chore(deps): bump the pip group across 38 directories with 14 updates

[dependabot]

Bumps the pip group with 2 updates in the /alloydb/notebooks directory: pytest and nbconvert.
Bumps the pip group with 2 updates in the /aml-ai directory: pytest and requests.
Bumps the pip group with 1 update in the /asset/snippets directory: pytest.
Bumps the pip group with 1 update in the /auth/api-client directory: pytest.
Bumps the pip group with 1 update in the /auth/cloud-client directory: pytest.
Bumps the pip group with 2 updates in the /auth/service-to-service directory: pytest and requests.
Bumps the pip group with 1 update in the /batch directory: pytest.
Bumps the pip group with 2 updates in the /bigquery/continuous-queries directory: pytest and requests.
Bumps the pip group with 1 update in the /billing directory: pytest.
Bumps the pip group with 1 update in the /cdn directory: pytest.
Bumps the pip group with 5 updates in the /cloud-media-livestream/keypublisher directory:

Package	From	To
pytest	8.2.0	9.0.3
requests	2.32.2	2.33.0
flask	2.2.5	3.1.3
pyopenssl	25.0.0	26.0.0
werkzeug	3.0.6	3.1.6

Bumps the pip group with 3 updates in the /cloud_scheduler/snippets directory: pytest, flask and werkzeug.
Bumps the pip group with 2 updates in the /cloud_tasks/http_queues directory: pytest and requests.
Bumps the pip group with 10 updates in the /composer/2022_airflow_summit directory:

Package	From	To
pytest	7.4.0	9.0.3
requests	2.31.0	2.33.0
flask	2.2.5	3.1.3
pyopenssl	23.2.0	26.0.0
werkzeug	2.2.3	3.1.6
black	23.1a1	26.3.1
cryptography	40.0.2	46.0.7
google-cloud-aiplatform	1.27.1	1.133.0
protobuf	4.23.4	5.29.6
apache-airflow	2.6.3	3.2.0

Bumps the pip group with 5 updates in the /composer/airflow_1_samples directory:

Package	From	To
flask	1.1.2	3.1.3
pyopenssl	20.0.0	26.0.0
werkzeug	0.16.1	3.1.6
cryptography	3.2.1	46.0.7
protobuf	3.14.0	5.29.6

Bumps the pip group with 10 updates in the /composer/cicd_sample directory:

Package	From	To
pytest	7.4.0	9.0.3
requests	2.31.0	2.33.0
flask	2.2.5	3.1.3
pyopenssl	23.2.0	26.0.0
werkzeug	2.2.3	3.1.6
black	23.1a1	26.3.1
cryptography	40.0.2	46.0.7
google-cloud-aiplatform	1.27.1	1.133.0
protobuf	4.23.4	5.29.6
apache-airflow	2.6.3	3.2.0

Bumps the pip group with 2 updates in the /composer/rest directory: pytest and requests.
Bumps the pip group with 2 updates in the /compute/auth directory: pytest and requests.
Bumps the pip group with 2 updates in the /compute/client_library directory: pytest and black.
Bumps the pip group with 3 updates in the /compute/encryption directory: pytest, requests and cryptography.
Bumps the pip group with 2 updates in the /compute/metadata directory: pytest and requests.
Bumps the pip group with 2 updates in the /compute/oslogin directory: pytest and requests.
Bumps the pip group with 4 updates in the /dataflow/gemma directory: pytest, google-cloud-aiplatform, protobuf and keras.
Bumps the pip group with 2 updates in the /dataflow/gemma-flex-template directory: pytest and google-cloud-aiplatform.
Bumps the pip group with 4 updates in the /dataflow/run-inference directory: pytest, google-cloud-aiplatform, torch and transformers.
Bumps the pip group with 3 updates in the /datastore/cloud-ndb directory: pytest, flask and werkzeug.
Bumps the pip group with 3 updates in the /dialogflow directory: pytest, flask and werkzeug.
Bumps the pip group with 3 updates in the /dialogflow-cx directory: pytest, flask and werkzeug.
Bumps the pip group with 1 update in the /discoveryengine directory: pytest.
Bumps the pip group with 3 updates in the /gemma2 directory: pytest, google-cloud-aiplatform and protobuf.
Bumps the pip group with 5 updates in the /iap directory:

Package	From	To
pytest	8.2.0	9.0.3
requests	2.32.2	2.33.0
flask	3.0.3	3.1.3
werkzeug	3.0.3	3.1.6
cryptography	45.0.1	46.0.7

Bumps the pip group with 2 updates in the /media_cdn directory: pytest and cryptography.
Bumps the pip group with 1 update in the /notebooks directory: pytest.
Bumps the pip group with 1 update in the /servicedirectory directory: pytest.
Bumps the pip group with 1 update in the /storagecontrol directory: pytest.
Bumps the pip group with 1 update in the /storagetransfer directory: pytest.
Bumps the pip group with 1 update in the /talent directory: pytest.
Bumps the pip group with 1 update in the /tpu directory: pytest.

Updates pytest from 8.3.3 to 9.0.3

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

• #12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

• #13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

  Previously this resulted in an internal assertion failure during plugin loading.

  Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

• #13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

• #14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

• #14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

• #13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.
• #13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.
• #14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.
• #14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

• #12689: The test reports are now published to Codecov from GitHub Actions. The test statistics is visible on the web interface.

  -- by aleguy02

9.0.2

pytest 9.0.2 (2025-12-06)

Bug fixes

• #13896: The terminal progress feature added in pytest 9.0.0 has been disabled by default, except on Windows, due to compatibility issues with some terminal emulators.

  You may enable it again by passing -p terminalprogress. We may enable it by default again once compatibility improves in the future.

  Additionally, when the environment variable TERM is dumb, the escape codes are no longer emitted, even if the plugin is enabled.

• #13904: Fixed the TOML type of the tmp_path_retention_count settings in the API reference from number to string.

• #13946: The private config.inicfg attribute was changed in a breaking manner in pytest 9.0.0. Due to its usage in the ecosystem, it is now restored to working order using a compatibility shim. It will be deprecated in pytest 9.1 and removed in pytest 10.

... (truncated)

Commits

• a7d58d7 Prepare release version 9.0.3
• 089d981 Merge pull request #14366 from bluetech/revert-14193-backport
• 8127eaf Revert "Fix: assertrepr_compare respects dict insertion order (#14050) (#14193)"
• 99a7e60 Merge pull request #14363 from pytest-dev/patchback/backports/9.0.x/95d8423bd...
• ddee02a Merge pull request #14343 from bluetech/cve-2025-71176-simple
• 74eac69 doc: Update training info (#14298) (#14301)
• f92dee7 Merge pull request #14267 from pytest-dev/patchback/backports/9.0.x/d6fa26c62...
• 7ee58ac Merge pull request #12378 from Pierre-Sassoulas/fix-implicit-str-concat-and-d...
• 37da870 Merge pull request #14259 from mitre88/patch-4 (#14268)
• c34bfa3 Add explanation for string context diffs (#14257) (#14266)
• Additional commits viewable in compare view

Updates nbconvert from 7.16.6 to 7.17.0

Release notes

Sourced from nbconvert's releases.

v7.17.0

7.17.0

(Full Changelog)

Enhancements made

• Add support for arbitrary browser arguments #2227 (@​shreve, @​Carreau, @​krassowski)

Bugs fixed

• Fix QtPNGExporter returning empty bytes on macOS #2264 (@​h3pdesign, @​Carreau, @​QuLogic)
• Fix CVE-2025-53000: Secure Inkscape Windows path (registry first + block CWD) #2261 (@​h3pdesign, @​krassowski, @​mberlanda, @​minrk, @​salmankadaya, @​th3gowtham)
• Fix get_export_names and get_exporter default args #2228 (@​shreve, @​krassowski)
• PyPA-Compliant Summary #2226 (@​hackowitz-af, @​Carreau)

Maintenance and upkeep improvements

• avoid cov environment on free-threaded Pythons #2267 (@​minrk)
• update pre-commit, and fix all issues. #2238 (@​Carreau)
• Drop test on 3.9, test on 3.13, 3.14, 3.14t #2237 (@​Carreau)
• Bump the actions group across 1 directory with 2 updates #2231 (@​Carreau, @​krassowski)
• Replace @flaky.flaky decorate with pytest marker #2229 (@​mgorny, @​Carreau)
• update to mermaid 11.10.0 #2224 (@​bollwyvl, @​krassowski)
• Drop support for Python 3.8, fix the CI tests #2221 (@​shreve, @​minrk)

Documentation improvements

• Use intersphinx_registry #2232 (@​Carreau, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​bollwyvl (activity) | @​Carreau (activity) | @​h3pdesign (activity) | @​hackowitz-af (activity) | @​krassowski (activity) | @​mberlanda (activity) | @​mgorny (activity) | @​minrk (activity) | @​MSeal (activity) | @​QuLogic (activity) | @​salmankadaya (activity) | @​shreve (activity) | @​th3gowtham (activity)

Changelog

Sourced from nbconvert's changelog.

7.17.0

(Full Changelog)

Enhancements made

• Add support for arbitrary browser arguments #2227 (@​shreve, @​Carreau, @​krassowski)

Bugs fixed

• Fix QtPNGExporter returning empty bytes on macOS #2264 (@​h3pdesign, @​Carreau, @​QuLogic)
• Fix CVE-2025-53000: Secure Inkscape Windows path (registry first + block CWD) #2261 (@​h3pdesign, @​krassowski, @​mberlanda, @​minrk, @​salmankadaya, @​th3gowtham)
• Fix get_export_names and get_exporter default args #2228 (@​shreve, @​krassowski)
• PyPA-Compliant Summary #2226 (@​hackowitz-af, @​Carreau)

Maintenance and upkeep improvements

• avoid cov environment on free-threaded Pythons #2267 (@​minrk)
• update pre-commit, and fix all issues. #2238 (@​Carreau)
• Drop test on 3.9, test on 3.13, 3.14, 3.14t #2237 (@​Carreau)
• Bump the actions group across 1 directory with 2 updates #2231 (@​Carreau, @​krassowski)
• Replace @flaky.flaky decorate with pytest marker #2229 (@​mgorny, @​Carreau)
• update to mermaid 11.10.0 #2224 (@​bollwyvl, @​krassowski)
• Drop support for Python 3.8, fix the CI tests #2221 (@​shreve, @​minrk)

Documentation improvements

• Use intersphinx_registry #2232 (@​Carreau, @​krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​bollwyvl (activity) | @​Carreau (activity) | @​h3pdesign (activity) | @​hackowitz-af (activity) | @​krassowski (activity) | @​mberlanda (activity) | @​mgorny (activity) | @​minrk (activity) | @​MSeal (activity) | @​QuLogic (activity) | @​salmankadaya (activity) | @​shreve (activity) | @​th3gowtham (activity)

Commits

• 21b35d8 Publish 7.17.0
• c9ac1d1 Fix CVE-2025-53000: Secure Inkscape Windows path (registry first + block CWD)...
• b13276d avoid cov environment on free-threaded Pythons (#2267)
• 7c7055f [pre-commit.ci] auto fixes from pre-commit.com hooks
• 74f3ddd Fix QtPNGExporter returning empty bytes on macOS
• 216550b fix links
• 39777ac try to comment fialing test
• 7b591ca ruff-check
• 6ec7638 parent
• 59414b3 fix mypy
• Additional commits viewable in compare view

Updates pytest from 8.2.0 to 9.0.3

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

• #12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

• #13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

  Previously this resulted in an internal assertion failure during plugin loading.

  Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

• #13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

• #14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

• #14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

• #13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.
• #13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.
• #14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.
• #14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

• #12689: The test reports are now published to Codecov from GitHub Actions. The test statistics is visible on the web interface.

  -- by aleguy02

9.0.2

pytest 9.0.2 (2025-12-06)

Bug fixes

• #13896: The terminal progress feature added in pytest 9.0.0 has been disabled by default, except on Windows, due to compatibility issues with some terminal emulators.

  You may enable it again by passing -p terminalprogress. We may enable it by default again once compatibility improves in the future.

  Additionally, when the environment variable TERM is dumb, the escape codes are no longer emitted, even if the plugin is enabled.

• #13904: Fixed the TOML type of the tmp_path_retention_count settings in the API reference from number to string.

• #13946: The private config.inicfg attribute was changed in a breaking manner in pytest 9.0.0. Due to its usage in the ecosystem, it is now restored to working order using a compatibility shim. It will be deprecated in pytest 9.1 and removed in pytest 10.

... (truncated)

Commits

• a7d58d7 Prepare release version 9.0.3
• 089d981 Merge pull request #14366 from bluetech/revert-14193-backport
• 8127eaf Revert "Fix: assertrepr_compare respects dict insertion order (#14050) (#14193)"
• 99a7e60 Merge pull request #14363 from pytest-dev/patchback/backports/9.0.x/95d8423bd...
• ddee02a Merge pull request #14343 from bluetech/cve-2025-71176-simple
• 74eac69 doc: Update training info (#14298) (#14301)
• f92dee7 Merge pull request #14267 from pytest-dev/patchback/backports/9.0.x/d6fa26c62...
• 7ee58ac Merge pull request #12378 from Pierre-Sassoulas/fix-implicit-str-concat-and-d...
• 37da870 Merge pull request #14259 from mitre88/patch-4 (#14268)
• c34bfa3 Add explanation for string context diffs (#14257) (#14266)
• Additional commits viewable in compare view

Updates requests from 2.32.2 to 2.33.0

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

• 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

• CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

• Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

• Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

• Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

• Various typo fixes and doc improvements.

New Contributors

• @​M0d3v1 made their first contribution in psf/requests#6865
• @​aminvakil made their first contribution in psf/requests#7220
• @​E8Price made their first contribution in psf/requests#6960
• @​mitre88 made their first contribution in psf/requests#7244
• @​magsen made their first contribution in psf/requests#6553
• @​Rohan5commit made their first contribution in psf/requests#7227

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

v2.32.5

2.32.5 (2025-08-18)

Bugfixes

• The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

• Added support for Python 3.14.
• Dropped support for Python 3.8 following its end of support.

v2.32.4

2.32.4 (2025-06-10)

... (truncated)

Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

• 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

• CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

• Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

• Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

• Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

• Various typo fixes and doc improvements.

2.32.5 (2025-08-18)

Bugfixes

• The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

• Added support for Python 3.14.
• Dropped support for Python 3.8 following its end of support.

2.32.4 (2025-06-10)

Security

• CVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted environment will retrieve credentials for the wrong hostname/machine from a netrc file.

... (truncated)

Commits

• bc04dfd v2.33.0
• 66d21cb Merge commit from fork
• 8b9bc8f Move badges to top of README (#7293)
• e331a28 Remove unused extraction call (#7292)
• 753fd08 docs: fix FAQ grammar in httplib2 example
• 774a0b8 docs(socks): same block as other sections
• 9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
• ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
• 0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
• d568f47 docs: clarify Quickstart POST example (#6960)
• Additional commits viewable in compare view

Updates pytest from 8.2.0 to 9.0.3

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

• #12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

• #13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

  Previously this resulted in an internal assertion failure during plugin loading.

  Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

• #13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

• #14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

• #14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

• #13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.
• #13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.
• #14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.
• #14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

• #12689: The test reports are now published to Codecov from GitHub Actions. The test statistics is visible on the web interface.

  -- by aleguy02

9.0.2

pytest 9.0.2 (2025-12-06)

Bug fixes

• #13896: The terminal progress feature added in pytest 9.0.0 has been disabled by default, except on Windows, due to compatibility issues with some terminal emulators.

  You may enable it again by passing -p terminalprogress. We may enable it by default again once compatibility improves in the future.

  Additionally, when the environment variable TERM is dumb, the escape codes are no longer emitted, even if the plugin is enabled.

• #13904: Fixed the TOML type of the tmp_path_retention_count settings in the API reference from number to string.

• #13946: The private config.inicfg attribute was changed in a breaking manner in pytest 9.0.0. Due to its usage in the ecosystem, it is now restored to working order using a compatibility shim. It will be deprecated in pytest 9.1 and removed in pytest 10.

... (truncated)

Commits

• a7d58d7 Prepare release version 9.0.3
• 089d981 Merge pull request #14366 from bluetech/revert-14193-backport
• 8127eaf Revert "Fix: assertrepr_compare respects dict insertion order (#14050) (#14193)"
• 99a7e60 Merge pull request #14363 from pytest-dev/patchback/backports/9.0.x/95d8423bd...
• ddee02a Merge pull request #14343 from bluetech/cve-2025-71176-simple
• 74eac69 doc: Update training info (#14298) (#14301)
• f92dee7 Merge pull request #14267 from pytest-dev/patchback/backports/9.0.x/d6fa26c62...
• 7ee58ac Merge pull request #12378 from Pierre-Sassoulas/fix-implicit-str-concat-and-d...
• 37da870 Merge pull request #14259 from mitre88/patch-4 (#14268)
• c34bfa3 Add explanation for string context diffs (#14257) (#14266)
• Additional commits viewable in compare view

Updates pytest from 8.2.0 to 9.0.3

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

• #12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

• #13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

  Previously this resulted in an internal assertion failure during plugin loading.

  Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

• #13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

• #14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

• #14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

• #13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.
• #13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.
• #14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.
• #14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

• #12689: The test reports are now published to Codecov from GitHub Actions. The test statistics is visible on the web interface.

  -- by aleguy02

9.0.2

pytest 9.0.2 (2025-12-06)

Bug fixes

• #13896: The terminal progress feature added in pytest 9.0.0 has been disabled by default, except on Windows, due to compatibility issues with some terminal emulators.

  You may enable it again by passing -p terminalprogress. We may enable it by default again once compatibility improves in the future.

  Additionally, when the environment variable TERM is dumb, the escape codes are no longer emitted, even if the plugin is enabled.

• #13904: Fixed the TOML type of the tmp_path_retention_count settings in the API reference from number to string.

• #13946: The private config.inicfg attribute was changed in a breaking manner in pytest 9.0.0. Due to its usage in the ecosystem, it is now restored to working order using a compatibility shim. It will be deprecated in pytest 9.1 and removed in pytest 10.

... (truncated)

Commits

• a7d58d7 Prepare release version 9.0.3
• 089d981 Merge pull request #14366 from bluetech/revert-14193-backport
• 8127eaf Revert "Fix: assertrepr_compare respects dict insertion order (#14050) (#14193)"
• 99a7e60 Merge pull request #14363 from pytest-dev/patchback/backports/9.0.x/95d8423bd...
• ddee02a Merge pull request #14343 from bluetech/cve-2025-71176-simple
• 74eac69 doc: Update training info (#14298) (#14301)
• f92dee7 Merge pull request #14267 from pytest-dev/patchback/backports/9.0.x/d6fa26c62...
• 7ee58ac Merge pull request #12378 from Pierre-Sassoulas/fix-implicit-str-concat-and-d...
• 37da870 Merge pull request #14259 from mitre88/patch-4 (#14268)
• c34bfa3 Add explanation for string context diffs (#14257) (#14266)
• Additional commits viewable in compare view

Updates pytest from 8.2.0 to 9.0.3

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

• #12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

• #13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

  Previously this resulted in an internal assertion failure during plugin loading.

  Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

• #13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

• #14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

• #14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

• #13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.
• #13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.
• #14088: Clarified that the default pytest_co...

  Description has been truncated

[dependabot]

Superseded by #20.