chore(deps): update dependency pytest to v9.0.3 [security] by renovate[bot] · Pull Request #571 · cds-snc/github-secret-scanning

renovate · 2026-04-13T23:33:32Z

This PR contains the following updates:

Package	Change	Age	Confidence
pytest (changelog)	`==9.0.2` → `==9.0.3`

Review

Updates have been tested and work
If updates are AWS related, versions match the infrastructure (e.g. Lambda runtime, database, etc.)

pytest has vulnerable tmpdir handling

CVE-2025-71176 / GHSA-6w46-j5rx-g56g

More information

Details

pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, which allows local users to cause a denial of service or possibly gain privileges.

Severity

CVSS Score: 6.8 / 10 (Medium)
Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

pytest has vulnerable tmpdir handling

CVE-2025-71176 / GHSA-6w46-j5rx-g56g

More information

Details

pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, which allows local users to cause a denial of service or possibly gain privileges.

Severity

CVSS Score: 6.8 / 10 (Medium)
Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

pytest-dev/pytest (pytest)

`v9.0.3`

Compare Source

pytest 9.0.3 (2026-04-07)

Bug fixes

#12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.
#13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

Previously this resulted in an internal assertion failure during plugin loading.

Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.
#13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.
#14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.
#14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

#13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.
#13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.
#14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.
#14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

#12689: The test reports are now published to Codecov from GitHub Actions.
The test statistics is visible on the web interface.

-- by aleguy02

Configuration

📅 Schedule: (in timezone America/Montreal)

Branch creation
- ""
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-06-22T17:58:40Z

Production: alarms

✅ Terraform Init: success
✅ Terraform Validate: success
✅ Terraform Format: success
✅ Terraform Plan: success
✅ Conftest: success

Plan: 0 to add, 4 to change, 0 to destroy

Show summary

CHANGE	NAME
update	`aws_cloudwatch_metric_alarm.api_error`
	`aws_cloudwatch_metric_alarm.api_secret_detected`
	`aws_kms_key.sns_cloudwatch`
	`aws_sns_topic.cloudwatch_alarm`

Show plan

Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_cloudwatch_metric_alarm.api_error will be updated in-place
  ~ resource "aws_cloudwatch_metric_alarm" "api_error" {
        id                        = "GitHub secret scanning: error"
      ~ tags                      = {
          + "CostCentre" = "github-secret-scanning-production"
          + "Terraform"  = "true"
          + "ssc_cbrid"  = "22DH"
        }
      ~ tags_all                  = {
          + "CostCentre" = "github-secret-scanning-production"
          + "Terraform"  = "true"
          + "ssc_cbrid"  = "22DH"
        }
        # (18 unchanged attributes hidden)
    }

  # aws_cloudwatch_metric_alarm.api_secret_detected will be updated in-place
  ~ resource "aws_cloudwatch_metric_alarm" "api_secret_detected" {
        id                        = "GitHub secret scanning: secret detected"
      ~ tags                      = {
          + "CostCentre" = "github-secret-scanning-production"
          + "Terraform"  = "true"
          + "ssc_cbrid"  = "22DH"
        }
      ~ tags_all                  = {
          + "CostCentre" = "github-secret-scanning-production"
          + "Terraform"  = "true"
          + "ssc_cbrid"  = "22DH"
        }
        # (18 unchanged attributes hidden)
    }

  # aws_kms_key.sns_cloudwatch will be updated in-place
  ~ resource "aws_kms_key" "sns_cloudwatch" {
        id                                 = "17a3cee1-81fc-462c-99b7-e23b21612aa3"
      ~ tags                               = {
          + "ssc_cbrid"  = "22DH"
            # (2 unchanged elements hidden)
        }
      ~ tags_all                           = {
          + "ssc_cbrid"  = "22DH"
            # (2 unchanged elements hidden)
        }
        # (12 unchanged attributes hidden)
    }

  # aws_sns_topic.cloudwatch_alarm will be updated in-place
  ~ resource "aws_sns_topic" "cloudwatch_alarm" {
        id                                       = "arn:aws:sns:ca-central-1:283582579564:github-secret-scanning-cloudwatch-alarm"
        name                                     = "github-secret-scanning-cloudwatch-alarm"
      ~ tags                                     = {
          + "ssc_cbrid"  = "22DH"
            # (2 unchanged elements hidden)
        }
      ~ tags_all                                 = {
          + "ssc_cbrid"  = "22DH"
            # (2 unchanged elements hidden)
        }
        # (13 unchanged attributes hidden)
    }

Plan: 0 to add, 4 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"

Show Conftest results

WARN - plan.json - main - Cloudwatch log metric pattern is invalid: ["aws_cloudwatch_log_metric_filter.api_error"]

21 tests, 20 passed, 1 warning, 0 failures, 0 exceptions

github-actions · 2026-06-22T17:58:47Z

Production: alert_compromise

✅ Terraform Init: success
✅ Terraform Validate: success
✅ Terraform Format: success
✅ Terraform Plan: success
✅ Conftest: success

Plan: 0 to add, 3 to change, 0 to destroy

Show summary

CHANGE	NAME
update	`aws_iam_role.group_broadcast_alert_role`
	`aws_lambda_function.broadcast_alert`
	`aws_ssm_parameter.notify_doc_api_key`

Show plan

Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_iam_role.group_broadcast_alert_role will be updated in-place
  ~ resource "aws_iam_role" "group_broadcast_alert_role" {
        id                    = "group_broadcast_alert_role"
        name                  = "group_broadcast_alert_role"
      ~ tags                  = {
          + "CostCentre" = "github-secret-scanning-production"
          + "Terraform"  = "true"
          + "ssc_cbrid"  = "22DH"
        }
      ~ tags_all              = {
          + "CostCentre" = "github-secret-scanning-production"
          + "Terraform"  = "true"
          + "ssc_cbrid"  = "22DH"
        }
        # (8 unchanged attributes hidden)

        # (3 unchanged blocks hidden)
    }

  # aws_lambda_function.broadcast_alert will be updated in-place
  ~ resource "aws_lambda_function" "broadcast_alert" {
        id                             = "broadcast_alert"
        tags                           = {}
      ~ tags_all                       = {
          + "ssc_cbrid" = "22DI"
        }
        # (31 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

  # aws_ssm_parameter.notify_doc_api_key will be updated in-place
  ~ resource "aws_ssm_parameter" "notify_doc_api_key" {
        id              = "notify_doc_api_key"
        name            = "notify_doc_api_key"
      ~ tags            = {
          + "ssc_cbrid"  = "22DH"
            # (2 unchanged elements hidden)
        }
      ~ tags_all        = {
          + "ssc_cbrid"  = "22DH"
            # (2 unchanged elements hidden)
        }
        # (10 unchanged attributes hidden)
    }

Plan: 0 to add, 3 to change, 0 to destroy.

Warning: Argument is deprecated

  with aws_iam_role.group_broadcast_alert_role,
  on iam.tf line 4, in resource "aws_iam_role" "group_broadcast_alert_role":
   4:   managed_policy_arns = ["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"]

managed_policy_arns is deprecated. Use the aws_iam_role_policy_attachment
resource instead. If Terraform should exclusively manage all managed policy
attachments (the current behavior of this argument), use the
aws_iam_role_policy_attachments_exclusive resource as well.

(and one more similar warning elsewhere)

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"
Releasing state lock. This may take a few moments...

Show Conftest results

WARN - plan.json - main - Missing Common Tags: ["aws_lambda_function.broadcast_alert"]

21 tests, 20 passed, 1 warning, 0 failures, 0 exceptions

github-actions · 2026-06-22T17:59:02Z

Production: cloudfront

✅ Terraform Init: success
✅ Terraform Validate: success
✅ Terraform Format: success
✅ Terraform Plan: success
✅ Conftest: success

Plan: 0 to add, 2 to change, 0 to destroy

Show summary

CHANGE	NAME
update	`aws_cloudfront_distribution.api`
	`aws_wafv2_web_acl.api`

Show plan

Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_cloudfront_distribution.api will be updated in-place
  ~ resource "aws_cloudfront_distribution" "api" {
        id                              = "E3JW0APMFZN4DN"
        tags                            = {
            "CostCentre" = "github-secret-scanning-production"
            "Terraform"  = "true"
        }
      ~ tags_all                        = {
          + "ssc_cbrid"  = "22DI"
            # (2 unchanged elements hidden)
        }
        # (23 unchanged attributes hidden)

        origin {
          # At least one attribute in this block is (or was) sensitive,
          # so its contents will not be displayed.
        }

        # (4 unchanged blocks hidden)
    }

  # aws_wafv2_web_acl.api will be updated in-place
  ~ resource "aws_wafv2_web_acl" "api" {
        id            = "ff46dbec-de07-4249-8a6f-bf03d8823194"
        name          = "github-secret-scanning"
      ~ tags          = {
          + "ssc_cbrid"  = "22DH"
            # (2 unchanged elements hidden)
        }
      ~ tags_all      = {
          + "ssc_cbrid"  = "22DH"
            # (2 unchanged elements hidden)
        }
        # (7 unchanged attributes hidden)

        # (8 unchanged blocks hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"
Releasing state lock. This may take a few moments...

Show Conftest results

21 tests, 21 passed, 0 warnings, 0 failures, 0 exceptions

renovate Bot added Dependencies Renovate labels Apr 13, 2026

renovate Bot force-pushed the renovate/pypi-pytest-vulnerability branch 2 times, most recently from a43f082 to 50a2ba0 Compare June 3, 2026 16:19

chore(deps): update dependency pytest to v9.0.3 [security]

11d3390

renovate Bot force-pushed the renovate/pypi-pytest-vulnerability branch from 50a2ba0 to 11d3390 Compare June 22, 2026 17:56

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency pytest to v9.0.3 [security]#571

chore(deps): update dependency pytest to v9.0.3 [security]#571
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/pypi-pytest-vulnerability

renovate Bot commented Apr 13, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 22, 2026

Uh oh!

github-actions Bot commented Jun 22, 2026

Uh oh!

github-actions Bot commented Jun 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review

pytest has vulnerable tmpdir handling

Details

Severity

References

pytest has vulnerable tmpdir handling

Details

Severity

References

Release Notes

v9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

Improved documentation

Contributor-facing changes

Configuration

Uh oh!

github-actions Bot commented Jun 22, 2026

Production: alarms

Uh oh!

github-actions Bot commented Jun 22, 2026

Production: alert_compromise

Uh oh!

github-actions Bot commented Jun 22, 2026

Production: cloudfront

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Apr 13, 2026 •

edited

Loading

`v9.0.3`