chore(deps): bump pytest from 7.4.4 to 9.0.3#1987
chore(deps): bump pytest from 7.4.4 to 9.0.3#1987dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
Bumps [pytest](https://github.com/pytest-dev/pytest) from 7.4.4 to 9.0.3. - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@7.4.4...9.0.3) --- updated-dependencies: - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit adb5cdf. Configure here.
| @@ -1,4 +1,4 @@ | |||
| # This file is automatically @generated by Poetry 2.3.1 and should not be changed by hand. | |||
| # This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand. | |||
There was a problem hiding this comment.
Lock file markers lost due to Poetry version downgrade
High Severity
The lock file was regenerated with Poetry 2.2.1 (downgrade from 2.3.1), which has known issues with multi-group markers. All per-group markers = {main = "extra == \"docs\""} entries were stripped from dozens of packages in both "main" and "dev" groups (e.g. anyio, beautifulsoup4, bleach, jinja2, tornado, nbconvert, and many more). This means packages previously only installed for pip install flow360[docs] will now be installed unconditionally for all users, significantly expanding the dependency footprint.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit adb5cdf. Configure here.
| optional = false | ||
| python-versions = ">=3.10" | ||
| groups = ["main", "dev"] | ||
| markers = "python_version == \"3.10\"" |
There was a problem hiding this comment.
Python 3.11+ packages downgraded to 3.10-era versions
Medium Severity
The lock file collapsed Python-version-specific package entries into single older versions. ipython 9.x entries (for Python 3.11/3.12+) were removed, leaving only 8.38.0 for all versions. Similarly sphinx 8.2.3, myst-parser 5.0.0, pydata-sphinx-theme 0.16.1, sphinx-book-theme 1.2.0, sphinx-design 0.7.0, sphinx-autodoc-typehints 3.5.2, sphinx-prompt 1.10.2, and markdown-it-py 4.0.0 entries for Python 3.11+ were all removed. Python 3.11+ users are now downgraded to older package versions.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit adb5cdf. Configure here.
|
Dependabot can't resolve your Python dependency files. Because of this, Dependabot cannot update this pull request. |
1 similar comment
|
Dependabot can't resolve your Python dependency files. Because of this, Dependabot cannot update this pull request. |
Bumps pytest from 7.4.4 to 9.0.3.
Release notes
Sourced from pytest's releases.
... (truncated)
Commits
a7d58d7Prepare release version 9.0.3089d981Merge pull request #14366 from bluetech/revert-14193-backport8127eafRevert "Fix: assertrepr_compare respects dict insertion order (#14050) (#14193)"99a7e60Merge pull request #14363 from pytest-dev/patchback/backports/9.0.x/95d8423bd...ddee02aMerge pull request #14343 from bluetech/cve-2025-71176-simple74eac69doc: Update training info (#14298) (#14301)f92dee7Merge pull request #14267 from pytest-dev/patchback/backports/9.0.x/d6fa26c62...7ee58acMerge pull request #12378 from Pierre-Sassoulas/fix-implicit-str-concat-and-d...37da870Merge pull request #14259 from mitre88/patch-4 (#14268)c34bfa3Add explanation for string context diffs (#14257) (#14266)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Medium Risk
Upgrading
pytestfrom 7.x to 9.x can change test discovery/execution behavior and plugin compatibility. The lockfile was regenerated (with different Poetry version/marker normalization), which may also shift resolved transitive deps across environments.Overview
Updates the project’s
pytestdependency to9.0.3and widens the declared version ranges inpyproject.tomlto allowpytest<10.Regenerates
poetry.lock, pulling inpytest’s new dependency constraints and normalizing environment markers/extras across multiple packages (notably simplifying several Python-version-conditional doc/test tool entries).Reviewed by Cursor Bugbot for commit adb5cdf. Bugbot is set up for automated code reviews on this repo. Configure here.