[dependabot]

Bumps pytest from 9.0.2 to 9.0.3.

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

• #12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

• #13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

  Previously this resulted in an internal assertion failure during plugin loading.

  Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

• #13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

• #14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

• #14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

• #13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.
• #13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.
• #14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.
• #14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

• #12689: The test reports are now published to Codecov from GitHub Actions. The test statistics is visible on the web interface.

  -- by aleguy02

Commits

• a7d58d7 Prepare release version 9.0.3
• 089d981 Merge pull request #14366 from bluetech/revert-14193-backport
• 8127eaf Revert "Fix: assertrepr_compare respects dict insertion order (#14050) (#14193)"
• 99a7e60 Merge pull request #14363 from pytest-dev/patchback/backports/9.0.x/95d8423bd...
• ddee02a Merge pull request #14343 from bluetech/cve-2025-71176-simple
• 74eac69 doc: Update training info (#14298) (#14301)
• f92dee7 Merge pull request #14267 from pytest-dev/patchback/backports/9.0.x/d6fa26c62...
• 7ee58ac Merge pull request #12378 from Pierre-Sassoulas/fix-implicit-str-concat-and-d...
• 37da870 Merge pull request #14259 from mitre88/patch-4 (#14268)
• c34bfa3 Add explanation for string context diffs (#14257) (#14266)
• Additional commits viewable in compare view

[greptile-apps]

Greptile Summary

Bumps pytest from 9.0.2 to 9.0.3 in envs/finrl_env, also tightening the lower bound in pyproject.toml from >=8.0.0 to >=9.0.3. The lock file is regenerated and gains audioop-lts for Python 3.13 compatibility. The patch release fixes CVE-2025-71176 (insecure temporary directory use) among other minor bug fixes.

Confidence Score: 5/5

• Safe to merge — routine patch-release security bump with no logic changes.
• Only dependency metadata and the lock file are changed. The new version fixes a CVE; no API surface or behavior is altered. All remaining findings are P2 or lower — none identified.
• No files require special attention.

Important Files Changed

Filename	Overview
envs/finrl_env/pyproject.toml	Lower bound for pytest tightened from >=8.0.0 to >=9.0.3, pinning to the patched version that fixes CVE-2025-71176 (insecure temporary directory use).
envs/finrl_env/uv.lock	Lock file updated: pytest bumped to 9.0.3, revision incremented to 3, audioop-lts added for Python 3.13 compatibility, and resolution markers split to distinguish 3.12.x from >=3.13.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[dependabot detects pytest 9.0.3] --> B[pyproject.toml\nlower bound: >=8.0.0 → >=9.0.3]
    B --> C[uv.lock regenerated\nrevision 2 → 3]
    C --> D[pytest 9.0.3 resolved\nCVE-2025-71176 fixed]
    C --> E[audioop-lts added\nPython 3.13 compatibility]

Loading

_{Reviews (1): Last reviewed commit: "Bump pytest from 9.0.2 to 9.0.3 in /envs..." | Re-trigger Greptile}

[Darktex]

Automated review: patch-level bump of pytest (9.0.2 to 9.0.3) in /envs/finrl_env. Diff verified clean. Approving.

[Darktex]

Patch bump of pytest (9.0.2 -> 9.0.3). Diff scope limited to envs/finrl_env pyproject.toml pin and uv.lock. LGTM.

[Darktex]

Note: This is an automated review by Claude Code, not a human review.

---

Dependabot bump of pytest 9.0.2→9.0.3 in envs/finrl_env. Dev-only dep; patch release with bugfixes only, no breaking changes. CI green; only pyproject.toml/uv.lock touched. Looks safe to merge.

---

Automated review by Claude Code | Learn more

[burtenshaw]

Superseded by merged rollup PR #562, which includes this dependency update along with the rest of the current Dependabot environment queue.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.