Update pytest for CVE-2025-71176 - #22
Merged
Merged
Conversation
Turning on dependency alerts surfaced two immediately: pytest 8.3.4 in both test manifests, for unsafe temporary-directory handling, fixed in 9.0.3. Test-only. pytest is not installed in the runtime image — the Dockerfile installs requirements.txt alone — so nothing reachable was affected. Worth clearing anyway so the alert list stays at zero and a real one is visible when it arrives. pytest 9.1.1 in both manifests. pytest-playwright had to move to 0.8.0 with it; every earlier release caps pytest below 9. Playwright itself stays at 1.49.0 to match the runner image. Both suites verified on the new pins: 37 backend tests and 4 browser end-to-end tests.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Turning on dependency alerts surfaced two immediately, both the same thing:
pytest 8.3.4 in
requirements-dev.txtandrequirements-e2e.txt, forCVE-2025-71176 — unsafe temporary-directory handling, fixed in 9.0.3.
Reachability: none
pytest is not installed in the runtime image. The Dockerfile installs
requirements.txtalone, so nothing an attacker can reach was ever affected.Clearing it anyway so the alert list sits at zero and a real one stands out when
it arrives.
The changes
pytest8.3.4 → 9.1.1 in both manifests.pytest-playwright0.5.2 → 0.8.0. Every earlier release capspytestbelow 9; 0.8.0 is the first that accepts it.
playwrightstays at 1.49.0 to match the browser build in the runnerimage and CI.
Verification
Both suites on the new pins: 37 backend tests against a real PostgreSQL
database, and 4 browser end-to-end tests against a staging container.