fix(security): VULN-88816 bump pytest to >=9.0.3

[shuningc]

Changes (3 files)

Before: galileo-core (main) + galileo-core[testing] (test) → pytest<9 + respx
After: galileo-core (main) + respx (test) + pytest>=9.0.3
mock_request still works via galileo_core pytest plugin

Why galileo-core[testing] was removed

That extra pins pytest<9.0.0, which blocked the upgrade. The mock_request fixture still works — it comes from galileo_core's pytest11 plugin entry point (galileo_core.testing.request_mocker), and only needs respx installed directly.

Verification

1995 passed, 4 skipped with poetry install --all-extras --no-root (same as CI).

[fercor-cisco]

🤖 This review was generated by the Astra agent (claude-opus-4-8). It may contain mistakes.

Verdict: request_changes — The pytest floor >=9.0.2 still permits the version the CVE flags as vulnerable; the remediation is 9.0.3.

[fercor-cisco]

🤖 This review was generated by the Astra agent (claude-opus-4-8). It may contain mistakes.

Verdict: request_changes — The lock file downgrades several unrelated, security-sensitive dependencies (urllib3, cryptography, protobuf, pillow, etc.), which is counterproductive and likely unintended in a security-remediation PR.

General Comments

• 🟠 major (security): This PR is a security remediation (VULN-88816), but the poetry.lock changes go far beyond the stated scope of "bump pytest + swap galileo-core[testing] for respx." The lock diff downgrades a number of unrelated dependencies relative to main, including several that FOSSA actively tracks for CVEs:

• urllib3 2.7.0 → 2.5.0 (non-optional, in main+test groups — always installed)

• cryptography 49.0.0 → 45.0.6

• protobuf 6.33.6 → 6.31.1 (non-optional, main)

• pillow 12.3.0 → 11.3.0

• click 8.4.2 → 8.1.8

• python-multipart 0.0.32 → 0.0.20

Downgrading urllib3 and cryptography in a PR whose whole purpose is to close an OSS vulnerability is a regression risk — it can reintroduce other CVEs and will likely trip FOSSA on the same branch. This pattern usually means the lock was regenerated from a stale/divergent base or on a different platform, rather than as a minimal targeted update.

Please rebase onto the current main and regenerate the lock so the only changes are the intended ones (pytest, pytest-asyncio, dropping the galileo-core[testing] extra, adding respx). The diff should not touch urllib3, cryptography, protobuf, pillow, click, or python-multipart. If any of these version changes are in fact intended, please call that out explicitly in the PR description.