fix(security): VULN-88816 bump pytest to >=9.0.3

[shuningc]

Changes (3 files)

Before: galileo-core (main) + galileo-core[testing] (test) → pytest<9 + respx
After: galileo-core (main) + respx (test) + pytest>=9.0.3
mock_request still works via galileo_core pytest plugin

Why galileo-core[testing] was removed

That extra pins pytest<9.0.0, which blocked the upgrade. The mock_request fixture still works — it comes from galileo_core's pytest11 plugin entry point (galileo_core.testing.request_mocker), and only needs respx installed directly.

Verification

1995 passed, 4 skipped with poetry install --all-extras --no-root (same as CI).

[fercor-cisco]

🤖 This review was generated by the Astra agent (claude-opus-4-8). It may contain mistakes.

Verdict: request_changes — The pytest floor >=9.0.2 still permits the version the CVE flags as vulnerable; the remediation is 9.0.3.

[fercor-cisco]

🤖 This review was generated by the Astra agent (claude-opus-4-8). It may contain mistakes.

Verdict: request_changes — The lock file downgrades several unrelated, security-sensitive dependencies (urllib3, cryptography, protobuf, pillow, etc.), which is counterproductive and likely unintended in a security-remediation PR.

General Comments

• 🟠 major (security): This PR is a security remediation (VULN-88816), but the poetry.lock changes go far beyond the stated scope of "bump pytest + swap galileo-core[testing] for respx." The lock diff downgrades a number of unrelated dependencies relative to main, including several that FOSSA actively tracks for CVEs:

• urllib3 2.7.0 → 2.5.0 (non-optional, in main+test groups — always installed)

• cryptography 49.0.0 → 45.0.6

• protobuf 6.33.6 → 6.31.1 (non-optional, main)

• pillow 12.3.0 → 11.3.0

• click 8.4.2 → 8.1.8

• python-multipart 0.0.32 → 0.0.20

Downgrading urllib3 and cryptography in a PR whose whole purpose is to close an OSS vulnerability is a regression risk — it can reintroduce other CVEs and will likely trip FOSSA on the same branch. This pattern usually means the lock was regenerated from a stale/divergent base or on a different platform, rather than as a minimal targeted update.

Please rebase onto the current main and regenerate the lock so the only changes are the intended ones (pytest, pytest-asyncio, dropping the galileo-core[testing] extra, adding respx). The diff should not touch urllib3, cryptography, protobuf, pillow, click, or python-multipart. If any of these version changes are in fact intended, please call that out explicitly in the PR description.

[fercor-cisco]

🤖 This review was generated by the Astra agent (claude-opus-4-8). It may contain mistakes.

Verdict: approve — Correct, verified security bump; floor >=9.0.3 matches remediation and the extra→respx swap is functionally equivalent.

Follow-ups

Suggested follow-up work that could be tracked as Jira tickets:

• splunk-ao-adk/pyproject.toml:130-140: The splunk-ao-adk subpackage's dev dependency group still declares pytest>=8.4.0 and galileo-core[testing]>=3.82.0, both of which permit the pytest versions vulnerable to CVE-2025-71176 (affected "through 9.0.2"). This is out of scope for VULN-88816 (which targets the root poetry.lock, and the ADK is uv-managed with no committed uv.lock yet), but if FOSSA begins scanning the ADK subpackage the same CVE could recur. Consider bumping the ADK's pytest floor to >=9.0.3 in a follow-up. Note its tests/conftest.py comment also still references the old "galileo_core[testing] extras" wording, which remains accurate there since the ADK keeps the extra.

[fercor-cisco]

🔵 nit (design): pytest = ">=9.0.3" has no upper bound, unlike the caret-capped style of the sibling test deps (pytest-cov = "^6.0.0", pytest-asyncio = "^1.4.0", etc.). In practice pytest-asyncio transitively caps pytest at <10, so a future poetry update won't silently pull pytest 10, but for consistency and to keep the security floor explicit you may prefer ^9.0.3 (i.e. >=9.0.3,<10). Non-blocking.

Suggested change

	pytest = ">=9.0.3"
	pytest = "^9.0.3"

🤖 Generated by the Astra agent