Skip to content

chore(deps): update dependency pytest to v9.0.3 [security]#16632

Closed
renovate-bot wants to merge 1 commit intogoogleapis:mainfrom
renovate-bot:renovate/pypi-pytest-vulnerability
Closed

chore(deps): update dependency pytest to v9.0.3 [security]#16632
renovate-bot wants to merge 1 commit intogoogleapis:mainfrom
renovate-bot:renovate/pypi-pytest-vulnerability

Conversation

@renovate-bot
Copy link
Copy Markdown
Contributor

@renovate-bot renovate-bot commented Apr 13, 2026

This PR contains the following updates:

Package Change Age Confidence
pytest (changelog) ==9.0.0==9.0.3 age confidence

GitHub Vulnerability Alerts

CVE-2025-71176

pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, which allows local users to cause a denial of service or possibly gain privileges.


Release Notes

pytest-dev/pytest (pytest)

v9.0.3

Compare Source

pytest 9.0.3 (2026-04-07)

Bug fixes

  • #​12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

  • #​13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

    Previously this resulted in an internal assertion failure during plugin loading.

    Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

  • #​13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

  • #​14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

  • #​14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

  • #​13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.
  • #​13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.
  • #​14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.
  • #​14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

  • #​12689: The test reports are now published to Codecov from GitHub Actions.
    The test statistics is visible on the web interface.

    -- by aleguy02

v9.0.2

Compare Source

pytest 9.0.2 (2025-12-06)

Bug fixes

  • #​13896: The terminal progress feature added in pytest 9.0.0 has been disabled by default, except on Windows, due to compatibility issues with some terminal emulators.

    You may enable it again by passing -p terminalprogress. We may enable it by default again once compatibility improves in the future.

    Additionally, when the environment variable TERM is dumb, the escape codes are no longer emitted, even if the plugin is enabled.

  • #​13904: Fixed the TOML type of the tmp_path_retention_count settings in the API reference from number to string.

  • #​13946: The private config.inicfg attribute was changed in a breaking manner in pytest 9.0.0.
    Due to its usage in the ecosystem, it is now restored to working order using a compatibility shim.
    It will be deprecated in pytest 9.1 and removed in pytest 10.

  • #​13965: Fixed quadratic-time behavior when handling unittest subtests in Python 3.10.

Improved documentation

  • #​4492: The API Reference now contains cross-reference-able documentation of pytest's command-line flags <command-line-flags>.

v9.0.1

Compare Source

pytest 9.0.1 (2025-11-12)

Bug fixes

  • #​13895: Restore support for skipping tests via raise unittest.SkipTest.
  • #​13896: The terminal progress plugin added in pytest 9.0 is now automatically disabled when iTerm2 is detected, it generated desktop notifications instead of the desired functionality.
  • #​13904: Fixed the TOML type of the verbosity settings in the API reference from number to string.
  • #​13910: Fixed UserWarning: Do not expect file_or_dir on some earlier Python 3.12 and 3.13 point versions.

Packaging updates and notes for downstreams

  • #​13933: The tox configuration has been adjusted to make sure the desired
    version string can be passed into its package_env through
    the SETUPTOOLS_SCM_PRETEND_VERSION_FOR_PYTEST environment
    variable as a part of the release process -- by webknjaz.

Contributor-facing changes

  • #​13891, #​13942: The CI/CD part of the release automation is now capable of
    creating GitHub Releases without having a Git checkout on
    disk -- by bluetech and webknjaz.
  • #​13933: The tox configuration has been adjusted to make sure the desired
    version string can be passed into its package_env through
    the SETUPTOOLS_SCM_PRETEND_VERSION_FOR_PYTEST environment
    variable as a part of the release process -- by webknjaz.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate-bot renovate-bot requested a review from a team as a code owner April 13, 2026 18:50
@trusted-contributions-gcf trusted-contributions-gcf bot added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Apr 13, 2026
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the pytest dependency from version 9.0.0 to 9.0.3 in the packages/gapic-generator/requirements.txt file. I have no feedback to provide.

@renovate-bot renovate-bot force-pushed the renovate/pypi-pytest-vulnerability branch from 4ab9039 to c33e5ac Compare April 13, 2026 21:49
@renovate-bot renovate-bot requested review from a team as code owners April 13, 2026 21:49
@renovate-bot renovate-bot requested review from GarrettWu and removed request for a team April 13, 2026 21:49
@yoshi-kokoro yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Apr 13, 2026
@renovate-bot renovate-bot force-pushed the renovate/pypi-pytest-vulnerability branch from c33e5ac to c2c2f94 Compare April 13, 2026 23:35
@trusted-contributions-gcf trusted-contributions-gcf bot added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Apr 13, 2026
@yoshi-kokoro yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Apr 13, 2026
@renovate-bot renovate-bot force-pushed the renovate/pypi-pytest-vulnerability branch from c2c2f94 to f15b29b Compare April 14, 2026 01:53
@renovate-bot renovate-bot requested a review from a team as a code owner April 14, 2026 01:53
@trusted-contributions-gcf trusted-contributions-gcf bot added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Apr 14, 2026
@yoshi-kokoro yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Apr 14, 2026
@renovate-bot renovate-bot force-pushed the renovate/pypi-pytest-vulnerability branch from f15b29b to c56d31f Compare April 14, 2026 06:23
@trusted-contributions-gcf trusted-contributions-gcf bot added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Apr 14, 2026
@parthea parthea closed this Apr 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

kokoro:force-run Add this label to force Kokoro to re-run the tests.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants