chore(deps): update dependency pytest to v9 [security] by renovate-bot · Pull Request #2763 · googleapis/google-api-python-client · GitHub

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
pytest (changelog)	==8.2.2 → ==9.0.3

pytest has vulnerable tmpdir handling

CVE-2025-71176 / GHSA-6w46-j5rx-g56g

More information

Details

pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, which allows local users to cause a denial of service or possibly gain privileges.

Severity

CVSS Score: 6.8 / 10 (Medium)
Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

pytest-dev/pytest (pytest)

v9.0.3

Compare Source

pytest 9.0.3 (2026-04-07)

Bug fixes

#12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.
#13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

Previously this resulted in an internal assertion failure during plugin loading.

Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.
#13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.
#14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.
#14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

#13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.
#13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.
#14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.
#14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

#12689: The test reports are now published to Codecov from GitHub Actions.
The test statistics is visible on the web interface.

-- by aleguy02

v9.0.2

Compare Source

pytest 9.0.2 (2025-12-06)

Bug fixes

#13896: The terminal progress feature added in pytest 9.0.0 has been disabled by default, except on Windows, due to compatibility issues with some terminal emulators.

You may enable it again by passing -p terminalprogress. We may enable it by default again once compatibility improves in the future.

Additionally, when the environment variable TERM is dumb, the escape codes are no longer emitted, even if the plugin is enabled.
#13904: Fixed the TOML type of the tmp_path_retention_count settings in the API reference from number to string.
#13946: The private config.inicfg attribute was changed in a breaking manner in pytest 9.0.0.
Due to its usage in the ecosystem, it is now restored to working order using a compatibility shim.
It will be deprecated in pytest 9.1 and removed in pytest 10.
#13965: Fixed quadratic-time behavior when handling unittest subtests in Python 3.10.

Improved documentation

#4492: The API Reference now contains cross-reference-able documentation of pytest's command-line flags <command-line-flags>.

v9.0.1

Compare Source

pytest 9.0.1 (2025-11-12)

Bug fixes

#13895: Restore support for skipping tests via raise unittest.SkipTest.
#13896: The terminal progress plugin added in pytest 9.0 is now automatically disabled when iTerm2 is detected, it generated desktop notifications instead of the desired functionality.
#13904: Fixed the TOML type of the verbosity settings in the API reference from number to string.
#13910: Fixed UserWarning: Do not expect file_or_dir on some earlier Python 3.12 and 3.13 point versions.

Packaging updates and notes for downstreams

#13933: The tox configuration has been adjusted to make sure the desired
version string can be passed into its package_env through
the SETUPTOOLS_SCM_PRETEND_VERSION_FOR_PYTEST environment
variable as a part of the release process -- by webknjaz.

Contributor-facing changes

#13891, #13942: The CI/CD part of the release automation is now capable of
creating GitHub Releases without having a Git checkout on
disk -- by bluetech and webknjaz.
#13933: The tox configuration has been adjusted to make sure the desired
version string can be passed into its package_env through
the SETUPTOOLS_SCM_PRETEND_VERSION_FOR_PYTEST environment
variable as a part of the release process -- by webknjaz.

v9.0.0

Compare Source

pytest 9.0.0 (2025-11-05)

New features

#1367: Support for subtests has been added.

subtests <subtests> are an alternative to parametrization, useful in situations where the parametrization values are not all known at collection time.

Example:
```
def contains_docstring(p: Path) -> bool:
    """Return True if the given Python file contains a top-level docstring."""
    ...

def test_py_files_contain_docstring(subtests: pytest.Subtests) -> None:
    for path in Path.cwd().glob("*.py"):
        with subtests.test(path=str(path)):
            assert contains_docstring(path)
```
Each assert failure or error is caught by the context manager and reported individually, giving a clear picture of all files that are missing a docstring.

In addition, unittest.TestCase.subTest is now also supported.

This feature was originally implemented as a separate plugin in pytest-subtests, but since then has been merged into the core.

[!NOTE]
This feature is experimental and will likely evolve in future releases. By that we mean that we might change how subtests are reported on failure, but the functionality and how to use it are stable.
#13743: Added support for native TOML configuration files.

While pytest, since version 6, supports configuration in pyproject.toml files under [tool.pytest.ini_options],
it does so in an "INI compatibility mode", where all configuration values are treated as strings or list of strings.
Now, pytest supports the native TOML data model.

In pyproject.toml, the native TOML configuration is under the [tool.pytest] table.
```
# pyproject.toml
[tool.pytest]
minversion = "9.0"
addopts = ["-ra", "-q"]
testpaths = [
    "tests",
    "integration",
]
```
The [tool.pytest.ini_options] table remains supported, but both tables cannot be used at the same time.

If you prefer to use a separate configuration file, or don't use pyproject.toml, you can use pytest.toml or .pytest.toml:
```
# pytest.toml or .pytest.toml
[pytest]
minversion = "9.0"
addopts = ["-ra", "-q"]
testpaths = [
    "tests",
    "integration",
]
```
The documentation now (sometimes) shows configuration snippets in both TOML and INI formats, in a tabbed interface.

See config file formats for full details.
#13823: Added a "strict mode" enabled by the strict configuration option.

When set to true, the strict option currently enables
- strict_config
- strict_markers
- strict_parametrization_ids
- strict_xfail
The individual strictness options can be explicitly set to override the global strict setting.

The previously-deprecated --strict command-line flag now enables strict mode.

If pytest adds new strictness options in the future, they will also be enabled in strict mode.
Therefore, you should only enable strict mode if you use a pinned/locked version of pytest,
or if you want to proactively adopt new strictness options as they are added.

See strict mode for more details.
#13737: Added the strict_parametrization_ids configuration option.

When set, pytest emits an error if it detects non-unique parameter set IDs,
rather than automatically making the IDs unique by adding 0, 1, ... to them.
This can be particularly useful for catching unintended duplicates.
#13072: Added support for displaying test session progress in the terminal tab using the OSC 9;4; ANSI sequence.
When pytest runs in a supported terminal emulator like ConEmu, Gnome Terminal, Ptyxis, Windows Terminal, Kitty or Ghostty,
you'll see the progress in the terminal tab or window,
allowing you to monitor pytest's progress at a glance.

This feature is automatically enabled when running in a TTY. It is implemented as an internal plugin. If needed, it can be disabled as follows:
- On a user level, using -p no:terminalprogress on the command line or via an environment variable PYTEST_ADDOPTS='-p no:terminalprogress'.
- On a project configuration level, using addopts = "-p no:terminalprogress".
#478: Support PEP420 (implicit namespace packages) as --pyargs target when consider_namespace_packages is true in the config.

Previously, this option only impacted package imports, now it also impacts tests discovery.
#13678: Added a new faulthandler_exit_on_timeout configuration option set to "false" by default to let faulthandler interrupt the pytest process after a timeout in case of deadlock.

Previously, a faulthandler timeout would only dump the traceback of all threads to stderr, but would not interrupt the pytest process.

-- by ogrisel.
#13829: Added support for configuration option aliases via the aliases parameter in Parser.addini() <pytest.Parser.addini>.

Plugins can now register alternative names for configuration options,
allowing for more flexibility in configuration naming and supporting backward compatibility when renaming options.
The canonical name always takes precedence if both the canonical name and an alias are specified in the configuration file.

Improvements in existing functionality

#13330: Having pytest configuration spread over more than one file (for example having both a pytest.ini file and pyproject.toml with a [tool.pytest.ini_options] table) will now print a warning to make it clearer to the user that only one of them is actually used.

-- by sgaist
#13574: The single argument --version no longer loads the entire plugin infrastructure, making it faster and more reliable when displaying only the pytest version.

Passing --version twice (e.g., pytest --version --version) retains the original behavior, showing both the pytest version and plugin information.

[!NOTE]
Since --version is now processed early, it only takes effect when passed directly via the command line. It will not work if set through other mechanisms, such as PYTEST_ADDOPTS or addopts.
#13823: Added strict_xfail as an alias to the xfail_strict option,
strict_config as an alias to the --strict-config flag,
and strict_markers as an alias to the --strict-markers flag.
This makes all strictness options consistently have configuration options with the prefix strict_.
#13700: --junitxml no longer prints the generated xml file summary at the end of the pytest session when --quiet is given.
#13732: Previously, when filtering warnings, pytest would fail if the filter referenced a class that could not be imported. Now, this only outputs a message indicating the problem.
#13859: Clarify the error message for pytest.raises() when a regex match fails.
#13861: Better sentence structure in a test's expected error message. Previously, the error message would be "expected exception must be <expected>, but got <actual>". Now, it is "Expected <expected>, but got <actual>".

Removals and backward incompatible breaking changes

#12083: Fixed a bug where an invocation such as pytest a/ a/b would cause only tests from a/b to run, and not other tests under a/.

The fix entails a few breaking changes to how such overlapping arguments and duplicates are handled:
1. pytest a/b a/ or pytest a/ a/b are equivalent to pytest a; if an argument overlaps another arguments, only the prefix remains.
2. pytest x.py x.py is equivalent to pytest x.py; previously such an invocation was taken as an explicit request to run the tests from the file twice.
If you rely on these behaviors, consider using --keep-duplicates <duplicate-paths>, which retains its existing behavior (including the bug).
#13719: Support for Python 3.9 is dropped following its end of life.
#13766: Previously, pytest would assume it was running in a CI/CD environment if either of the environment variables $CI or $BUILD_NUMBER was defined;
now, CI mode is only activated if at least one of those variables is defined and set to a non-empty value.
#13779: PytestRemovedIn9Warning deprecation warnings are now errors by default.

Following our plan to remove deprecated features with as little disruption as
possible, all warnings of type PytestRemovedIn9Warning now generate errors
instead of warning messages by default.

The affected features will be effectively removed in pytest 9.1, so please consult the
deprecations section in the docs for directions on how to update existing code.

In the pytest 9.0.X series, it is possible to change the errors back into warnings as a
stopgap measure by adding this to your pytest.ini file:
```
[pytest]
filterwarnings =
    ignore::pytest.PytestRemovedIn9Warning
```
But this will stop working when pytest 9.1 is released.

If you have concerns about the removal of a specific feature, please add a
comment to 13779.

Deprecations (removal in next major release)

#13807: monkeypatch.syspath_prepend() <pytest.MonkeyPatch.syspath_prepend> now issues a deprecation warning when the prepended path contains legacy namespace packages (those using pkg_resources.declare_namespace()).
Users should migrate to native namespace packages (420).
See monkeypatch-fixup-namespace-packages for details.

Bug fixes

#13445: Made the type annotations of pytest.skip and friends more spec-complaint to have them work across more type checkers.
#13537: Fixed a bug in which ExceptionGroup with only Skipped exceptions in teardown was not handled correctly and showed as error.
#13598: Fixed possible collection confusion on Windows when short paths and symlinks are involved.
#13716: Fixed a bug where a nonsensical invocation like pytest x.py[a] (a file cannot be parametrized) was silently treated as pytest x.py. This is now a usage error.
#13722: Fixed a misleading assertion failure message when using pytest.approx on mappings with differing lengths.
#13773: Fixed the static fixture closure calculation to properly consider transitive dependencies requested by overridden fixtures.
#13816: Fixed pytest.approx which now returns a clearer error message when comparing mappings with different keys.
#13849: Hidden .pytest.ini files are now picked up as the config file even if empty.
This was an inconsistency with non-hidden pytest.ini.
#13865: Fixed --show-capture with --tb=line.
#13522: Fixed pytester in subprocess mode ignored all :attr`pytester.plugins <pytest.Pytester.plugins>` except the first.

Fixed pytester in subprocess mode silently ignored non-str pytester.plugins <pytest.Pytester.plugins>.
Now it errors instead.
If you are affected by this, specify the plugin by name, or switch the affected tests to use pytester.runpytest_inprocess <pytest.Pytester.runpytest_inprocess> explicitly instead.

Packaging updates and notes for downstreams

#13791: Minimum requirements on iniconfig and packaging were bumped to 1.0.1 and 22.0.0, respectively.

Contributor-facing changes

#12244: Fixed self-test failures when TERM=dumb.
#12474: Added scheduled GitHub Action Workflow to run Sphinx linkchecks in repo documentation.
#13621: pytest's own testsuite now handles the lsof command hanging (e.g. due to unreachable network filesystems), with the affected selftests being skipped after 10 seconds.
#13638: Fixed deprecated gh pr new command in scripts/prepare-release-pr.py.
The script now uses gh pr create which is compatible with GitHub CLI v2.0+.
#13695: Flush stdout and stderr in Pytester.run to avoid truncated outputs in test_faulthandler.py::test_timeout on CI -- by ogrisel.
#13771: Skip test_do_not_collect_symlink_siblings on Windows environments without symlink support to avoid false negatives.
#13841: tox>=4 is now required when contributing to pytest.
#13625: Added missing docstrings to pytest_addoption(), pytest_configure(), and cacheshow() functions in cacheprovider.py.

Miscellaneous internal changes

#13830: Configuration overrides (-o/--override-ini) are now processed during startup rather than during config.getini() <pytest.Config.getini>.

v8.4.2

Compare Source

pytest 8.4.2 (2025-09-03)

Bug fixes

#13478: Fixed a crash when using console_output_style{.interpreted-text role="confval"} with times and a module is skipped.
#13530: Fixed a crash when using pytest.approx{.interpreted-text role="func"} and decimal.Decimal{.interpreted-text role="class"} instances with the decimal.FloatOperation{.interpreted-text role="class"} trap set.
#13549: No longer evaluate type annotations in Python 3.14 when inspecting function signatures.

This prevents crashes during module collection when modules do not explicitly use from __future__ import annotations and import types for annotations within a if TYPE_CHECKING: block.
#13559: Added missing [int]{.title-ref} and [float]{.title-ref} variants to the [Literal]{.title-ref} type annotation of the [type]{.title-ref} parameter in pytest.Parser.addini{.interpreted-text role="meth"}.
#13563: pytest.approx{.interpreted-text role="func"} now only imports numpy if NumPy is already in sys.modules. This fixes unconditional import behavior introduced in [8.4.0]{.title-ref}.

Improved documentation

#13577: Clarify that pytest_generate_tests is discovered in test modules/classes; other hooks must be in conftest.py or plugins.

Contributor-facing changes

#13480: Self-testing: fixed a few test failures when run with -Wdefault or a similar override.
#13547: Self-testing: corrected expected message for test_doctest_unexpected_exception in Python 3.14.
#13684: Make pytest's own testsuite insensitive to the presence of the CI environment variable -- by ogrisel{.interpreted-text role="user"}.

v8.4.1

Compare Source

pytest 8.4.1 (2025-06-17)

Bug fixes

#13461: Corrected _pytest.terminal.TerminalReporter.isatty to support
being called as a method. Before it was just a boolean which could
break correct code when using -o log_cli=true).
#13477: Reintroduced pytest.PytestReturnNotNoneWarning{.interpreted-text role="class"} which was removed by accident in pytest [8.4]{.title-ref}.

This warning is raised when a test functions returns a value other than None, which is often a mistake made by beginners.

See return-not-none{.interpreted-text role="ref"} for more information.
#13497: Fixed compatibility with Twisted 25+.

Improved documentation

#13492: Fixed outdated warning about faulthandler not working on Windows.

v8.4.0

Compare Source

pytest 8.4.0 (2025-06-02)

Removals and backward incompatible breaking changes

#11372: Async tests will now fail, instead of warning+skipping, if you don't have any suitable plugin installed.
#12346: Tests will now fail, instead of raising a warning, if they return any value other than None.
#12874: We dropped support for Python 3.8 following its end of life (2024-10-07).
#12960: Test functions containing a yield now cause an explicit error. They have not been run since pytest 4.0, and were previously marked as an expected failure and deprecation warning.

See the docs <yield tests deprecated>{.interpreted-text role="ref"} for more information.

Deprecations (removal in next major release)

#10839: Requesting an asynchronous fixture without a [pytest_fixture_setup]{.title-ref} hook that resolves it will now give a DeprecationWarning. This most commonly happens if a sync test requests an async fixture. This should have no effect on a majority of users with async tests or fixtures using async pytest plugins, but may affect non-standard hook setups or autouse=True. For guidance on how to work around this warning see sync-test-async-fixture{.interpreted-text role="ref"}.

New features

#11538: Added pytest.RaisesGroup{.interpreted-text role="class"} as an equivalent to pytest.raises{.interpreted-text role="func"} for expecting ExceptionGroup{.interpreted-text role="exc"}. Also adds pytest.RaisesExc{.interpreted-text role="class"} which is now the logic behind pytest.raises{.interpreted-text role="func"} and used as parameter to pytest.RaisesGroup{.interpreted-text role="class"}. RaisesGroup includes the ability to specify multiple different expected exceptions, the structure of nested exception groups, and flags for emulating except* <except_star>{.interpreted-text role="ref"}. See assert-matching-exception-groups{.interpreted-text role="ref"} and docstrings for more information.
#12081: Added capteesys{.interpreted-text role="fixture"} to capture AND pass output to next handler set by --capture=.
#12504: pytest.mark.xfail{.interpreted-text role="func"} now accepts pytest.RaisesGroup{.interpreted-text role="class"} for the raises parameter when you expect an exception group. You can also pass a pytest.RaisesExc{.interpreted-text role="class"} if you e.g. want to make use of the check parameter.
#12713: New [--force-short-summary]{.title-ref} option to force condensed summary output regardless of verbosity level.

This lets users still see condensed summary output of failures for quick reference in log files from job outputs, being especially useful if non-condensed output is very verbose.
#12749: pytest traditionally collects classes/functions in the test module namespace even if they are imported from another file.

For example:

contents of src/domain.py

class Testament: ...

contents of tests/test_testament.py

from domain import Testament

def test_testament(): ...
```

In this scenario with the default options, pytest will collect the class [Testament]{.title-ref} from [tests/test_testament.py]{.title-ref} because it starts with [Test]{.title-ref}, even though in this case it is a production class being imported in the test module namespace.

This behavior can now be prevented by setting the new `collect_imported_tests`{.interpreted-text role="confval"} configuration option to `false`, which will make pytest collect classes/functions from test files **only** if they are defined in that file.

\-- by `FreerGit`{.interpreted-text role="user"}

#12765: Thresholds to trigger snippet truncation can now be set with truncation_limit_lines{.interpreted-text role="confval"} and truncation_limit_chars{.interpreted-text role="confval"}.

See truncation-params{.interpreted-text role="ref"} for more information.
#13125: console_output_style{.interpreted-text role="confval"} now supports times to show execution time of each test.
#13192: pytest.raises{.interpreted-text role="func"} will now raise a warning when passing an empty string to match, as this will match against any value. Use match="^$" if you want to check that an exception has no message.
#13192: pytest.raises{.interpreted-text role="func"} will now print a helpful string diff if matching fails and the match parameter has ^ and $ and is otherwise escaped.
#13192: You can now pass with pytest.raises(check=fn): <pytest.raises>{.interpreted-text role="func"}, where fn is a function which takes a raised exception and returns a boolean. The raises fails if no exception was raised (as usual), passes if an exception is raised and fn returns True (as well as match and the type matching, if specified, which are checked before), and propagates the exception if fn returns False (which likely also fails the test).
#13228: hidden-param{.interpreted-text role="ref"} can now be used in id of pytest.param{.interpreted-text role="func"} or in
ids of Metafunc.parametrize <pytest.Metafunc.parametrize>{.interpreted-text role="py:func"}.
It hides the parameter set from the test name.
#13253: New flag: --disable-plugin-autoload <disable_plugin_autoload>{.interpreted-text role="ref"} which works as an alternative to PYTEST_DISABLE_PLUGIN_AUTOLOAD{.interpreted-text role="envvar"} when setting environment variables is inconvenient; and allows setting it in config files with addopts{.interpreted-text role="confval"}.

Improvements in existing functionality

#10224: pytest's short and long traceback styles (how-to-modifying-python-tb-printing{.interpreted-text role="ref"})
now have partial 657{.interpreted-text role="pep"} support and will show specific code segments in the
traceback.

================================= FAILURES =================================
_______________________ test_gets_correct_tracebacks _______________________

test_tracebacks.py:12: in test_gets_correct_tracebacks
    assert manhattan_distance(p1, p2) == 1
           ^^^^^^^^^^^^^^^^^^^^^^^^^^
test_tracebacks.py:6: in manhattan_distance
    return abs(point_1.x - point_2.x) + abs(point_1.y - point_2.y)
                           ^^^^^^^^^
E   AttributeError: 'NoneType' object has no attribute 'x'

-- by ammaraskar{.interpreted-text role="user"}

#11118: Now pythonpath{.interpreted-text role="confval"} configures [$PYTHONPATH]{.title-ref} earlier than before during the initialization process, which now also affects plugins loaded via the [-p]{.title-ref} command-line option.

-- by millerdev{.interpreted-text role="user"}

#11381: The type parameter of the parser.addini method now accepts ["int"]{.title-ref} and "float" parameters, facilitating the parsing of configuration values in the configuration file.

Example:

def pytest_addoption(parser):
    parser.addini("int_value", type="int", default=2, help="my int value")
    parser.addini("float_value", type="float", default=4.2, help="my float value")

The [pytest.ini]{.title-ref} file:

[pytest]
int_value = 3
float_value = 5.4

#11525: Fixtures are now clearly represented in the output as a "fixture object", not as a normal function as before, making it easy for beginners to catch mistakes such as referencing a fixture declared in the same module but not requested in the test function.

-- by the-compiler{.interpreted-text role="user"} and glyphack{.interpreted-text role="user"}
#12426: A warning is now issued when pytest.mark.usefixtures ref{.interpreted-text role="ref"} is used without specifying any fixtures. Previously, empty usefixtures markers were silently ignored.
#12707: Exception chains can be navigated when dropped into Pdb in Python 3.13+.
#12736: Added a new attribute [name]{.title-ref} with the fixed value ["pytest tests"]{.title-ref} to the root tag [testsuites]{.title-ref} of the junit-xml generated by pytest.

This attribute is part of many junit-xml specifications and is even part of the [junit-10.xsd]{.title-ref} specification that pytest's implementation is based on.
#12943: If a test fails with an exceptiongroup with a single exception, the contained exception will now be displayed in the short test summary info.
#12958: A number of unraisable <unraisable>{.interpreted-text role="ref"} enhancements:
- Set the unraisable hook as early as possible and unset it as late as possible, to collect the most possible number of unraisable exceptions.
- Call the garbage collector just before unsetting the unraisable hook, to collect any straggling exceptions.
- Collect multiple unraisable exceptions per test phase.
- Report the tracemalloc{.interpreted-text role="mod"} allocation traceback (if available).
- Avoid using a generator based hook to allow handling StopIteration{.interpreted-text role="class"} in test failures.
- Report the unraisable exception as the cause of the pytest.PytestUnraisableExceptionWarning{.interpreted-text role="class"} exception if raised.
- Compute the repr of the unraisable object in the unraisable hook so you get the latest information if available, and should help with resurrection of the object.
#13010: pytest.approx{.interpreted-text role="func"} now can compare collections that contain numbers and non-numbers mixed.
#13016: A number of threadexception <unraisable>{.interpreted-text role="ref"} enhancements:
- Set the excepthook as early as possible and unset it as late as possible, to collect the most possible number of unhandled exceptions from threads.
- Collect multiple thread exceptions per test phase.
- Report the tracemalloc{.interpreted-text role="mod"} allocation traceback (if available).
- Avoid using a generator based hook to allow handling StopIteration{.interpreted-text role="class"} in test failures.
- Report the thread exception as the cause of the pytest.PytestUnhandledThreadExceptionWarning{.interpreted-text role="class"} exception if raised.
- Extract the name of the thread object in the excepthook which should help with resurrection of the thread.
#13031: An empty parameter set as in pytest.mark.parametrize([], ids=idfunc) will no longer trigger a call to idfunc with internal objects.
#13115: Allows supplying ExceptionGroup[Exception] and BaseExceptionGroup[BaseException] to pytest.raises to keep full typing on ExceptionInfo <pytest.ExceptionInfo>{.interpreted-text role="class"}:
```
with pytest.raises(ExceptionGroup[Exception]) as exc_info:
    some_function()
```
Parametrizing with other exception types remains an error - we do not check the types of child exceptions and thus do not permit code that might look like we do.
#13122: The --stepwise mode received a number of improvements:
- It no longer forgets the last failed test in case pytest is executed later without the flag.
  
  This enables the following workflow:
  1. Execute pytest with --stepwise, pytest then stops at the first failing test;
  2. Iteratively update the code and run the test in isolation, without the --stepwise flag (for example in an IDE), until it is fixed.
  3. Execute pytest with --stepwise again and pytest will continue from the previously failed test, and if it passes, continue on to the next tests.
  Previously, at step 3, pytest would start from the beginning, forgetting the previously failed test.
  
  This change however might cause issues if the --stepwise mode is used far apart in time, as the state might get stale, so the internal state will be reset automatically in case the test suite changes (for now only the number of tests are considered for this, we might change/improve this on the future).
- New --stepwise-reset/--sw-reset flag, allowing the user to explicitly reset the stepwise state and restart the workflow from the beginning.
#13308: Added official support for Python 3.14.
#13380: Fix ExceptionGroup{.interpreted-text role="class"} traceback filtering to exclude pytest internals.
#13415: The author metadata of the BibTex example is now correctly formatted with last names following first names.
An example of BibLaTex has been added.
BibTex and BibLaTex examples now clearly indicate that what is cited is software.

-- by willynilly{.interpreted-text role="user"}
#13420: Improved test collection performance by optimizing path resolution used in FSCollector.
#13457: The error message about duplicate parametrization no longer displays an internal stack trace.
#4112: Using pytest.mark.usefixtures <pytest.mark.usefixtures ref>{.interpreted-text role="ref"} on pytest.param{.interpreted-text role="func"} now produces an error instead of silently doing nothing.
#5473: Replace [:]{.title-ref} with [;]{.title-ref} in the assertion rewrite warning message so it can be filtered using standard Python warning filters before calling pytest.main{.interpreted-text role="func"}.

[#&#8203;6985](https://redirect.github.com/pytest-dev/pytest/issues/6985): Improved `pytest.approx`{.interpreted-text role="func"} to enhance the readability of value ranges and tolerances between 0.001 and 1000.

:   -   The [repr]{.title-ref} method now provides clearer output for values within those ranges, making it easier to interpret the results.

    -   Previously, the output for those ranges of values and tolerances was displayed in scientific notation (e.g., [42 ± 1.0e+00]{.title-ref}). The updated method now presents the tolerance as a decimal for better readability (e.g., [42 ± 1]{.title-ref}).

        Example:

        **Previous Output:**

        ``` console
        >>> pytest.approx(42, abs=1)
        42 ± 1.0e+00
        ```

        **Current Output:**

        ``` console
        >>> pytest.approx(42, abs=1)
        42 ± 1
        ```

    \-- by `fazeelghafoor`{.interpreted-text role="user"}

#7683: The formerly optional pygments dependency is now required, causing output always to be source-highlighted (unless disabled via the --code-highlight=no CLI option).

Bug fixes

#10404: Apply filterwarnings from config/cli as soon as possible, and revert them as late as possible
so that warnings as errors are collected throughout the pytest run and before the
unraisable and threadexcept hooks are removed.

This allows very late warnings and unraisable/threadexcept exceptions to fail the test suite.

This also changes the warning that the lsof plugin issues from PytestWarning to the new warning PytestFDWarning so it can be more easily filtered.
#11067: The test report is now consistent regardless if the test xfailed via pytest.mark.xfail <pytest.mark.xfail ref>{.interpreted-text role="ref"} or pytest.fail{.interpreted-text role="func"}.

Previously, xfailed tests via the marker would have the string "reason: " prefixed to the message, while those xfailed via the function did not. The prefix has been removed.
#12008: In 11220{.interpreted-text role="pr"}, an unintended change in reordering was introduced by changing the way indices were assigned to direct params. More specifically, before that change, the indices of direct params to metafunc's callspecs were assigned after all parametrizations took place. Now, that change is reverted.
#12863: Fix applying markers, including pytest.mark.parametrize <pytest.mark.parametrize ref>{.interpreted-text role="ref"} when placed above [@staticmethod]{.title-ref} or [@classmethod]{.title-ref}.
#12929: Handle StopIteration from test cases, setup and teardown correctly.
#12938: Fixed --durations-min argument not respected if -vv is used.
#12946: Fixed missing help for pdb{.interpreted-text role="mod"} commands wrapped by pytest -- by adamchainz{.interpreted-text role="user"}.
#12981: Prevent exceptions in pytest.Config.add_cleanup{.interpreted-text role="func"} callbacks preventing further cleanups.
#13047: Restore pytest.approx{.interpreted-text role="func"} handling of equality checks between [bool]{.title-ref} and [numpy.bool_]{.title-ref} types.

Comparing [bool]{.title-ref} and [numpy.bool_]{.title-ref} using pytest.approx{.interpreted-text role="func"} accidentally changed in version [8.3.4]{.title-ref} and [8.3.5]{.title-ref} to no longer match:
```
>>> import numpy as np
>>> from pytest import approx
>>> [np.True_, np.True_] == pytest.approx([True, True])
False
```
This has now been fixed:
```
>>> [np.True_, np.True_] == pytest.approx([True, True])
True
```
#13119: Improved handling of invalid regex patterns for filter warnings by providing a clear error message.
#13175: The diff is now also highlighted correctly when comparing two strings.
#13248: Fixed an issue where passing a scope in Metafunc.parametrize <pytest.Metafunc.parametrize>{.interpreted-text role="py:func"} with indirect=True
could result in other fixtures being unable to depend on the parametrized fixture.
#13291: Fixed repr of attrs objects in assertion failure messages when using attrs>=25.2.
#13312: Fixed a possible KeyError crash on PyPy during collection of tests involving higher-scoped parameters.
#13345: Fix type hints for pytest.TestReport.when{.interpreted-text role="attr"} and pytest.TestReport.location{.interpreted-text role="attr"}.
#13377: Fixed handling of test methods with positional-only parameter syntax.

Now, methods are supported that formally define self as positional-only
and/or fixture parameters as keyword-only, e.g.:
```
class TestClass:

    def test_method(self, /, *, fixture): ...
```
Before, this caused an internal error in pytest.
#13384: Fixed an issue where pytest could report negative durations.
#13420: Added lru_cache to nodes._check_initialpaths_for_relpath.
#9037: Honor disable_test_id_escaping_and_forfeit_all_rights_to_community_support{.interpreted-text role="confval"} when escaping ids in parametrized tests.

Improved documentation

#12535: [This
example]{.title-ref}<https://docs.pytest.org/en/latest/example/simple.html#making-test-result-information-available-in-fixtures>
showed print statements that do not exactly reflect what the
different branches actually do. The fix makes the example more precise.
#13218: Pointed out in the pytest.approx{.interpreted-text role="func"} documentation that it considers booleans unequal to numeric zero or one.
#13221: Improved grouping of CLI options in the --help output.
#6649: Added ~pytest.TerminalReporter{.interpreted-text role="class"} to the api-reference{.interpreted-text role="ref"} documentation page.
#8612: Add a recipe for handling abstract test classes in the documentation.

A new example has been added to the documentation to demonstrate how to use a mixin class to handle abstract
test classes without manually setting the __test__ attribute for subclasses.
This ensures that subclasses of abstract test classes are automatically collected by pytest.

Packaging updates and notes for downstreams

#13317: Specified minimum allowed versions of colorama, iniconfig,
and packaging; and bumped the minimum allowed version
of exceptiongroup for python_version<'3.11' from a release
candidate to a full release.

Contributor-facing changes

#12017: Mixed internal improvements:
- Migrate formatting to f-strings in some tests.
- Use type-safe constructs in JUnitXML tests.
- MovedMockTiming into _pytest.timing.
-- by RonnyPfannschmidt{.interpreted-text role="user"}
#12647: Fixed running the test suite with the hypothesis pytest plugin.

Miscellaneous internal changes

#6649: Added ~pytest.TerminalReporter{.interpreted-text role="class"} to the public pytest API, as it is part of the signature of the pytest_terminal_summary{.interpreted-text role="hook"} hook.

v8.3.5

Compare Source

pytest 8.3.5 (2025-03-02)

Bug fixes

#11777: Fixed issue where sequences were still being shortened even with -vv verbosity.
#12888: Fixed broken input when using Python 3.13+ and a libedit build of Python, such as on macOS or with uv-managed Python binaries from the python-build-standalone project. This could manifest e.g. by a broken prompt when using Pdb, or seeing empty inputs with manual usage of input() and suspended capturing.
#13026: Fixed AttributeError{.interpreted-text role="class"} crash when using --import-mode=importlib when top-level directory same name as another module of the standard library.
#13053: Fixed a regression in pytest 8.3.4 where, when using --import-mode=importlib, a directory containing py file with the same name would cause an ImportError
#13083: Fixed issue where pytest could crash if one of the collected directories got removed during collection.

Improved documentation

#12842: Added dedicated page about using types with pytest.

See types{.interpreted-text role="ref"} for detailed usage.

Contributor-facing changes

#13112: Fixed selftest failures in test_terminal.py with Pygments >= 2.19.0
#13256: Support for Towncrier versions released in 2024 has been re-enabled
when building Sphinx docs -- by webknjaz{.interpreted-text role="user"}.

v8.3.4

Compare Source

pytest 8.3.4 (2024-12-01)

Bug fixes

#12592: Fixed KeyError{.interpreted-text role="class"} crash when using --import-mode=importlib in a directory layout where a directory contains a child directory with the same name.
#12818: Assertion rewriting now preserves the source ranges of the original instructions, making it play well with tools that deal with the AST, like executing.
#12849: ANSI escape codes for colored output now handled correctly in pytest.fail{.interpreted-text role="func"} with [pytrace=False]{.title-ref}.
#9353: pytest.approx{.interpreted-text role="func"} now uses strict equality when given booleans.

Improved documentation

#10558: Fix ambiguous docstring of pytest.Config.getoption{.interpreted-text role="func"}.
#10829: Improve documentation on the current handling of the --basetemp option and its lack of retention functionality (temporary directory location and retention{.interpreted-text role="re

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Code Review

This pull request updates the pytest dependency to version 9.0.3 for Python 3.7 and Python >= 3.8. However, a review comment correctly points out that pytest 9.0.3 is incompatible with Python 3.7 and 3.8, which will cause installation failures, and provides a suggestion to pin compatible versions for each Python environment.

Pytest 9.0.3 cannot be installed on Python 3.7, 3.8, or 3.9 because support for these Python versions has been dropped in newer releases of pytest:

Pytest 8.0 dropped support for Python 3.7.
Pytest 8.4 dropped support for Python 3.8.
Pytest 9.0 dropped support for Python 3.9.

Specifying pytest==9.0.3 for Python 3.7 and >= 3.8 will cause installation failures in environments running those Python versions. We should pin the maximum compatible pytest version for each Python version.

pytest==7.4.4; python_version == '3.7'
pytest==8.3.5; python_version == '3.8'
pytest==8.4.2; python_version == '3.9'
pytest==9.0.3; python_version >= '3.10'

renovate-bot requested review from a team as code owners June 10, 2026 20:05

renovate-bot requested a review from parthea June 10, 2026 20:05

trusted-contributions-gcf Bot added kokoro:force-run Add this label to force Kokoro to re-run the tests. owlbot:run Add this label to trigger the Owlbot post processor. labels Jun 10, 2026

product-auto-label Bot added the size: xs Pull request size is extra small. label Jun 10, 2026

gcf-owl-bot Bot removed the owlbot:run Add this label to trigger the Owlbot post processor. label Jun 10, 2026

product-auto-label Bot added the samples Issues that are directly related to samples. label Jun 10, 2026

gemini-code-assist Bot reviewed Jun 10, 2026

View reviewed changes

yoshi-kokoro removed kokoro:force-run Add this label to force Kokoro to re-run the tests. labels Jun 10, 2026

renovate-bot force-pushed the renovate/pypi-pytest-vulnerability branch from ff997fc to a8a1804 Compare July 16, 2026 18:13

trusted-contributions-gcf Bot added kokoro:force-run Add this label to force Kokoro to re-run the tests. owlbot:run Add this label to trigger the Owlbot post processor. labels Jul 16, 2026

gcf-owl-bot Bot removed the owlbot:run Add this label to trigger the Owlbot post processor. label Jul 16, 2026

yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Jul 16, 2026

chore(deps): update dependency pytest to v9 [security]

20f6132

renovate-bot force-pushed the renovate/pypi-pytest-vulnerability branch from a8a1804 to 20f6132 Compare August 20, 2026 20:50

trusted-contributions-gcf Bot added kokoro:force-run Add this label to force Kokoro to re-run the tests. owlbot:run Add this label to trigger the Owlbot post processor. labels Aug 20, 2026

gcf-owl-bot Bot removed the owlbot:run Add this label to trigger the Owlbot post processor. label Aug 20, 2026

yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Aug 20, 2026

chore(deps): update dependency pytest to v9 [security] by renovate-bot · Pull Request #2763 · googleapis/google-api-python-client · GitHub

Uh oh!

chore(deps): update dependency pytest to v9 [security] - #2763

chore(deps): update dependency pytest to v9 [security]#2763
renovate-bot wants to merge 1 commit into
googleapis:mainfrom
renovate-bot:renovate/pypi-pytest-vulnerability

renovate-bot commented Jun 10, 2026 •
edited
Loading

Uh oh!

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Jun 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		pytest==9.0.3; python_version == '3.7'
		pytest==9.0.3; python_version >= '3.8'

chore(deps): update dependency pytest to v9 [security] by renovate-bot · Pull Request #2763 · googleapis/google-api-python-client · GitHub

Uh oh!

chore(deps): update dependency pytest to v9 [security] - #2763

Conversation

renovate-bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

pytest has vulnerable tmpdir handling

Details

Severity

References

Release Notes

pytest 9.0.3 (2026-04-07)

Bug fixes

Improved documentation

Contributor-facing changes

pytest 9.0.2 (2025-12-06)

Bug fixes

Improved documentation

pytest 9.0.1 (2025-11-12)

Bug fixes

Packaging updates and notes for downstreams

Contributor-facing changes

pytest 9.0.0 (2025-11-05)

New features

Improvements in existing functionality

Removals and backward incompatible breaking changes

Deprecations (removal in next major release)

Bug fixes

Packaging updates and notes for downstreams

Contributor-facing changes

Miscellaneous internal changes

pytest 8.4.2 (2025-09-03)

Bug fixes

Improved documentation

Contributor-facing changes

pytest 8.4.1 (2025-06-17)

Bug fixes

Improved documentation

pytest 8.4.0 (2025-06-02)

Removals and backward incompatible breaking changes

Deprecations (removal in next major release)

New features

contents of src/domain.py

contents of tests/test_testament.py

Improvements in existing functionality

Bug fixes

Improved documentation

Packaging updates and notes for downstreams

Contributor-facing changes

Miscellaneous internal changes

pytest 8.3.5 (2025-03-02)

Bug fixes

Improved documentation

Contributor-facing changes

pytest 8.3.4 (2024-12-01)

Bug fixes

Improved documentation

Configuration

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Jun 10, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

renovate-bot commented Jun 10, 2026 •
edited
Loading