Fix LOW-severity vulnerabilities in dev/test Python deps (pytest, black, Pygments)

[yedidyakfir]

Summary

Dependabot has flagged LOW-severity vulnerabilities in dev/test-only Python dependencies. These do not ship in deployed runtime code, so real-world risk is low — fix opportunistically.

Source: GitHub → Security → Dependabot alerts.

Affected packages

Package	Advisory	Fixed in	GHSA
pytest	Vulnerable tmpdir handling	9.0.3	GHSA-6w46-j5rx-g56g
black	Arbitrary file write from unsanitized cache file name	26.3.1	GHSA-3936-cmfr-pm3m
Pygments	ReDoS via inefficient GUID-matching regex	2.20.0	GHSA-5239-wwwm-4pmq

Implementation Considerations

• Dev/test/tooling deps only — not in production runtime.
• Bump together:

  uv lock --upgrade-package pytest --upgrade-package black --upgrade-package pygments
  uv sync

• black 26.x may reformat code — review the diff and apply formatting in a dedicated commit if needed.

List tasks

• Bump pytest to ≥9.0.3
• Bump black to ≥26.3.1 (review formatting changes)
• Bump Pygments to ≥2.20.0
• Run test suite and commit updated uv.lock

[github-actions]

Closed by #125.