deps: pytest 9.0.3 and pytest-asyncio 1.4.0 (CVE-2025-71176) - #8
Merged
Conversation
…ith it CVE-2025-71176 (GHSA-6w46-j5rx-g56g, CVSS 6.8): pytest through 9.0.2 on UNIX uses predictable /tmp/pytest-of-{user} directories, so a local user can cause a denial of service or possibly escalate. Fixed in 9.0.3. pytest-asyncio 1.1.0 pins pytest<9, so the two move together or neither does. 1.4.0 is the first release that accepts pytest 9. 239 passed, 5 skipped on Linux under the new pins, unchanged from 8.4.1. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes Dependabot alert #1.
What
pytest8.4.1 -> 9.0.3,pytest-asyncio1.1.0 -> 1.4.0 inrequirements-dev.txt.Why
GHSA-6w46-j5rx-g56g / CVE-2025-71176, CVSS 6.8 medium. pytest through 9.0.2 on UNIX uses predictable
/tmp/pytest-of-{user}directories, which lets a local user cause a denial of service or possibly escalate privileges. First patched in 9.0.3.The two are coupled.
pytest-asyncio1.1.0 pinspytest<9, so pytest cannot move on its own. 1.4.0 is the first release that accepts pytest 9.Dev-only.
requirements-dev.txtnever ships, so this is CI and local test surface, not the installed agent.Verification
Full Linux suite on Python 3.12 against the new pins, identical pass/skip counts to 8.4.1. Windows-only tests skip on Linux as usual and run in CI.
Noted, not changed
Nothing in this repo actually uses
pytest-asyncio. There is noasyncio_modeconfig, no@pytest.mark.asyncio, noasync def test_, and no import of it anywhere. Every async path intests/test_request_limits.pyandtests/test_peer_discovery_security.pygoes throughasyncio.run()inside a sync test. It looks like a leftover from the API auth/TLS work. Dropping it outright would remove a dependency and the version coupling that made this alert a two-package change, but that is a separate call from taking the security fix.🤖 Generated with Claude Code