v1.9.0

v1.9.0 (2026-06-29)

Feat

• --gremlin-explain <id>: new diagnostic flag that prints why a specific gremlin was
  selected, instrumented, and which test was chosen to run against it — exposing how
  coverage-guided selection reaches its decisions (#397, #398)

Fix

• Preserve non-cov addopts in subprocess runs: gremlins' coverage pre-scan and
  mutant-execution runs previously cleared all pytest addopts via -o addopts= to neutralize
  pytest-cov, silently dropping collection-affecting options such as --import-mode=importlib.
  This disabled coverage-guided test selection for projects relying on those options. Only the
  --cov* / --no-cov* family is now stripped; everything else survives into the subprocess
  (#424, #436)
• Parametrize values containing |: coverage selection now splits on the last pipe so
  parametrized test IDs whose values contain | are no longer dropped (#419)

Internal

• Cold-run coverage scoped to gremlin source files, avoiding wasted tracing on unrelated
  modules (#423)
• Security: bumped transitive dependencies to clear latent CVEs that pip-audit flagged
  against the live advisory DB — 13 CVEs in #418 (idna, pillow, pip, pymdown-extensions, urllib3,
  uv, pytest) and msgpack→1.2.1 + pip→26.1.2 in #442/#443 (GHSA-6v7p-g79w-8964, PYSEC-2026-196)
• Dependencies: routine bumps across the dev toolchain — pytest 9.1.1, ruff 0.15.20,
  mypy 2.1.0, tox 4.56.1, coverage 7.14.3, commitizen 4.16.4, pip-audit 2.10.1, playwright 1.61.0,
  codecov-action 7, plus several GitHub Actions group updates

What's Changed

• chore(deps): patch 13 CVEs in transitive deps + harden flaky cache-perf test by @mikelane in #418
• chore(deps): bump coverage from 7.13.5 to 7.14.1 by @dependabot[bot] in #405
• chore(deps): bump mypy from 1.19.1 to 2.1.0 by @dependabot[bot] in #406
• chore(deps): bump commitizen from 4.13.9 to 4.16.2 by @dependabot[bot] in #411
• chore(deps): bump tox from 4.50.3 to 4.55.0 by @dependabot[bot] in #409
• chore(deps): bump tox-uv from 1.33.4 to 1.35.2 by @dependabot[bot] in #408
• chore(deps): bump ruff from 0.15.7 to 0.15.15 by @dependabot[bot] in #413
• chore(deps): bump playwright from 1.58.0 to 1.60.0 by @dependabot[bot] in #412
• chore(deps): bump pre-commit from 4.5.1 to 4.6.0 by @dependabot[bot] in #399
• chore(deps): bump actions/cache from 4 to 5 in the actions-core group across 1 directory by @dependabot[bot] in #372
• chore(deps): bump the third-party-actions group across 1 directory with 2 updates by @dependabot[bot] in #388
• fix: rsplit on last pipe so parametrize values containing | are not dropped from coverage selection by @mikelane in #419
• feat: add --gremlin-explain diagnostic flag (#397) by @mikelane in #398
• cleanup: scope cold-run coverage to gremlin source files by @mikelane in #423
• chore(deps): bump msgpack→1.2.1 and pip→26.1.2 to clear latent CVEs (#442) by @mikelane in #443
• chore(deps): bump codecov/codecov-action from 6 to 7 in the third-party-actions group across 1 directory by @dependabot[bot] in #425
• chore(deps): bump pip-audit from 2.10.0 to 2.10.1 by @dependabot[bot] in #430
• chore(deps): bump playwright from 1.60.0 to 1.61.0 by @dependabot[bot] in #441
• chore(deps): bump coverage from 7.14.1 to 7.14.3 by @dependabot[bot] in #439
• chore(deps): bump commitizen from 4.16.2 to 4.16.4 by @dependabot[bot] in #431
• chore(deps): bump pytest from 9.0.3 to 9.1.1 by @dependabot[bot] in #434
• chore(deps): bump tox from 4.55.0 to 4.56.1 by @dependabot[bot] in #438
• chore(deps): bump ruff from 0.15.15 to 0.15.20 by @dependabot[bot] in #440
• chore(deps): bump the actions-core group across 1 directory with 2 updates by @dependabot[bot] in #437
• fix(coverage): preserve non-cov addopts in subprocess runs (#424) by @disi-omni in #436
• docs: add v1.9.0 changelog entry by @mikelane in #447

New Contributors

• @disi-omni made their first contribution in #436

Full Changelog: v1.8.1...v1.9.0