Skip to content

chore(deps-dev): bump the test group across 1 directory with 3 updates#29

Merged
heznpc merged 1 commit into
mainfrom
dependabot/pip/test-38d7016204
May 21, 2026
Merged

chore(deps-dev): bump the test group across 1 directory with 3 updates#29
heznpc merged 1 commit into
mainfrom
dependabot/pip/test-38d7016204

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 21, 2026 •
edited
Loading

Updates the requirements on pytest, pytest-asyncio and pytest-cov to permit the latest version.
Updates pytest to 9.0.3

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

  • #12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

  • #13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

    Previously this resulted in an internal assertion failure during plugin loading.

    Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

  • #13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

  • #14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

  • #14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

  • #13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.
  • #13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.
  • #14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.
  • #14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

  • #12689: The test reports are now published to Codecov from GitHub Actions. The test statistics is visible on the web interface.

    -- by aleguy02

Commits

Updates pytest-asyncio to 1.3.0

Release notes

Sourced from pytest-asyncio's releases.

pytest-asyncio 1.3.0

1.3.0 - 2025-11-10

Removed

  • Support for Python 3.9 (#1278)

Added

  • Support for pytest 9 (#1279)

Notes for Downstream Packagers

  • Tested Python versions include free threaded Python 3.14t (#1274)
  • Tests are run in the same pytest process, instead of spawning a subprocess with pytest.Pytester.runpytest_subprocess. This prevents the test suite from accidentally using a system installation of pytest-asyncio, which could result in test errors. (#1275)
Commits
  • 2e9695f docs: Compile changelog for v1.3.0
  • dd0e9ba docs: Reference correct issue in news fragment.
  • 4c31abe Build(deps): Bump nh3 from 0.3.1 to 0.3.2
  • 13e9477 Link to migration guides from changelog
  • 4d2cf3c tests: handle Python 3.14 DefaultEventLoopPolicy deprecation warnings
  • ee3549b test: Remove obsolete test for the event_loop fixture.
  • 7a67c82 tests: Fix failing test by preventing warning conversion to error.
  • a17b689 test: add pytest config to isolated test directories
  • 18afc9d fix(tests): replace runpytest_subprocess with runpytest
  • cdc6bd1 Add support for pytest 9 and drop Python 3.9 support
  • Additional commits viewable in compare view

Updates pytest-cov to 7.1.0

Changelog

Sourced from pytest-cov's changelog.

7.1.0 (2026-03-21)

  • Fixed total coverage computation to always be consistent, regardless of reporting settings. Previously some reports could produce different total counts, and consequently can make --cov-fail-under behave different depending on reporting options. See [#641](https://github.com/pytest-dev/pytest-cov/issues/641) <https://github.com/pytest-dev/pytest-cov/issues/641>_.

  • Improve handling of ResourceWarning from sqlite3.

    The plugin adds warning filter for sqlite3 ResourceWarning unclosed database (since 6.2.0). It checks if there is already existing plugin for this message by comparing filter regular expression. When filter is specified on command line the message is escaped and does not match an expected message. A check for an escaped regular expression is added to handle this case.

    With this fix one can suppress ResourceWarning from sqlite3 from command line::

    pytest -W "ignore:unclosed database in <sqlite3.Connection object at:ResourceWarning" ...

  • Various improvements to documentation. Contributed by Art Pelling in [#718](https://github.com/pytest-dev/pytest-cov/issues/718) <https://github.com/pytest-dev/pytest-cov/pull/718>_ and "vivodi" in [#738](https://github.com/pytest-dev/pytest-cov/issues/738) <https://github.com/pytest-dev/pytest-cov/pull/738>. Also closed [#736](https://github.com/pytest-dev/pytest-cov/issues/736) <https://github.com/pytest-dev/pytest-cov/issues/736>.

  • Fixed some assertions in tests. Contributed by in Markéta Machová in [#722](https://github.com/pytest-dev/pytest-cov/issues/722) <https://github.com/pytest-dev/pytest-cov/pull/722>_.

  • Removed unnecessary coverage configuration copying (meant as a backup because reporting commands had configuration side-effects before coverage 5.0).

7.0.0 (2025-09-09)

  • Dropped support for subprocesses measurement.

    It was a feature added long time ago when coverage lacked a nice way to measure subprocesses created in tests. It relied on a .pth file, there was no way to opt-out and it created bad interations with coverage's new patch system <https://coverage.readthedocs.io/en/latest/config.html#run-patch>_ added in 7.10 <https://coverage.readthedocs.io/en/7.10.6/changes.html#version-7-10-0-2025-07-24>_.

    To migrate to this release you might need to enable the suprocess patch, example for .coveragerc:

    .. code-block:: ini

    [run] patch = subprocess

    This release also requires at least coverage 7.10.6.

  • Switched packaging to have metadata completely in pyproject.toml and use hatchling <https://pypi.org/project/hatchling/>_ for building. Contributed by Ofek Lev in [#551](https://github.com/pytest-dev/pytest-cov/issues/551) <https://github.com/pytest-dev/pytest-cov/pull/551>_ with some extras in [#716](https://github.com/pytest-dev/pytest-cov/issues/716) <https://github.com/pytest-dev/pytest-cov/pull/716>_.

  • Removed some not really necessary testing deps like six.

... (truncated)

Commits
  • 66c8a52 Bump version: 7.0.0 → 7.1.0
  • f707662 Make the examples use pypy 3.11.
  • 6049a78 Make context test use the old ctracer (seems the new sysmon tracer behaves di...
  • 8ebf20b Update changelog.
  • 861d30e Remove the backup context manager - shouldn't be needed since coverage 5.0, ...
  • fd4c956 Pass the precision on the nulled total (seems that there's some caching goion...
  • 78c9c4e Only run the 3.9 on older deps.
  • 4849a92 Punctuation.
  • 197c35e Update changelog and hopefully I don't forget to publish release again :))
  • 14dc1c9 Update examples to use 3.11 and make the adhoc layout example look a bit more...
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels May 21, 2026
@dependabot dependabot Bot requested a review from heznpc as a code owner May 21, 2026 00:38
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels May 21, 2026
heznpc added a commit that referenced this pull request May 21, 2026
@heznpc
fix: 2nd-pass audit — previously declared done, second-pass caught (#32)
98b7892 
Adversarial second-pass on commits 01ed305 (PR #26) and ec7045d (PR #27),
both reported as "done / tests pass / CI green". Two Critical findings.

[C1] CodeQL `analyze (actions)` open alert
- Rule: `actions/missing-workflow-permissions`
- File: .github/workflows/cd.yml
- Message: "Actions job or workflow does not limit the permissions of the
  GITHUB_TOKEN."
- Detected by the CodeQL `actions` language matrix that PR #26 itself added.
  PR #26 introduced top-level permissions on most workflows but missed
  cd.yml and setup.yml. The 5 required CI checks didn't include CodeQL,
  so the alert landed silently after merge.
- Fix: add `permissions: contents: read` at workflow top level in cd.yml
  and setup.yml. Jobs continue to opt into the writes they need
  (contents:write / id-token:write / attestations:write for publish;
  issues:write for setup).

[C2] `ok()` and `err()` Response Helpers — dead code marketed as feature
- server.py:41 and server.py:47 defined ok() / err() helpers.
- Zero references anywhere in src/ or tests/ (`grep -rn "\\bok(\\|\\berr("` =
  only the definitions + the introductory comment).
- Coverage report confirmed: server.py:43-44, 49 uncovered.
- README.md:32 and README.ko.md:30 marketed these as "Response Helpers —
  ok() and err() for consistent tool responses" in the "What You Get"
  list — i.e. a public feature claim with no backing code usage.
- The bundled `greet` tool returns plain `str` — the README's marketed
  pattern doesn't match the bundled example.
- FastMCP's idiom is `return value` / `raise on error`; ok/err helpers
  are a raw-MCP-without-FastMCP relic that actively teach the wrong
  pattern.
- Fix: delete ok() / err() / their introductory comment. Replace the
  Tools-section banner comment with one line documenting the actual
  FastMCP idiom. Remove the "Response Helpers" bullet from README.md
  and README.ko.md.

Why this matters beyond cosmetics: a starter is a teaching artifact.
False "What You Get" entries silently propagate the wrong pattern to
every clone. The dead helpers were also reachable code surface that
CodeQL has to scan but no test exercises.

Verification
- All 7 workflows now have top-level `permissions:` (verified via
  `awk` scan of column-1 `permissions:` line).
- ruff / ruff format / mypy strict / pytest 17/17 all clean.
- Coverage 72.12% (improved from 70.64% — uncovered dead code removed).

Out-of-scope for this PR (will be raised as Major findings for user
decision):
- tests/test_tools.py has no `test_greet_registered_on_server` despite
  test_server_info.py and test_code_review.py both having that pattern.
- server_info.py wheel-install fallback path (lines 41-42, 52-56) is 0%
  covered; test only exercises the dev/source-tree read-pyproject path.
- src/my_mcp_server/tools/greet.py defines a `register()` that's never
  called by server.py — fully dead modular example.
- SECURITY.md "branch protection on main" claim is starter-side only;
  clones inherit nothing.
- 4 Dependabot PRs (#28, #29, #30, #31) opened today — #28 is
  attest-build-provenance v3.2.0 → v4.1.0, making our 6-hour-old SHA
  pin already one major behind.
@heznpc
Copy link
Copy Markdown
Member

heznpc commented May 21, 2026

@dependabot rebase

@dependabot
chore(deps-dev): bump the test group across 1 directory with 3 updates
26c89f2 
Updates the requirements on [pytest](https://github.com/pytest-dev/pytest), [pytest-asyncio](https://github.com/pytest-dev/pytest-asyncio) and [pytest-cov](https://github.com/pytest-dev/pytest-cov) to permit the latest version.

Updates `pytest` to 9.0.3
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@8.0.0...9.0.3)

Updates `pytest-asyncio` to 1.3.0
- [Release notes](https://github.com/pytest-dev/pytest-asyncio/releases)
- [Commits](pytest-dev/pytest-asyncio@v1.0.0...v1.3.0)

Updates `pytest-cov` to 7.1.0
- [Changelog](https://github.com/pytest-dev/pytest-cov/blob/master/CHANGELOG.rst)
- [Commits](pytest-dev/pytest-cov@v6.0.0...v7.1.0)

---
updated-dependencies:
- dependency-name: pytest
  dependency-version: 9.0.3
  dependency-type: direct:development
  dependency-group: test
- dependency-name: pytest-asyncio
  dependency-version: 1.3.0
  dependency-type: direct:development
  dependency-group: test
- dependency-name: pytest-cov
  dependency-version: 7.1.0
  dependency-type: direct:development
  dependency-group: test
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps-dev): bump the test group with 3 updates chore(deps-dev): bump the test group across 1 directory with 3 updates May 21, 2026
@dependabot dependabot Bot force-pushed the dependabot/pip/test-38d7016204 branch from 6de1305 to 26c89f2 Compare May 21, 2026 13:23
@heznpc heznpc merged commit db9bfe3 into main May 21, 2026
9 checks passed
@heznpc heznpc deleted the dependabot/pip/test-38d7016204 branch May 21, 2026 15:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@heznpc heznpc Awaiting requested review from heznpc heznpc is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@heznpc