build(deps): bump pytest to 9.0.3 across every requirements file to clear 60 security alerts by ocelotl · Pull Request #5317 · open-telemetry/opentelemetry-python-contrib

ocelotl · 2026-11-10T15:55:13Z

Description

Raises pytest to 9.0.3 in every requirements file in the repository. GHSA-6w46-j5rx-g56g (GHSA-6w46-j5rx-g56g) has a vulnerable range of < 9.0.3, so 9.0.3 is the lowest version that clears the advisory. The bump closes 60 open Dependabot alerts, every one of them an instance of GHSA-6w46-j5rx-g56g.

The bump cannot be split across smaller pull requests. A lint- environment installs dev-requirements.txt and one package's test-requirements.txt in a single resolution, so as soon as one file disagrees the environment is unresolvable:

error: Because you require pytest==9.0.3 and pytest==7.4.4, we can conclude that your requirements are unsatisfiable

I tried the split first and it turned every lint- job red.

The remaining commits are what pytest 9 requires, rather than unrelated cleanup:

flaky 3.7.0 imports call_runtest_hook from _pytest.runner, which pytest 9 removed, and collection aborts. 3.8.1 works under both 7.4.4 and 9.0.3.
syrupy 4.6.1 declares pytest>=7.0.0,<9.0.0, so the two resourcedetector-gcp environments cannot be installed at all. 6.1.1 is the highest release that permits pytest 9, and the 31 stored snapshots match unchanged under it.
pytest 9 defaults to the importlib import mode, under which instrumentation/opentelemetry-instrumentation-grpc/tests/protobuf is not a package, so the absolute import at test_server_pb2_grpc.py:3 fails at collection. The commit adds an __init__.py carrying only the licence header.
In pytest 9, pytest.xfail is an instance of _pytest.outcomes._XFail rather than a function. pylint does not follow its -> NoReturn annotation through __call__, which produces 27 possibly-used-before-assignment errors in tests/test_botocore_bedrock.py and fails lint-instrumentation-botocore. pytest.xfail.Exception is XFailed in both 7.4.4 and 9.0.3 and _XFail.__call__ does nothing but raise it, so raising it directly is equivalent and lint clean.
pytest-asyncio 0.23.5 declares pytest<9; three files move to 1.4.1.
Fifteen generated requirements files are recompiled rather than hand-edited. pytest 9 requires packaging>=22.0 and several oldest files pinned packaging==18.0 or 21.0, so editing only the pytest line left them uninstallable.

Gaps and concerns

instrumentation/opentelemetry-instrumentation-fastapi/test-requirements.latest.txt is edited by hand for the pytest line alone, which is the one deliberate exception to recompiling. Recompiling it moves starlette from 1.3.1 down to 0.48.0, because test-requirements.in carries fastapi~=0.119.1 and that range caps starlette below 1.0, which would reopen six starlette advisories. Raising the fastapi floor is a decision about the declared fastapi ~= 0.92 support range at pyproject.toml:37 and belongs in its own pull request.

One commit is not a dependency bump. test_metrics_concurrent_requests in tornado requires the client-measured and the server-measured duration of a 1 second request to agree within 10 ms, and under pytest 9.0.3 that assertion fails on the Python 3.10 runners with AssertionError: 0.020430181503295897 != 0.0 within 0.01 delta. I first saw the failure on my fork, so I pushed the branch here without the commit to check the failure reproduces on this repository's CI, and it does. The excess is entirely on the client side: a failing run reported server_ms=1002 against client_s=1.0242199897766113 where a passing run reported server_ms=1003 against client_s=1.005490779876709, and the client figure covers connection setup and the event loop dispatch of two concurrent fetches, neither of which the server figure includes. Both tolerances move to 50 ms, which is what the same test already allows for PyPy. The PyPy allowance came from #4665 closing #4664 and the 20 ms tolerance from #4550 closing #4070, both of them the same assertion flaking for the same reason. I could not attribute the change in timing to pytest 9 itself: a branch carrying only the tornado pytest bump passes with a 2.5 ms gap.

Recompiling the two starlette files also drops importlib-metadata, zipp and sniffio. None of the three is a pytest dependency. opentelemetry-api on core main now declares only typing-extensions, so importlib-metadata is no longer pulled in, and zipp came in through importlib-metadata. anyio 4.14.2 declares only idna, so sniffio is no longer pulled in either.

opamp is the only package compiled with --resolution lowest rather than --resolution lowest-direct, so it lowers transitive dependencies too and picked up pygments==2.7.2 once pytest 9 pulled pygments in. sphinx 7.1.2 in dev-requirements.txt needs pygments>=2.13, which made lint-opamp-client unresolvable, so its test-requirements.in gains a pygments>=2.13 floor.

Type of change

Bug fix (non-breaking change which fixes an issue)

Checklist:

I am a human and not a bot
I have run tox -e precommit
I have run tox -e typecheck
I have run the relevant tests and linting tox environments

flaky 3.7.0 does `from _pytest.runner import call_runtest_hook`, which pytest removed. Under pytest 9 the import fails and every environment that installs flaky dies at collection. 3.8.1 works under both pytest 7.4.4 and pytest 9.0.3, so the bump is safe ahead of the pytest upgrade and is kept separate from it.

…ackage instrumentation/opentelemetry-instrumentation-grpc/tests/protobuf/test_server_pb2_grpc.py:3 does `from tests.protobuf import test_server_pb2`, an absolute import that only resolves while the package directory is on sys.path and `tests.protobuf` is a real package. The directory had no __init__.py, so resolution depended on pytest inserting the directory itself, which pytest 9 no longer does by default. Adding the missing __init__.py makes the import work without relying on an import-mode default. The grpc suite goes from 12 collection errors to 156 passed.

GHSA-6w46-j5rx-g56g has no fix below pytest 9.0.3 and affects 60 open alerts. The bump has to cover every file at once. The lint environments install dev-requirements.txt and the package's own test-requirements.txt in a single resolution, so any file left on 7.4.4 makes the lint environment for its package unresolvable. 115 files pin pytest, not the 60 that carry an alert. Three things move with pytest because pytest 9 requires them: - pytest-asyncio 0.23.5 to 1.4.1 in the aiohttp-server, asyncio and click test requirements, since 0.23.5 caps pytest below 9. No test or conftest change was needed. The six instrumentation-genai files keep pytest-asyncio 0.21.0, which works unchanged under pytest 9. - The uv-generated requirements files are regenerated rather than hand-edited, because pytest 9 requires packaging>=22.0 and the oldest variants resolved packaging to 18.0 or 21.0, which cannot satisfy it. Regeneration also adds pygments, which pytest 9 depends on and pytest 7.4.4 did not, and drops pyparsing and six, which packaging 22.0 no longer needs. - The pytest floor in each regenerated .in file moves from 7.4 to 9.0. instrumentation/opentelemetry-instrumentation-fastapi/test-requirements.latest.txt is edited by hand instead of regenerated. Regenerating it from the current .in replaces fastapi 0.137.2 with 0.119.1 and starlette 1.3.1 with 0.48.0, because the .in still asks for fastapi~=0.119.1 and fastapi 0.119.1 caps starlette below 0.49.0. Starlette's first fixed release is 0.49.1, so regenerating would reopen six starlette advisories that are currently closed. The .in and the generated file have drifted and need reconciling in their own change.

syrupy 4.6.1 declares pytest>=7.0.0,<9.0.0, so the resourcedetector-gcp environments cannot be installed alongside pytest 9.0.3: Because syrupy==4.6.1 depends on pytest>=7.0.0,<9.0.0 and you require pytest==9.0.3, we can conclude that your requirements and syrupy==4.6.1 are incompatible. syrupy 5.0.0 is the lowest release that permits pytest 9. 6.1.1 is the highest. The 31 stored snapshots under resource/opentelemetry-resourcedetector-gcp/tests/__snapshots__ match unchanged under both, so this takes the highest and keeps the two requirements files identical outside their opentelemetry-api and opentelemetry-sdk pins.

….xfail In pytest 9, pytest.xfail is an instance of _pytest.outcomes._XFail rather than a function. Its __call__ is still annotated -> NoReturn, but pylint does not follow the annotation through __call__, so every variable assigned only in the branches of an if/elif chain whose else branch calls pytest.xfail is reported as possibly-used-before-assignment: tests/test_botocore_bedrock.py:1464:25: E0606: Possibly using variable 'finish_reason' before assignment (possibly-used-before-assignment) That accounts for 27 errors in this file and fails lint-instrumentation-botocore. pytest.xfail.Exception is _pytest.outcomes.XFailed in both pytest 7.4.4 and pytest 9.0.3, and _XFail.__call__ does nothing but raise it, so raising it directly is equivalent and pylint recognises the branch as terminating. Verified against pylint 4.0.9 with both pytest versions.

opentelemetry-pr-dashboard · 2026-11-10T15:56:04Z

Pull request dashboard status

Merged · refreshed 2026-11-10 21:04 UTC

Status above doesn't look right?

Anything look wrong? Report it with what you expected; it helps us improve the dashboard.

… inputs instrumentation/opentelemetry-instrumentation-starlette/test-requirements.in and opamp/opentelemetry-opamp-client/test-requirements.in still carried a pytest 7 floor while their generated outputs were moved to 9.0.3. Both are compiled with -c dev-requirements.txt, which now constrains pytest to 9.0.3, so regenerating either one would fail to resolve rather than reproduce the committed file. opamp also gains a pygments floor. pytest 9 adds pygments as a dependency, opamp is the only package compiled with --resolution lowest rather than --resolution lowest-direct, and that lowers transitive dependencies too, so the first regeneration produced pygments==2.7.2. The lint environment installs dev-requirements.txt alongside that file and sphinx 7.1.2 requires pygments>=2.13, which made lint-opamp-client unresolvable: Because sphinx==7.1.2 depends on pygments>=2.13 and you require sphinx==7.1.2, we can conclude that you require pygments>=2.13. And because you require pygments==2.7.2, we can conclude that your requirements are unsatisfiable. Regenerating the four outputs also drops importlib-metadata, zipp and sniffio from the two starlette files. Those are not pytest dependencies. They disappear because the resolution runs against the current metadata of opentelemetry-api and anyio, which no longer require them.

test_metrics_concurrent_requests issues a 1 second request to /slow and a fast request to /async at the same time, then requires the client-measured and the server-measured duration of each to agree within 10ms and 20ms. Under pytest 9.0.3 the first of those assertions fails on the Python 3.10 runners: AssertionError: 0.020430181503295897 != 0.0 within 0.01 delta tests/test_metrics_instrumentation.py:229 The excess is entirely on the client side. A failing run reported server_ms=1002 against client_s=1.0242199897766113, where a passing run reported server_ms=1003 against client_s=1.005490779876709. The client figure covers connection setup and the event loop dispatch of two concurrent fetches, neither of which the server figure includes, and the server figure is quantised to whole milliseconds on top of that. 10ms of a 1 second measurement is 1 percent, which is below the noise floor of a shared runner. The assertion exists to catch per-request state being mixed between concurrent requests, and mixing per-request state substitutes a 1ms duration for a 1000ms one, which a 50ms tolerance still catches. 50ms is what this same test already allows for PyPy. The PyPy allowance was added in open-telemetry#4665 to close open-telemetry#4664, and the 20ms tolerance was added in open-telemetry#4550 to close open-telemetry#4070, both of them the same assertion flaking for the same reason.

Copilot

🔵 Needs a closer look

Compatibility of retained plugins with pytest 9, particularly pytest-asyncio 0.21.0 and pytest-aiohttp 1.0.5, requires confirmation across the supported Python/PyPy CI matrix because dependency-backed execution is unavailable in this review.

No open issues 🎉

What changed in this PR

Updates the monorepo’s test dependencies to pytest 9.0.3 to address GHSA-6w46-j5rx-g56g while keeping shared development and package requirements aligned.

Changes:

Updates pytest pins and requirement inputs, regenerating dependency files where needed.
Upgrades affected test plugins and adjusts gRPC test packaging and Bedrock expected-failure handling.
Relaxes Tornado timing assertions to reduce scheduling-related flakes, continuing the adjustments in #4550 and #4665.

File	Description
`util/opentelemetry-util-http/test-requirements.txt`	Pins pytest 9.0.3.
`util/opentelemetry-util-genai/test-requirements.txt`	Pins pytest 9.0.3.
`tests/opentelemetry-docker-tests/tests/test-requirements.txt`	Updates pytest and flaky.
`sdk-extension/opentelemetry-sdk-extension-aws/test-requirements-1.txt`	Pins pytest 9.0.3.
`sdk-extension/opentelemetry-sdk-extension-aws/test-requirements-0.txt`	Pins pytest 9.0.3.
`resource/opentelemetry-resourcedetector-gcp/requirements.oldest.txt`	Updates pytest and syrupy.
`resource/opentelemetry-resourcedetector-gcp/requirements.latest.txt`	Updates pytest and syrupy.
`resource/opentelemetry-resource-detector-containerid/test-requirements.txt`	Pins pytest 9.0.3.
`resource/opentelemetry-resource-detector-azure/test-requirements-1.txt`	Pins pytest 9.0.3.
`resource/opentelemetry-resource-detector-azure/test-requirements-0.txt`	Pins pytest 9.0.3.
`propagator/opentelemetry-propagator-ot-trace/test-requirements.txt`	Pins pytest 9.0.3.
`propagator/opentelemetry-propagator-aws-xray/test-requirements-1.txt`	Pins pytest 9.0.3.
`propagator/opentelemetry-propagator-aws-xray/test-requirements-0.txt`	Pins pytest 9.0.3.
`processor/opentelemetry-processor-baggage/test-requirements.txt`	Pins pytest 9.0.3.
`opentelemetry-instrumentation/test-requirements.txt`	Pins pytest 9.0.3.
`opentelemetry-distro/test-requirements.txt`	Pins pytest 9.0.3.
`opamp/opentelemetry-opamp-client/test-requirements.lowest.txt`	Updates pytest and adds Pygments.
`opamp/opentelemetry-opamp-client/test-requirements.latest.txt`	Updates pytest and adds Pygments.
`opamp/opentelemetry-opamp-client/test-requirements.in`	Raises pytest minimum and adds Pygments floor.
`instrumentation/opentelemetry-instrumentation-wsgi/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-urllib3/test-requirements-1.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-urllib3/test-requirements-0.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-urllib/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-tortoiseorm/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-tornado/tests/test_metrics_instrumentation.py`	Raises duration-comparison tolerances to 50 ms.
`instrumentation/opentelemetry-instrumentation-tornado/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-threading/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-system-metrics/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-structlog/test-requirements.oldest.txt`	Updates pytest, packaging, and transitive pins.
`instrumentation/opentelemetry-instrumentation-structlog/test-requirements.latest.txt`	Updates pytest and adds Pygments.
`instrumentation/opentelemetry-instrumentation-structlog/test-requirements.in`	Moves pytest requirement to 9.x.
`instrumentation/opentelemetry-instrumentation-starlette/test-requirements.oldest.txt`	Updates pytest and refreshes transitive dependencies.
`instrumentation/opentelemetry-instrumentation-starlette/test-requirements.latest.txt`	Updates pytest and refreshes transitive dependencies.
`instrumentation/opentelemetry-instrumentation-starlette/test-requirements.in`	Moves pytest requirement to 9.x.
`instrumentation/opentelemetry-instrumentation-sqlite3/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-sqlalchemy/test-requirements.oldest.txt`	Updates pytest, packaging, and transitive pins.
`instrumentation/opentelemetry-instrumentation-sqlalchemy/test-requirements.latest.txt`	Updates pytest and adds Pygments.
`instrumentation/opentelemetry-instrumentation-sqlalchemy/test-requirements.in`	Moves pytest requirement to 9.x.
`instrumentation/opentelemetry-instrumentation-requests/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-remoulade/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-redis/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-pyramid/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-pymysql/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-pymssql/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-pymongo/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-pymemcache/test-requirements-4.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-pymemcache/test-requirements-3.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-pymemcache/test-requirements-2.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-pymemcache/test-requirements-1.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-pymemcache/test-requirements-0.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-psycopg2/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-psycopg2/test-requirements-binary.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-psycopg/test-requirements-1.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-psycopg/test-requirements-0.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-pika/test-requirements-1.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-pika/test-requirements-0.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-mysqlclient/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-mysql/test-requirements-2.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-mysql/test-requirements-1.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-mysql/test-requirements-0.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-logging/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-kafka-python/test-requirements.oldest.txt`	Updates pytest, packaging, and transitive pins.
`instrumentation/opentelemetry-instrumentation-kafka-python/test-requirements.latest.txt`	Updates pytest and adds Pygments.
`instrumentation/opentelemetry-instrumentation-kafka-python/test-requirements.in`	Moves pytest requirement to 9.x.
`instrumentation/opentelemetry-instrumentation-jinja2/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-httpx/test-requirements-3.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-httpx/test-requirements-2.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-httpx/test-requirements-1.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-httpx/test-requirements-0.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-grpc/tests/protobuf/__init__.py`	Makes protobuf test helpers a Python package.
`instrumentation/opentelemetry-instrumentation-grpc/test-requirements-1.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-grpc/test-requirements-0.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-flask/test-requirements-3.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-flask/test-requirements-2.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-flask/test-requirements-1.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-flask/test-requirements-0.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-fastapi/test-requirements.oldest.txt`	Updates pytest, packaging, and transitive pins.
`instrumentation/opentelemetry-instrumentation-fastapi/test-requirements.latest.txt`	Updates only the pytest pin.
`instrumentation/opentelemetry-instrumentation-fastapi/test-requirements.in`	Moves pytest requirement to 9.x.
`instrumentation/opentelemetry-instrumentation-falcon/test-requirements-4.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-falcon/test-requirements-3.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-falcon/test-requirements-2.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-falcon/test-requirements-1.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-falcon/test-requirements-0.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-exceptions/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-django/test-requirements-3.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-django/test-requirements-2.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-django/test-requirements-1.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-django/test-requirements-0.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-dbapi/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-confluent-kafka/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-click/test-requirements.txt`	Updates pytest and pytest-asyncio.
`instrumentation/opentelemetry-instrumentation-celery/test-requirements-1.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-celery/test-requirements-0.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-cassandra/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-cassandra/test-requirements-scylla.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-botocore/tests/test_botocore_bedrock.py`	Raises expected-failure exceptions directly for lint compatibility.
`instrumentation/opentelemetry-instrumentation-botocore/test-requirements-3.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-botocore/test-requirements-2.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-botocore/test-requirements-1.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-botocore/test-requirements-0.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-boto3sqs/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-aws-lambda/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-asyncpg/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-asyncio/test-requirements.txt`	Updates pytest and pytest-asyncio.
`instrumentation/opentelemetry-instrumentation-asyncclick/test-requirements.oldest.txt`	Updates pytest, packaging, and transitive pins.
`instrumentation/opentelemetry-instrumentation-asyncclick/test-requirements.latest.txt`	Updates pytest and adds Pygments.
`instrumentation/opentelemetry-instrumentation-asyncclick/test-requirements.in`	Moves pytest requirement to 9.x.
`instrumentation/opentelemetry-instrumentation-asgi/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-aiopg/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-aiokafka/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-aiohttp-server/test-requirements.txt`	Updates pytest and pytest-asyncio.
`instrumentation/opentelemetry-instrumentation-aiohttp-client/test-requirements.txt`	Pins pytest 9.0.3.
`instrumentation/opentelemetry-instrumentation-aio-pika/test-requirements.in`	Moves pytest requirement to 9.x.
`instrumentation/opentelemetry-instrumentation-aio-pika/test-requirements-oldest.txt`	Updates pytest, packaging, and transitive pins.
`instrumentation/opentelemetry-instrumentation-aio-pika/test-requirements-latest.txt`	Updates pytest and adds Pygments.
`instrumentation-genai/opentelemetry-instrumentation-vertexai/tests/requirements.oldest.txt`	Pins pytest 9.0.3.
`instrumentation-genai/opentelemetry-instrumentation-vertexai/tests/requirements.latest.txt`	Pins pytest 9.0.3.
`instrumentation-genai/opentelemetry-instrumentation-openai-v2/tests/requirements.oldest.txt`	Pins pytest 9.0.3.
`instrumentation-genai/opentelemetry-instrumentation-openai-v2/tests/requirements.latest.txt`	Pins pytest 9.0.3.
`instrumentation-genai/opentelemetry-instrumentation-openai-agents-v2/tests/requirements.oldest.txt`	Pins pytest 9.0.3.
`instrumentation-genai/opentelemetry-instrumentation-openai-agents-v2/tests/requirements.latest.txt`	Pins pytest 9.0.3.
`exporter/opentelemetry-exporter-richconsole/test-requirements.txt`	Updates pytest and flaky.
`exporter/opentelemetry-exporter-prometheus-remote-write/test-requirements.txt`	Pins pytest 9.0.3.
`exporter/opentelemetry-exporter-credential-provider-gcp/test-requirements.txt`	Pins pytest 9.0.3.
`dev-requirements.txt`	Aligns shared pytest and flaky versions.

_{Review effort: Balanced}

ocelotl added 5 commits November 10, 2026 09:34

ocelotl requested a review from a team as a code owner November 10, 2026 15:55

github-actions Bot assigned codeboten, DylanRussell, herin049 and keith-decker Nov 10, 2026

github-actions Bot added the gen-ai Related to generative AI label Nov 10, 2026

github-actions Bot assigned lmolkova Nov 10, 2026

otelbot-python Bot added this to Python PR digest Nov 10, 2026

ocelotl added the Skip Changelog PRs that do not require a CHANGELOG.md entry label Nov 10, 2026

opentelemetry-pr-dashboard Bot mentioned this pull request Nov 10, 2026

Pull Request Dashboard #4959

Open

ocelotl force-pushed the bump_pytest_9 branch from 2cc4de2 to 5e47ac4 Compare November 10, 2026 19:05

herin049 approved these changes Nov 10, 2026

View reviewed changes

github-project-automation Bot moved this to Approved PRs in Python PR digest Nov 10, 2026

herin049 requested a balanced review from Copilot November 10, 2026 20:16

Copilot started reviewing on behalf of herin049 November 10, 2026 20:17

View session

Copilot AI reviewed Nov 10, 2026

View reviewed changes

herin049 added this pull request to the merge queue Nov 10, 2026

Merged via the queue into open-telemetry:main with commit bf908e4 Nov 10, 2026
770 checks passed

github-project-automation Bot moved this from Approved PRs to Done in Python PR digest Nov 10, 2026

Navigation Menu

Repository navigation

build(deps): bump pytest to 9.0.3 across every requirements file to clear 60 security alerts - #5317

build(deps): bump pytest to 9.0.3 across every requirements file to clear 60 security alerts#5317
herin049 merged 7 commits into
open-telemetry:mainfrom
ocelotl:bump_pytest_9

ocelotl commented Nov 10, 2026 •

edited

Loading

Uh oh!

opentelemetry-pr-dashboard Bot commented Nov 10, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Conversation

ocelotl commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Gaps and concerns

Type of change

Checklist:

Uh oh!

opentelemetry-pr-dashboard Bot commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull request dashboard status

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

ocelotl commented Nov 10, 2026 •

edited

Loading

opentelemetry-pr-dashboard Bot commented Nov 10, 2026 •

edited

Loading