nocarryr / python-dispatch / 35044268849

98%

push

github

Update dependency pytest to v9 [SECURITY] (#91)

This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [pytest](https://redirect.github.com/pytest-dev/pytest) ([changelog](https://docs.pytest.org/en/stable/changelog.html)) | `8.3.5` → `9.0.3` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/pytest/9.0.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/pytest/8.3.5/9.0.3?slim=true) |

---

### pytest has vulnerable tmpdir handling
[CVE-2025-71176](https://nvd.nist.gov/vuln/detail/CVE-2025-71176) / [GHSA-6w46-j5rx-g56g](https://redirect.github.com/advisories/GHSA-6w46-j5rx-g56g)

<details>
<summary>More information</summary>

#### Details
pytest through 9.0.2 on UNIX relies on directories with the `/tmp/pytest-of-{user}` name pattern, which allows local users to cause a denial of service or possibly gain privileges.

#### Severity
- CVSS Score: 6.8 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L`

#### References
- [https://nvd.nist.gov/vuln/detail/CVE-2025-71176](https://nvd.nist.gov/vuln/detail/CVE-2025-71176)
- [https://github.com/pytest-dev/pytest/issues/13669](https://redirect.github.com/pytest-dev/pytest/issues/13669)
- [https://www.openwall.com/lists/oss-security/2026/01/21/5](https://www.openwall.com/lists/oss-security/2026/01/21/5)
- [https://github.com/pytest-dev/pytest/pull/14343](https://redirect.github.com/pytest-dev/pytest/pull/14343)
- [https://github.com/pytest-dev/pytest/commit/<a class=hub.com/nocarryr/python-dispatch/commit/95d8423bd24992deea5b9df32555fa1741679e2c">95d8423bd](https://redirect.github.com/pytest-dev/pytest/commit/95d8423bd24992deea5b9df32555fa1741679e2c)
- [https://github.com/pytest-dev/pytest/releases/tag/9.0.3](https://redirect.github.com/pytest-dev/pytest/releases/tag/9.0.3)
- [https://github.com/advisories/GHSA-6w46-j5rx-g56g](https://redirect.github.com/advis... (continued)

832 of 850 relevant lines covered (97.88%)

6.61 hits per line