pip (deps): bump the python-dependencies group across 2 directories with 3 updates by dependabot[bot] · Pull Request #361 · NHSDigital/validated-relationships-service-api

dependabot · 2026-06-15T09:06:57Z

Bumps the python-dependencies group with 1 update in the / directory: pytest.
Bumps the python-dependencies group with 2 updates in the /sandbox directory: gunicorn and pytest-cov.

Updates pytest from 8.4.2 to 9.1.0

Release notes

Sourced from pytest's releases.

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

#14533: When using --doctest-modules, autouse fixtures with module, package or session scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.

If this is undesirable, move the fixture definition to a conftest.py file if possible.

Technical explanation for those interested: When using --doctest-modules, pytest possibly collects Python modules twice, once as pytest.Module and once as a DoctestModule (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the DoctestModule collects a fixture, it is now visible to it only, and not to the Module. This means that both need to register the fixtures independently.

Deprecations (removal in next major release)

#10819: Added a deprecation warning for class-scoped fixtures defined as instance methods (without @classmethod). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use @classmethod decorator instead -- by yastcher.

See 10819 and 14011.

#12882: Calling request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.

See dynamic-fixture-request-during-teardown for details.

#13409: Using non-~collections.abc.Collection iterables (such as generators, iterators, or custom iterable objects) for the argvalues parameter in @pytest.mark.parametrize <pytest.mark.parametrize ref> and metafunc.parametrize <pytest.Metafunc.parametrize> is now deprecated.

These iterables get exhausted after the first iteration, leading to tests getting unexpectedly skipped in cases such as running pytest.main() multiple times, using class-level parametrize decorators, or collecting tests multiple times.

See parametrize-iterators for details and suggestions.

#13946: The private config.inicfg attribute is now deprecated. Use config.getini() <pytest.Config.getini> to access configuration values instead.

See config-inicfg for more details.

#14004: Passing baseid to ~pytest.FixtureDef or nodeid strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.

Use the node parameter instead for fixture scoping. This enables more robust node-based matching instead of string prefix matching. If you've used nodeid=None, pass node=session instead.

This will be removed in pytest 10.

#14335: The method of configuring hooks using markers, deprecated since pytest 7.2, is now scheduled to be removed in pytest 10. See hook-markers for more details.

#14434: The --pastebin option is now deprecated.

... (truncated)

Commits

b2522cf Prepare release version 9.1.0
368d2fc [refactor] Tighten SetComparisonFunction to Iterator[str] (#14587)
ff77cd8 [refactor] Make base assertion comparisons return an iterator instead of a li...
0d8491a build(deps): Bump actions/stale from 10.2.0 to 10.3.0
4a809d9 Merge pull request #14568 from pytest-dev/register-fixture
5dfa385 Fix recursion traceback test to cover all styles (#14582)
f52ff0c Add pytest.register_fixture
a8ac094 Merge pull request #14567 from pytest-dev/more-visibility-deprecate
e5620cd [pre-commit.ci] pre-commit autoupdate (#14577)
2ce9c6d Merge pull request #14540 from minbang930/fix-14533-doctest-module-fixtures
Additional commits viewable in compare view

Updates pytest from 8.4.2 to 9.1.0

Release notes

Sourced from pytest's releases.

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

#14533: When using --doctest-modules, autouse fixtures with module, package or session scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.

If this is undesirable, move the fixture definition to a conftest.py file if possible.

Technical explanation for those interested: When using --doctest-modules, pytest possibly collects Python modules twice, once as pytest.Module and once as a DoctestModule (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the DoctestModule collects a fixture, it is now visible to it only, and not to the Module. This means that both need to register the fixtures independently.

Deprecations (removal in next major release)

#10819: Added a deprecation warning for class-scoped fixtures defined as instance methods (without @classmethod). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use @classmethod decorator instead -- by yastcher.

See 10819 and 14011.

#12882: Calling request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.

See dynamic-fixture-request-during-teardown for details.

#13409: Using non-~collections.abc.Collection iterables (such as generators, iterators, or custom iterable objects) for the argvalues parameter in @pytest.mark.parametrize <pytest.mark.parametrize ref> and metafunc.parametrize <pytest.Metafunc.parametrize> is now deprecated.

These iterables get exhausted after the first iteration, leading to tests getting unexpectedly skipped in cases such as running pytest.main() multiple times, using class-level parametrize decorators, or collecting tests multiple times.

See parametrize-iterators for details and suggestions.

#13946: The private config.inicfg attribute is now deprecated. Use config.getini() <pytest.Config.getini> to access configuration values instead.

See config-inicfg for more details.

#14004: Passing baseid to ~pytest.FixtureDef or nodeid strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.

Use the node parameter instead for fixture scoping. This enables more robust node-based matching instead of string prefix matching. If you've used nodeid=None, pass node=session instead.

This will be removed in pytest 10.

#14335: The method of configuring hooks using markers, deprecated since pytest 7.2, is now scheduled to be removed in pytest 10. See hook-markers for more details.

#14434: The --pastebin option is now deprecated.

... (truncated)

Commits

b2522cf Prepare release version 9.1.0
368d2fc [refactor] Tighten SetComparisonFunction to Iterator[str] (#14587)
ff77cd8 [refactor] Make base assertion comparisons return an iterator instead of a li...
0d8491a build(deps): Bump actions/stale from 10.2.0 to 10.3.0
4a809d9 Merge pull request #14568 from pytest-dev/register-fixture
5dfa385 Fix recursion traceback test to cover all styles (#14582)
f52ff0c Add pytest.register_fixture
a8ac094 Merge pull request #14567 from pytest-dev/more-visibility-deprecate
e5620cd [pre-commit.ci] pre-commit autoupdate (#14577)
2ce9c6d Merge pull request #14540 from minbang930/fix-14533-doctest-module-fixtures
Additional commits viewable in compare view

Updates gunicorn from 23.0.0 to 26.0.0

Release notes

Sourced from gunicorn's releases.

26.0.0

Breaking Changes

Eventlet worker removed: The eventlet worker class has been dropped. Migrate to gevent, gthread, or tornado.

New Features

ASGI Framework Compatibility Suite: New end-to-end compatibility test harness covering Starlette, FastAPI, Litestar, Quart, Sanic, and BlackSheep. Current grid passes 438/444 tests (98%).

ASGI Test Suite Expansion: 134 additional ASGI unit tests covering protocol semantics, lifespan, websockets, and chunked framing.

Security

HTTP/1.1 Request-Target Validation (RFC 9112 sections 3.2.3, 3.2.4):

Reject authority-form request-target outside CONNECT

Reject asterisk-form request-target outside OPTIONS

Reject relative-reference request-targets

Header Field Hardening (RFC 9110):

Reject control characters in header field-value (section 5.5)

Reject forbidden trailer field-names (section 6.5.1)

Reject Content-Length list form (RFC 9112 section 6.3)

Request Smuggling Hardening:

Tighten keepalive gate and scope finish_body byte cap

Keep _body_receiver alive across the keepalive smuggling gate so pipelined requests cannot re-enter a closed body

Address parser/protocol findings from a six-point WSGI/ASGI audit

PROXY Protocol (ASGI): Enforce proxy_allow_ips and tighten v1/v2 parsing in the ASGI callback parser.

Connection Draining: Drain the connection on close per RFC 9112 section 9.6 to prevent reset-on-close truncation.

Bug Fixes

Body Framing on HEAD/204/304:

Keep Content-Length on HEAD and 304 responses (#3621)

Drop body framing on HEAD/204/304 even when the framework set it

Warn once when an ASGI app emits a body for a no-body response

HTTP/2 ASGI:

Fix _handle_stream_ended to set _body_complete in the async HTTP/2 handler so request bodies finalize correctly on stream end

Add InvalidChunkExtension mapping and fast-parser support in ASGI tests (#3565)

HTTP/1.1 100-Continue: Stop adding Transfer-Encoding: chunked to 100-Continue interim responses.

WebSocket Close Handshake (RFC 6455):

Comply with the close handshake state machine

Close the transport after the close handshake completes

Fix binary send when the text key is None

Early Hints: Validate headers in the early_hints callback to match process_headers; pass only the header name to InvalidHeader (#3588).

ASGI Framework Fixes:

Fix ASGI disconnect handling for Django-style apps

Fix Litestar request handling (use raw ASGI receive for body/headers)

Fix Litestar HTTP endpoints for compatibility tests

Fix Quart headers endpoint to normalize keys to lowercase

Fix Quart WebSocket close test app (missing accept())

Fix duplicate Transfer-Encoding header for BlackSheep streaming

... (truncated)

Commits

5d819cf release: 26.0.0
b45c70d Merge pull request #3611 from zc-mattcen/docs-typo
99c8d48 Merge pull request #3623 from benoitc/chore/drop-eventlet-add-h2-uvloop-test-...
5a655af Merge pull request #3622 from benoitc/test/docker-port-and-ipv4-fixes
201df19 chore: remove eventlet worker; add h2 and uvloop to test deps
f4ac8e1 test: pass action name to dirty client and stabilize after TTOU spam
54d38af test: unblock docker fixtures on macOS hosts
68843c8 Merge pull request #3621 from benoitc/fix/asgi-preserve-content-length-on-hea...
31f2618 Merge pull request #3620 from benoitc/fix/asgi-proxy-protocol-trust-and-parsing
41ec752 fix: keep Content-Length on HEAD and 304 responses
Additional commits viewable in compare view

Updates pytest-cov from 5.0.0 to 7.1.0

Changelog

Sourced from pytest-cov's changelog.

7.1.0 (2026-03-21)

Fixed total coverage computation to always be consistent, regardless of reporting settings. Previously some reports could produce different total counts, and consequently can make --cov-fail-under behave different depending on reporting options. See [#641](https://github.com/pytest-dev/pytest-cov/issues/641) <https://github.com/pytest-dev/pytest-cov/issues/641>_.

Improve handling of ResourceWarning from sqlite3.

The plugin adds warning filter for sqlite3 ResourceWarning unclosed database (since 6.2.0). It checks if there is already existing plugin for this message by comparing filter regular expression. When filter is specified on command line the message is escaped and does not match an expected message. A check for an escaped regular expression is added to handle this case.

With this fix one can suppress ResourceWarning from sqlite3 from command line::

pytest -W "ignore:unclosed database in <sqlite3.Connection object at:ResourceWarning" ...

Various improvements to documentation. Contributed by Art Pelling in [#718](https://github.com/pytest-dev/pytest-cov/issues/718) <https://github.com/pytest-dev/pytest-cov/pull/718>_ and "vivodi" in [#738](https://github.com/pytest-dev/pytest-cov/issues/738) <https://github.com/pytest-dev/pytest-cov/pull/738>. Also closed [#736](https://github.com/pytest-dev/pytest-cov/issues/736) <https://github.com/pytest-dev/pytest-cov/issues/736>.

Fixed some assertions in tests. Contributed by in Markéta Machová in [#722](https://github.com/pytest-dev/pytest-cov/issues/722) <https://github.com/pytest-dev/pytest-cov/pull/722>_.

Removed unnecessary coverage configuration copying (meant as a backup because reporting commands had configuration side-effects before coverage 5.0).

7.0.0 (2025-09-09)

Dropped support for subprocesses measurement.

It was a feature added long time ago when coverage lacked a nice way to measure subprocesses created in tests. It relied on a .pth file, there was no way to opt-out and it created bad interations with coverage's new patch system <https://coverage.readthedocs.io/en/latest/config.html#run-patch>_ added in 7.10 <https://coverage.readthedocs.io/en/7.10.6/changes.html#version-7-10-0-2025-07-24>_.

To migrate to this release you might need to enable the suprocess patch, example for .coveragerc:

.. code-block:: ini

[run] patch = subprocess

This release also requires at least coverage 7.10.6.

Switched packaging to have metadata completely in pyproject.toml and use hatchling <https://pypi.org/project/hatchling/>_ for building. Contributed by Ofek Lev in [#551](https://github.com/pytest-dev/pytest-cov/issues/551) <https://github.com/pytest-dev/pytest-cov/pull/551>_ with some extras in [#716](https://github.com/pytest-dev/pytest-cov/issues/716) <https://github.com/pytest-dev/pytest-cov/pull/716>_.

Removed some not really necessary testing deps like six.

... (truncated)

Commits

66c8a52 Bump version: 7.0.0 → 7.1.0
f707662 Make the examples use pypy 3.11.
6049a78 Make context test use the old ctracer (seems the new sysmon tracer behaves di...
8ebf20b Update changelog.
861d30e Remove the backup context manager - shouldn't be needed since coverage 5.0, ...
fd4c956 Pass the precision on the nulled total (seems that there's some caching goion...
78c9c4e Only run the 3.9 on older deps.
4849a92 Punctuation.
197c35e Update changelog and hopefully I don't forget to publish release again :))
14dc1c9 Update examples to use 3.11 and make the adhoc layout example look a bit more...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…ith 3 updates Bumps the python-dependencies group with 1 update in the / directory: [pytest](https://github.com/pytest-dev/pytest). Bumps the python-dependencies group with 2 updates in the /sandbox directory: [gunicorn](https://github.com/benoitc/gunicorn) and [pytest-cov](https://github.com/pytest-dev/pytest-cov). Updates `pytest` from 8.4.2 to 9.1.0 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@8.4.2...9.1.0) Updates `pytest` from 8.4.2 to 9.1.0 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@8.4.2...9.1.0) Updates `gunicorn` from 23.0.0 to 26.0.0 - [Release notes](https://github.com/benoitc/gunicorn/releases) - [Commits](benoitc/gunicorn@23.0.0...26.0.0) Updates `pytest-cov` from 5.0.0 to 7.1.0 - [Changelog](https://github.com/pytest-dev/pytest-cov/blob/master/CHANGELOG.rst) - [Commits](pytest-dev/pytest-cov@v5.0.0...v7.1.0) --- updated-dependencies: - dependency-name: pytest dependency-version: 9.1.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: python-dependencies - dependency-name: pytest dependency-version: 9.1.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: python-dependencies - dependency-name: gunicorn dependency-version: 26.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: python-dependencies - dependency-name: pytest-cov dependency-version: 7.1.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: python-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Jun 15, 2026

dependabot Bot mentioned this pull request Jun 15, 2026

pip (deps): bump the python-dependencies group across 2 directories with 3 updates #352

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

pip (deps): bump the python-dependencies group across 2 directories with 3 updates#361

pip (deps): bump the python-dependencies group across 2 directories with 3 updates#361
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/python-dependencies-3807b49bbd

dependabot Bot commented on behalf of github Jun 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 15, 2026

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

Deprecations (removal in next major release)

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

Deprecations (removal in next major release)

26.0.0

Breaking Changes

New Features

Security

Bug Fixes

7.1.0 (2026-03-21)

7.0.0 (2025-09-09)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants