From 40e1f24cce8b17c65d23a780abd8a8f4a7656afa Mon Sep 17 00:00:00 2001 From: Don Beckham Date: Sun, 26 Jul 2026 16:54:26 -0500 Subject: [PATCH] Update pytest for CVE-2025-71176 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Turning on dependency alerts surfaced two immediately: pytest 8.3.4 in both test manifests, for unsafe temporary-directory handling, fixed in 9.0.3. Test-only. pytest is not installed in the runtime image — the Dockerfile installs requirements.txt alone — so nothing reachable was affected. Worth clearing anyway so the alert list stays at zero and a real one is visible when it arrives. pytest 9.1.1 in both manifests. pytest-playwright had to move to 0.8.0 with it; every earlier release caps pytest below 9. Playwright itself stays at 1.49.0 to match the runner image. Both suites verified on the new pins: 37 backend tests and 4 browser end-to-end tests. --- CHANGELOG.md | 3 +++ requirements-dev.txt | 2 +- requirements-e2e.txt | 5 +++-- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c1dcf7f..2756c52 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -41,6 +41,9 @@ pre-1.0 scheme; dates are when the change reached `main`. `TRUST_FORWARDED_FOR=false` did not prevent it, because the server was rewriting the peer address before the application saw it. That setting is replaced by `TRUSTED_PROXIES`. +- pytest 8.3.4 → 9.1.1 (with pytest-playwright 0.5.2 → 0.8.0, the first release + that accepts pytest 9) for CVE-2025-71176, unsafe temporary-directory + handling. Test-only — pytest is not installed in the runtime image. - An OIDC token that carries no `groups` claim is now refused instead of being admitted on the strength of Authentik's application binding. The provider is configured to send the claim, so its absence means the configuration has diff --git a/requirements-dev.txt b/requirements-dev.txt index b61750e..2837e50 100644 --- a/requirements-dev.txt +++ b/requirements-dev.txt @@ -1,3 +1,3 @@ # Test/dev dependencies (not installed in the runtime image). -r requirements.txt -pytest==8.3.4 +pytest==9.1.1 diff --git a/requirements-e2e.txt b/requirements-e2e.txt index 065ecab..a466eb1 100644 --- a/requirements-e2e.txt +++ b/requirements-e2e.txt @@ -1,10 +1,11 @@ # Browser end-to-end test dependencies (run via the Playwright image; see # scripts/run-e2e.sh). Kept separate from the runtime and unit-test deps. -pytest==8.3.4 +pytest==9.1.1 # itsdangerous: forge a Starlette session cookie for the authenticated workspace # E2E (must match the app's signer). itsdangerous==2.2.0 # Pin Playwright to match the runner image (mcr.microsoft.com/playwright/python # tag in scripts/run-e2e.sh / CI installs the matching browser build). playwright==1.49.0 -pytest-playwright==0.5.2 +# 0.8.0 is the first release that accepts pytest 9. +pytest-playwright==0.8.0