From 82a1d634d0b27f0c7f0dd473cc00c5f322f7a3f5 Mon Sep 17 00:00:00 2001
From: Haksung Jang <haksung@sk.com>
Date: Wed, 8 Jul 2026 20:31:06 +0900
Subject: [PATCH] chore(test): upgrade pytest 8->9 (+asyncio 1.x, cov 7.x) for
 GHSA-6w46-j5rx-g56g
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes the deferred dev-tooling advisory from the Dependabot sweep: pytest's
tmpdir handling (GHSA-6w46-j5rx-g56g) is fixed in 9.0.3. Moving to pytest 9
pulls two compatible majors (pip-resolved):

  pytest        8.3.4  -> 9.0.3
  pytest-asyncio 0.24.0 -> 1.4.0
  pytest-cov     6.0.0  -> 7.1.0

pytest-asyncio 1.x makes the async-fixture event-loop scope configurable and
warns when unset, so pin `asyncio_default_fixture_loop_scope = "function"` in
pyproject.toml — that preserves the per-test loop behaviour the suite ran under
with 0.24 (the root `_isolate_engine_per_test` autouse fixture is already
function-scoped), keeping the upgrade behaviour-preserving.

Verified locally: clean pip resolution of the three-package set; `asyncio_mode =
"auto"` still auto-collects async tests and `--cov` still reports under
9.0.3 / 1.4.0 / 7.1.0; the suite has no `event_loop` fixture override (removed in
asyncio 1.x), no module/session-scoped async fixtures, and no warnings-as-errors
config. The full DB-backed suite is validated by CI `test (backend)`.
---
 apps/backend/pyproject.toml       | 6 ++++++
 apps/backend/requirements-dev.txt | 6 +++---
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/apps/backend/pyproject.toml b/apps/backend/pyproject.toml
index 9ef2227b..123e6f38 100644
--- a/apps/backend/pyproject.toml
+++ b/apps/backend/pyproject.toml
@@ -1,5 +1,11 @@
 [tool.pytest.ini_options]
 asyncio_mode = "auto"
+# Pin the async-fixture event-loop scope explicitly. pytest-asyncio 1.x makes
+# this configurable and warns when it is unset; "function" preserves the
+# per-test loop behaviour the suite ran under with pytest-asyncio 0.24 (the
+# root `_isolate_engine_per_test` autouse fixture is function-scoped), so the
+# 8->9 upgrade is behaviour-preserving.
+asyncio_default_fixture_loop_scope = "function"
 testpaths = ["tests"]
 pythonpath = ["."]
 markers = [
diff --git a/apps/backend/requirements-dev.txt b/apps/backend/requirements-dev.txt
index c5909ef9..c5a09d01 100644
--- a/apps/backend/requirements-dev.txt
+++ b/apps/backend/requirements-dev.txt
@@ -1,7 +1,7 @@
 -r requirements.txt
-pytest==8.3.4
-pytest-asyncio==0.24.0
-pytest-cov==6.0.0
+pytest==9.0.3
+pytest-asyncio==1.4.0
+pytest-cov==7.1.0
 ruff==0.8.4
 mypy==1.13.0
 # Phase 2 PR #8: in-memory Redis double for CircuitBreaker unit tests.