[dependabot]

Bumps pytest from 9.0.2 to 9.0.3.

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

• #12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

• #13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

  Previously this resulted in an internal assertion failure during plugin loading.

  Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

• #13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

• #14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

• #14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

• #13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.
• #13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.
• #14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.
• #14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

• #12689: The test reports are now published to Codecov from GitHub Actions. The test statistics is visible on the web interface.

  -- by aleguy02

Commits

• a7d58d7 Prepare release version 9.0.3
• 089d981 Merge pull request #14366 from bluetech/revert-14193-backport
• 8127eaf Revert "Fix: assertrepr_compare respects dict insertion order (#14050) (#14193)"
• 99a7e60 Merge pull request #14363 from pytest-dev/patchback/backports/9.0.x/95d8423bd...
• ddee02a Merge pull request #14343 from bluetech/cve-2025-71176-simple
• 74eac69 doc: Update training info (#14298) (#14301)
• f92dee7 Merge pull request #14267 from pytest-dev/patchback/backports/9.0.x/d6fa26c62...
• 7ee58ac Merge pull request #12378 from Pierre-Sassoulas/fix-implicit-str-concat-and-d...
• 37da870 Merge pull request #14259 from mitre88/patch-4 (#14268)
• c34bfa3 Add explanation for string context diffs (#14257) (#14266)
• Additional commits viewable in compare view

[greptile-apps]

Greptile Summary

Bumps pytest from 9.0.2 to 9.0.3 in the dipg_safety_env environment, picking up a security fix for CVE-2025-71176 (insecure temporary directory usage) along with several bug fixes. The pyproject.toml minimum version constraint is also tightened from >=8.0.0 to >=9.0.3; the uv.lock is regenerated accordingly.

Confidence Score: 5/5

• Safe to merge — routine patch-level security update with no logic changes.
• Only two generated/config files are changed (pyproject.toml constraint tightening and regenerated uv.lock). The update addresses a real CVE (CVE-2025-71176) and four other bug fixes. No application code is touched and no alignment invariants are at stake.
• No files require special attention.

Important Files Changed

Filename	Overview
envs/dipg_safety_env/pyproject.toml	Tightens pytest minimum version constraint from >=8.0.0 to >=9.0.3, picking up CVE-2025-71176 (insecure temp dir) fix.
envs/dipg_safety_env/uv.lock	Generated lock file updated to resolve pytest 9.0.3 with platform-specific resolution markers; no manual changes needed.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[pyproject.toml\npytest>=8.0.0] -->|Dependabot bump| B[pyproject.toml\npytest>=9.0.3]
    B --> C[uv.lock regenerated\npytest==9.0.3]
    C --> D{Security fixes included}
    D -->|CVE-2025-71176| E[Insecure temp dir — fixed]
    D -->|#13634| F[conftest -p disable error — fixed]
    D -->|#13734| G[exceptiongroup crash — fixed]

Loading

_{Reviews (1): Last reviewed commit: "Bump pytest from 9.0.2 to 9.0.3 in /envs..." | Re-trigger Greptile}

[Darktex]

Automated review: patch-level bump of pytest (9.0.2 to 9.0.3) in /envs/dipg_safety_env. Diff verified clean. Approving.

[Darktex]

Patch bump of pytest (9.0.2 -> 9.0.3). Diff scope limited to envs/dipg_safety_env pyproject.toml pin and uv.lock. LGTM.

[Darktex]

Note: This is an automated review by Claude Code, not a human review.

---

Dependabot bump of pytest 9.0.2→9.0.3 in envs/dipg_safety_env. Dev-only dep; patch release with bugfixes only, no breaking changes. CI green; only pyproject.toml/uv.lock touched. Looks safe to merge.

---

Automated review by Claude Code | Learn more

[burtenshaw]

Superseded by merged rollup PR #562, which includes this dependency update along with the rest of the current Dependabot environment queue.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.