convertcom · abbaseya · Aug 12, 2026 · Aug 8, 2026 · Aug 8, 2026 · Aug 10, 2026
diff --git a/.yarnrc.yml b/.yarnrc.yml
@@ -1 +1,10 @@
 nodeLinker: node-modules
+
+# Supply-chain minimum release age: refuse to install any dependency version
+# published less than 3 days ago (smash-and-grab malware is usually yanked
+# within hours). Same value as the gate in convertcom/javascript-sdk. No
+# npmPreapprovedPackages entry here: this project has no internal npm
+# dependencies (the SDK ships via PyPI, and the only Node packages are release
+# tooling), so nothing in our own release chain can stall on a freshly-published
+# package.
+npmMinimalAgeGate: 4320
diff --git a/TESTING.md b/TESTING.md
@@ -39,8 +39,24 @@ All tooling is configured in `pyproject.toml`. Key settings:
 | coverage | `source = ["convert_sdk"]`; `fail_under = 85` |
 | towncrier | fragments under `changes/`; compiled only at release time |
 
-pytest is pinned to `>=8.4,<8.5` because pytest 9.x dropped Python 3.9 support,
-which is the lower bound of the CI matrix.
+pytest is split on an environment marker rather than pinned to one line:
+
+```toml
+"pytest>=9.0.3,<10; python_version >= '3.10'",
+"pytest>=8.4,<8.5;  python_version < '3.10'",
+```
+
+GHSA-6w46-j5rx-g56g / CVE-2025-71176 (pytest's insecure temporary directory —
+`/tmp/pytest-of-{user}` is predictable) affects every pytest release before
+9.0.3, and pytest 9 requires Python >=3.10. Because the matrix floor is 3.9, no
+single specifier is both patched and installable across it, so the marker takes
+the patched line wherever it can run and falls back to the last 3.9-compatible
+line on the bottom cell only.
+
+**Do not collapse these two lines into `pytest>=8.4,<8.5`** — that reintroduces
+the CVE on every cell. Collapse them into `pytest>=9.0.3` instead, and only once
+the SDK's own `requires-python` floor moves to 3.10. `pyproject.toml` carries the
+same instruction next to the specifiers.
 
 ## CI matrix
 

diff --git a/package.json b/package.json
@@ -8,9 +8,10 @@
   },
   "devDependencies": {
     "@semantic-release/exec": "^7.0.0",
-    "@semantic-release/github": "^11.0.0",
+    "@semantic-release/github": "^12.0.0",
     "@semantic-release/release-notes-generator": "^14.0.0",
     "conventional-changelog-conventionalcommits": "^8.0.0",
-    "semantic-release": "^24.0.0"
-  }
+    "semantic-release": "^25.0.0"
+  },
+  "packageManager": "yarn@4.18.0+sha512.fcb8716fe7cd0eece141ffc18b92193a9df9204c1ba83189c288835223fc0bbe64af473bab0d5e9927a7daeb5caf2bb07eb2787cc9338ca040ea125f2a1f2f7e"
 }
diff --git a/pyproject.toml b/pyproject.toml
@@ -156,9 +156,25 @@ exclude_lines = [
 
 [dependency-groups]
 dev = [
-    # pytest pinned to the 8.4.x line: pytest 9 drops Python 3.9 support, which
-    # would break the lower edge of the CI matrix (architecture decision; qs-02).
-    "pytest>=8.4,<8.5",
+    # pytest is split on an environment marker, not pinned to one line.
+    #
+    # GHSA-6w46-j5rx-g56g / CVE-2025-71176 (insecure temporary directory —
+    # `/tmp/pytest-of-{user}` is predictable, so a local user can pre-create or
+    # symlink it) affects EVERY pytest release up to 9.0.2 and is fixed only in
+    # 9.0.3. pytest 9 requires Python >=3.10, and NFR22 mandates the full
+    # CPython 3.9-3.13 matrix, so no single specifier is both patched and
+    # installable across the matrix.
+    #
+    # The marker takes the patched line everywhere it can run (3.10-3.13) and
+    # falls back to the last 3.9-compatible line on the bottom cell only. The
+    # 3.9 cell therefore carries a MODERATE, local-vector, dev-only advisory
+    # that no upstream release can clear; pytest never ships (the wheel is
+    # packages = ["src/convert_sdk"] and httpx is the only runtime dependency),
+    # so this is bounded to the runner executing the suite. Collapse the two
+    # lines into "pytest>=9.0.3" the moment the SDK's own requires-python
+    # floor moves to 3.10.
+    "pytest>=9.0.3,<10; python_version >= '3.10'",
+    "pytest>=8.4,<8.5; python_version < '3.10'",
     # RESPX route-level HTTPX mocking for transport/config-fetch tests
     # (qs-06 integration-test-harness pattern; no socket-level patching).
     "respx>=0.21,<1.0",