chore(deps)(deps): bump the testing group with 3 updates

[dependabot]

Bumps the testing group with 3 updates: pytest, faker and hypothesis.

Updates pytest from 8.3.5 to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

• #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
• #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
• #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
• #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

• #14533: When using --doctest-modules, autouse fixtures with module, package or session scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.

  If this is undesirable, move the fixture definition to a conftest.py file if possible.

  Technical explanation for those interested: When using --doctest-modules, pytest possibly collects Python modules twice, once as pytest.Module and once as a DoctestModule (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the DoctestModule collects a fixture, it is now visible to it only, and not to the Module. This means that both need to register the fixtures independently.

Deprecations (removal in next major release)

• #10819: Added a deprecation warning for class-scoped fixtures defined as instance methods (without @classmethod). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use @classmethod decorator instead -- by yastcher.

  See 10819 and 14011.

• #12882: Calling request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.

  See dynamic-fixture-request-during-teardown for details.

• #13409: Using non-~collections.abc.Collection iterables (such as generators, iterators, or custom iterable objects) for the argvalues parameter in @pytest.mark.parametrize <pytest.mark.parametrize ref> and metafunc.parametrize <pytest.Metafunc.parametrize> is now deprecated.

  These iterables get exhausted after the first iteration, leading to tests getting unexpectedly skipped in cases such as running pytest.main() multiple times, using class-level parametrize decorators, or collecting tests multiple times.

  See parametrize-iterators for details and suggestions.

• #13946: The private config.inicfg attribute is now deprecated. Use config.getini() <pytest.Config.getini> to access configuration values instead.

  See config-inicfg for more details.

• #14004: Passing baseid to ~pytest.FixtureDef or nodeid strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.

... (truncated)

Commits

• cf470ec Prepare release version 9.1.1
• e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
• 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
• 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
• b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
• 9a567e0 [automated] Update plugin list (#14617) (#14618)
• ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
• 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
• 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
• 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
• Additional commits viewable in compare view

Updates faker from 40.38.0 to 40.39.0

Release notes

Sourced from faker's releases.

Release v40.39.0

See CHANGELOG.md.

Changelog

Sourced from faker's changelog.

v40.39.0 - 2026-09-14

• Fix: compute Norwegian MOD11 check digit so no_NO iban() passes stdnum validation (#2415). Thanks @​CedricConday.

Commits

• 328b648 Bump version: 40.38.0 → 40.39.0
• eb2db2d 📝 Update CHANGELOG.md
• 3648583 fix(no_NO): compute Norwegian MOD11 check digit so iban() passes stdnum valid...
• See full diff in compare view

Updates hypothesis from 6.167.1 to 6.168.0

Commits

• cd434f2 Bump hypothesis version to 6.168.0 and update changelog
• 3187fb9 Merge pull request #4868 from Zac-HD/claude/hypothesis-datetime-strategy-ajzai0
• a60dc77 Reduce rate of tricky datetimes
• 67e5c04 Merge pull request #4875 from HypothesisWorks/create-pull-request/patch
• ecaed93 Merge remote-tracking branch 'upstream/master' into plait/review-hypothesis-4868
• 116ef84 Probe backwards for bound windows before the scan range
• ef17651 Bound the cache of probed timezone transitions
• 6b35510 Skip transition probing for fixed-offset timezones
• 26df9dd Simplify clamping of tricky-draw windows
• 6e9b745 Extract a _draw_ordinary_datetime helper
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Assignees

The following users could not be added as assignees: YOUR_GITHUB_USERNAME. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: automerge-candidate, dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

L9 Audit Harness Report

• Generated: 2026-09-23T05:33:22.520744+00:00
• Repo root: /home/runner/work/Cognitive.Engine.Graphs/Cognitive.Engine.Graphs
• Overall result: ✅ PASSED
• Exit code: 0

Step Results

Step	Status	Exit Code	Notes
Architecture Audit	✅ Passed	0
Spec Coverage	✅ Passed	0
Contract Wiring	✅ Passed	0

Architecture Audit Findings

Severity	Count
🔴 CRITICAL	0
🟠 HIGH	0
🟡 MEDIUM	17
🔵 LOW	0

See artifacts/audit_report.md for full details.

Spec Coverage

• ✅ Implemented: 37
• ⚠️ Partial: 9
• ❌ Missing: 0
• Total features: 46

Category	Implemented	Partial	Missing	Total
gates	10	0	0	10
scoring	7	0	0	7
v1.1_node	2	0	0	2
v1.1_edge	2	0	0	2
v1.1_action	0	2	0	2
v1.1_scoring	1	1	0	2
action_handler	0	6	0	6
gds_algorithm	5	0	0	5
research_pattern	10	0	0	10

See artifacts/coverage_report.md for full details.

Next Steps

All checks passed. Safe to merge.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ❌ 1 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

License Issues

poetry.lock

Package	Version	License	Issue Type
hypothesis	6.168.0	MPL-2.0	Incompatible License

Allowed Licenses: MIT, Apache-2.0, BSD-3-Clause, BSD-2-Clause, ISC

Excluded from license check: pkg:pypi/structlog, pkg:pypi/prometheus-client

OpenSSF Scorecard

Package	Version	Score	Details
pip/faker	40.39.0	🟢 5.2	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review ⚠️ 2 Found 7/26 approved changesets -- score normalized to 2 Packaging ⚠️ -1 packaging workflow not detected Security-Policy 🟢 4 security policy file detected Maintained 🟢 10 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
pip/hypothesis	6.168.0	Unknown	Unknown
pip/pytest	9.1.1	Unknown	Unknown

Scanned Files

• poetry.lock
• requirements-dev.txt

[github-actions]

✅ PR reviewable size is within recommended limits

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[cryptoxdog]

Remediation cycle 2: closes audit finding F-287-001 (contract unit R2) (f539ab5)

The cycle-1 fix (058aff7) made Supply Chain green by reverting Hypothesis to 6.167.1 in poetry.lock, but the Test Suite still installed 6.168.0. This cycle does two things instead:

• poetry.lock: restores the Dependabot-generated Hypothesis 6.168.0 lock. pyproject.toml hasn't changed since dd0ea67. With Poetry 2.4.1, poetry check --lock passes and poetry lock is a byte-identical no-op.
• supply-chain.yml and .github/env.template: add MPL-2.0 to the default Dependency Review allow-licenses. This matches the pip-licenses policy, which already admits MPL-2.0.

pytest 9.1.1 and Faker 40.39.0, the security thresholds, the exemptions and the pip-licenses policy are all unchanged. Locally, 1947 tests passed on pytest 9.1.1, Faker 40.39.0 and Hypothesis 6.168.0.

Still open:

• requirements-ci.txt / requirements-dev.txt keep hypothesis>=6.100,<7, so CI now resolves 6.168.1, which no longer matches the lock. Pinning is outside R2's authorized surfaces.
• If the repo variable vars.ALLOWED_LICENSES is set, it overrides the new default, and Dependency Review will stay red until it includes MPL-2.0.
• Per the contract's merge DAG, this lock must be regenerated after chore(deps)(deps): bump uvicorn from 0.52.4 to 0.53.0 in the web-framework group #286, chore(deps)(deps): bump python-multipart from 0.0.31 to 0.0.32 #290 and chore(deps)(deps): bump the dev-tools group with 2 updates #288 land.

---

Generated by Claude Code

[cryptoxdog]

Blocked: the repository variable ALLOWED_LICENSES overrides the new policy default.

Supply Chain Security / Dependency Review failed on f539ab5. The check runs on pull_request, so it used this PR's workflow, where the default is …, ISC, MPL-2.0. The input it actually resolved was:

allow-licenses: MIT, Apache-2.0, BSD-3-Clause, BSD-2-Clause, ISC

The value comes from vars.ALLOWED_LICENSES, not the file default, so it rejects poetry.lock » hypothesis@6.168.0 – License: MPL-2.0.

The remediation contract treats this as a policy/environment blocker. It forbids changing repository Actions variables from the PR, and this session can't read or write them anyway.

What's needed (operator): add MPL-2.0 to the repository (or org) Actions variable ALLOWED_LICENSES, or delete the variable so the workflow default applies. Then re-run the failed Dependency Review job. Nothing in this PR needs to change. All other checks on f539ab5 pass.

---

Generated by Claude Code