[dependabot]

Bumps pytest from 9.0.2 to 9.0.3.

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

• #12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

• #13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

  Previously this resulted in an internal assertion failure during plugin loading.

  Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

• #13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

• #14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

• #14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

• #13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.
• #13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.
• #14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.
• #14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

• #12689: The test reports are now published to Codecov from GitHub Actions. The test statistics is visible on the web interface.

  -- by aleguy02

Commits

• a7d58d7 Prepare release version 9.0.3
• 089d981 Merge pull request #14366 from bluetech/revert-14193-backport
• 8127eaf Revert "Fix: assertrepr_compare respects dict insertion order (#14050) (#14193)"
• 99a7e60 Merge pull request #14363 from pytest-dev/patchback/backports/9.0.x/95d8423bd...
• ddee02a Merge pull request #14343 from bluetech/cve-2025-71176-simple
• 74eac69 doc: Update training info (#14298) (#14301)
• f92dee7 Merge pull request #14267 from pytest-dev/patchback/backports/9.0.x/d6fa26c62...
• 7ee58ac Merge pull request #12378 from Pierre-Sassoulas/fix-implicit-str-concat-and-d...
• 37da870 Merge pull request #14259 from mitre88/patch-4 (#14268)
• c34bfa3 Add explanation for string context diffs (#14257) (#14266)
• Additional commits viewable in compare view

[greptile-apps]

Greptile Summary

Bumps pytest from 9.0.2 to 9.0.3 in envs/echo_env, picking up a security fix for CVE-2025-71176 (insecure temporary directory) along with several bug fixes. The pyproject.toml lower bound is tightened from >=8.0.0 to >=9.0.3 (standard Dependabot behavior for security patches), and the lock file hashes are updated correctly.

Confidence Score: 5/5

• This PR is safe to merge — it's a routine security patch bump with no logic changes.
• Only two files changed: a version constraint update in pyproject.toml and the corresponding lock file regeneration. The patch addresses CVE-2025-71176 and other bug fixes. No code logic, API, or invariants are touched. All P2 or lower — no blockers.
• No files require special attention.

Important Files Changed

Filename	Overview
envs/echo_env/pyproject.toml	Lower bound for pytest dev dependency tightened from >=8.0.0 to >=9.0.3 to pick up CVE-2025-71176 fix; straightforward and correct for a security patch bump.
envs/echo_env/uv.lock	Lock file updated to pytest 9.0.3 with correct PyPI URLs, SHA-256 hashes, and revision bump; no issues.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Dependabot detects pytest 9.0.3] --> B[CVE-2025-71176 security fix included]
    B --> C[pyproject.toml: pytest >=8.0.0 → >=9.0.3]
    C --> D[uv.lock: pinned to 9.0.3 with updated SHA-256 hashes]
    D --> E[echo_env dev dependency resolved to pytest 9.0.3]

Loading

_{Reviews (1): Last reviewed commit: "Bump pytest from 9.0.2 to 9.0.3 in /envs..." | Re-trigger Greptile}

[Darktex]

Automated review: patch-level bump of pytest (9.0.2 to 9.0.3) in /envs/echo_env. Diff verified clean. Approving.

[Darktex]

Patch bump of pytest (9.0.2 -> 9.0.3). Diff scope limited to envs/echo_env pyproject.toml pin and uv.lock. LGTM.

[Darktex]

Note: This is an automated review by Claude Code, not a human review.

---

Dependabot bump of pytest 9.0.2→9.0.3 in envs/echo_env. Dev-only dep; patch release with bugfixes only, no breaking changes. CI green; only pyproject.toml/uv.lock touched. Looks safe to merge.

---

Automated review by Claude Code | Learn more

[burtenshaw]

Superseded by merged rollup PR #562, which includes this dependency update along with the rest of the current Dependabot environment queue.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.