Bump pytest from 9.0.2 to 9.0.3 in the pip group across 1 directory

[dependabot]

Bumps the pip group with 1 update in the / directory: pytest.

Updates pytest from 9.0.2 to 9.0.3

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

• #12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

• #13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

  Previously this resulted in an internal assertion failure during plugin loading.

  Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

• #13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

• #14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

• #14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

• #13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.
• #13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.
• #14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.
• #14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

• #12689: The test reports are now published to Codecov from GitHub Actions. The test statistics is visible on the web interface.

  -- by aleguy02

Commits

• a7d58d7 Prepare release version 9.0.3
• 089d981 Merge pull request #14366 from bluetech/revert-14193-backport
• 8127eaf Revert "Fix: assertrepr_compare respects dict insertion order (#14050) (#14193)"
• 99a7e60 Merge pull request #14363 from pytest-dev/patchback/backports/9.0.x/95d8423bd...
• ddee02a Merge pull request #14343 from bluetech/cve-2025-71176-simple
• 74eac69 doc: Update training info (#14298) (#14301)
• f92dee7 Merge pull request #14267 from pytest-dev/patchback/backports/9.0.x/d6fa26c62...
• 7ee58ac Merge pull request #12378 from Pierre-Sassoulas/fix-implicit-str-concat-and-d...
• 37da870 Merge pull request #14259 from mitre88/patch-4 (#14268)
• c34bfa3 Add explanation for string context diffs (#14257) (#14266)
• Additional commits viewable in compare view

[villelaitila]

Reviewed the diff: it's a two-line change to requirements.txt bumping lxml (6.0.2 → 6.1.2) and pytest (9.0.2 → 9.0.3), with no other files touched.

No logical issues or weaknesses found:

• No source code is affected, so there's no behavioral risk to review beyond the pin changes themselves.
• The pytest bump is a bug-fix release that includes a fix for CVE-2025-71176 (insecure temporary directory) — a net-positive security update.
• The lxml bump (6.0.x → 6.1.x) is a minor-version bump under the ~= operator, so it's within the range the pin already permits; setup.cfg's lxml>=5.3.0 install-requires bound is unaffected and stays compatible.
• Nothing in setup.cfg or elsewhere pins these packages to conflicting versions.

Only suggestion: since lxml is used for XML parsing/serialization across the converters (xml_to_json.py, graphml.py) and 6.1 is a minor version, it'd be worth confirming CI passes fully on this PR before merging, though nothing in the changelog suggests a breaking change relevant to this codebase.

---

Generated by Claude Code