uv.lock
cryptography	46.0.5	46.0.7	buffer overflow on non-contiguous buffers	core/wren/uv.lock
pytest	9.0.2	9.1.1	vulnerable tmpdir handling	core/wren/uv.lock
pytest	8.4.2	9.1.1	vulnerable tmpdir handling	core/wren-core-py

How

• idna and cryptography are transitive dependencies — re-locked in place (uv lock --upgrade-package) with no manifest change.
• pytest is a dev-only test runner. In core/wren it re-locked within the existing pytest>=8 constraint; in core/wren-core-py the exact pin pytest==8.4.2 was bumped to ==9.1.1 (the poetry→uv migration in chore(wren-core-py): migrate from Poetry to uv #2363 moved this manifest to uv.lock).

Verification

• core/wren: 509 passed, 43 skipped (unit suite) under pytest 9.1.1
• core/wren-core-py: maturin develop + 33 passed under pytest 9.1.1

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated the development test dependency to a newer version for improved maintenance and compatibility.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 0ef2d4d7-3aba-403f-9403-8a58f123b2fc

📥 Commits

Reviewing files that changed from the base of the PR and between c4de8ac and 664d016.

⛔ Files ignored due to path filters (2)

• core/wren-core-py/uv.lock is excluded by !**/*.lock
• core/wren/uv.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• core/wren-core-py/pyproject.toml

---

Walkthrough

The dev dependency group in core/wren-core-py/pyproject.toml updates the pinned pytest version from 8.4.2 to 9.1.1. No other project metadata, build configuration, or exported entities are affected.

Changes

Pytest Version Update

Layer / File(s)	Summary
Update pinned pytest version core/wren-core-py/pyproject.toml	The dev dependency group's pytest pin is updated from 8.4.2 to 9.1.1.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Poem

A tiny hop, a version swap,
pytest grows from 8 to 9 with a plop!
No code was harmed, no logic bent,
just one small line of dependency content.
🐇✨ Onward to testing we go!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the dependency security patches for idna, cryptography, and pytest.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dependabot-py-deps

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}