Update pytest for CVE-2025-71176

CHANGELOG.md

@@ -41,6 +41,9 @@ pre-1.0 scheme; dates are when the change reached `main`.
   `TRUST_FORWARDED_FOR=false` did not prevent it, because the server was
   rewriting the peer address before the application saw it. That setting is
   replaced by `TRUSTED_PROXIES`.
+- pytest 8.3.4 → 9.1.1 (with pytest-playwright 0.5.2 → 0.8.0, the first release
+  that accepts pytest 9) for CVE-2025-71176, unsafe temporary-directory
+  handling. Test-only — pytest is not installed in the runtime image.
 - An OIDC token that carries no `groups` claim is now refused instead of being
   admitted on the strength of Authentik's application binding. The provider is
   configured to send the claim, so its absence means the configuration has

requirements-dev.txt

@@ -1,3 +1,3 @@
 # Test/dev dependencies (not installed in the runtime image).
 -r requirements.txt
-pytest==8.3.4
+pytest==9.1.1

requirements-e2e.txt

@@ -1,10 +1,11 @@
 # Browser end-to-end test dependencies (run via the Playwright image; see
 # scripts/run-e2e.sh). Kept separate from the runtime and unit-test deps.
-pytest==8.3.4
+pytest==9.1.1
 # itsdangerous: forge a Starlette session cookie for the authenticated workspace
 # E2E (must match the app's signer).
 itsdangerous==2.2.0
 # Pin Playwright to match the runner image (mcr.microsoft.com/playwright/python
 # tag in scripts/run-e2e.sh / CI installs the matching browser build).
 playwright==1.49.0
-pytest-playwright==0.5.2
+# 0.8.0 is the first release that accepts pytest 9.
+pytest-playwright==0.8.0