fix(FFESUPPORT-725): address Dependabot vulnerabilities

[aarsilv]

Summary

Closes FFESUPPORT-725.

Resolves all 8 open Dependabot alerts (3 high, 4 medium, 1 low) in this deprecated repository.

Changes

• pyproject.toml — bumped dev pytest constraint ^7.4 → ^8.4 to pull in pytest>=8.3.4, which patches GHSA-6w46-j5rx-g56g (vulnerable tmpdir handling).
• poetry.lock — refreshed via poetry update; transitive deps now resolve to patched versions:
  • HIGH urllib3 2.6.3 — GHSA-qccp-gfcp-xxvc (sensitive headers across origins), GHSA-mf9v-mfxr-j63j (decompression-bomb bypass)
  • HIGH deepdiff 8.6.2 — GHSA-54jj-px8x-5w5q (memory exhaustion DoS)
  • MEDIUM requests 2.32.5 — GHSA-gc5v-m9x4-r6x2 (insecure temp file reuse)
  • MEDIUM idna 3.16 — GHSA-65pc-fj4g-8rjx (idna.encode bypass)
  • MEDIUM sqlparse 0.5.4 — GHSA-27jp-wm6q-gp25 (formatting list of tuples DoS)
  • MEDIUM pytest 8.4.2 — GHSA-6w46-j5rx-g56g (vulnerable tmpdir handling)
  • LOW dbt-common 1.34.2 — GHSA-w75w-9qv4-j5xj (commonprefix path traversal)

Verification

• poetry install clean
• poetry run pytest -v — 22/22 pass (matches the Tests workflow on Python 3.9–3.12)

Note

This PR was generated with Claude Code.

[aarsilv]

🤖 Context from Claude: Bumping pytest from ^7.4 to ^8.4. This is a major bump and pytest 8 has some real deprecation removals (e.g., pytest.warns(None), some collector class changes), but this project's test suite uses only the high-level API (pytest.fixture, pytest.raises, pytest_mock's mocker, simple parametrize), none of which is affected. All 22 tests pass locally on pytest 8.4.2 and the CI run on this PR has 3.9/3.10/3.11/3.12 all green. Sticking on pytest 7.x would leave GHSA-6w46-j5rx-g56g unpatched (advisory is fixed in 8.3.4+), and there is no 7.x backport.

[aarsilv]

🤖 Context from Claude: The poetry.lock diff is large because I ran an unscoped poetry update (not poetry update <pkg> for each advisory). Reason: every advisory in this repo is on a transitive dep, and several of them — urllib3, requests, idna, sqlparse — are pulled in by both dbt-core and the direct deps in different versions, so individually pinning them would have produced an inconsistent solve. Letting Poetry re-resolve the whole graph is the cleanest way to clear every advisory while letting Poetry settle on a single consistent set. Nothing was bumped past its declared semver constraint in pyproject.toml (except pytest, which I bumped intentionally — see inline comment on pyproject.toml).

[Copilot]

Pull request overview

This PR updates the project’s development test dependency to a patched pytest release as part of resolving Dependabot-reported vulnerabilities in this repository.

Changes:

• Bump pytest in dev dependencies from ^7.4 to ^8.4 to ensure a non-vulnerable version (>=8.3.4) is used.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.