[renovate]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

pytest (dependency) 9.1.1 -> 9.2.0

Risk: 🟢 Safe

The Deep Dive

Update Scope

Lock file maintenance for renovate-eval/uv.lock. The only change is pytest 9.1.1 → 9.2.0 (release notes), which is a minor release. pytest is a test-only dependency. It comes in transitively through the dev dependency group (pytest-cov>=7.1.0, pyyaml>=6.0.3 in renovate-eval/pyproject.toml). The only place it runs is the renovate-eval-tests pre-commit hook (uv run pytest tests/ --cov ...). It is not part of the composite action or the reusable workflow at runtime.

These stay the same: pluggy 1.7.0 (meets the new pluggy>=1.6 floor), pytest-cov 7.1.0, coverage 7.17.0, iniconfig, packaging, pygments, colorama, pyyaml, flake.nix/flake.lock, and all workflow and action files.

Performance & Stability

• Rewrite cache keyed on a source hash (#11418, #13292): the assertion-rewrite .pyc cache now checks a hash of the source instead of the file's modification time. This happens automatically. The one-time cache rebuild doesn't matter here because the 504-test suite runs in about 3 s.
• Less overhead per test (#14687 fd-capture skip, #15254 tmp_path counter): both are automatic. The suite uses tmp_path heavily, so this is a small gain at most.
• Fixed a 9.1.0 regression where collection got quadratically slow with many same-named fixtures (#14942): the repo doesn't use the inherited class-fixture pattern that triggers it, so there's no observable effect.

Features & UX

• parametrize_long_str_id_strategy ini option (#6881): this is opt-in and isn't configured. [tool.pytest.ini_options] only sets testpaths. The default short strategy only affects auto-generated IDs longer than 100 characters.
• -m checked against registered markers under strict_markers (#2781): it only applies when strict_markers is on, and it isn't on in this repo. The hook doesn't pass -m either.
• Better assertion diffs (a legend for Full diff: in #14743, dict.items()/keys() diffs in #12860, lazily built large diffs in #14523): these are automatic and only change how failures are displayed.
• --no-summary no longer suppresses plugin summaries (#14724): not relevant, because the hook doesn't use --no-summary.

Security

• No GHSA or CVE exists for pytest at either version. OSV returns no entries for 9.1.1 or 9.2.0, and the repository advisories list is empty.
• Hardening in 9.2.0: Cache.get/set/mkdir now refuse keys that resolve outside the cache directory (#14884). It only affects test-time tooling and doesn't change how anything in this repo behaves.

Key Fixes

• Fixed a 9.1 regression with rootdir conftest.py visibility (#14683): this only matters when you collect from outside the rootdir. The hook runs cd renovate-eval && pytest tests/, so this repo was not affected.
• MonkeyPatch undo-entry fixes (#10644, #14909): the suite calls monkeypatch.setattr 207 times, mostly on modules such as renovate_eval.subprocess and inventory_module. All 504 tests still pass on 9.2.0.
• pluggy>=1.6 is now required (#9236): the lock already pins pluggy 1.7.0, so this is satisfied.

Newer Versions

As of 2026-11-02, 9.2.0 is the latest pytest release (releases). There's no newer release that fixes anything. Several 9.2.0 regressions are open upstream, and none applies to this repo:

• #15287 and #15286 (monkeypatch.setattr undo on a MagicMock child or on __annotations__): the suite's setattr targets are modules and functions, not mock children or __annotations__, and the full suite passes.
• #15281 (high memory use at collection with unittest.mock.call plus a raised recursion limit): the tests don't import call or call setrecursionlimit.
• #15295 (cache_dir containing ..): cache_dir isn't configured.
• #15290 (verbosity_* numeric strings), #15303 (xdist loadgroup), #15284 (JAX approx), and #15280 (pytest-asyncio): this repo doesn't use any of these options, plugins, or libraries.

Hazards & Risks

None of the 9.2.0 breaking changes or deprecations affect this repo:

• indirect, ids, and scope on parametrize are now keyword-only (#8593): an AST scan found no parametrize call with more than 2 positional arguments. ids= is always passed by keyword (tests/test_auditor.py:168, :291).
• -c now rejects paths that are missing or unsupported (#14716): the hook doesn't pass -c.
• Plugin import failures now produce exit codes 3 or 4 (#993): there's no pytest_plugins, -p, or PYTEST_PLUGINS. The only plugin is pytest-cov, and it loaded fine.
• Deprecations (yield_fixture in #14755, higher-scoped instance-method fixtures in #14774, non-string values for string ini options in #14808, CallSpec2 in #14742, and bytes passed to write_line in #7323): none are used. testpaths is a list-typed option. Running with -W default produced no warnings.
• Test order may change for higher-scoped parametrize (#8914): the suite has no fixtures with scope above function level.

Sources

• pytest 9.2.0 release notes
• pytest releases list
• pytest security advisories
• OSV PyPI pytest
• Lint CI run on PR head (renovate-eval pytest hook Passed)
• pytest issue #15287 (monkeypatch MagicMock regression)
• pytest issue #15281 (mock.call memory regression)

---

🟢 Verdict: Safe

This is a test-only minor bump of pytest. None of its breaking changes, deprecations, or open 9.2.0 regressions touch this repo's suite. All 504 tests pass on 9.2.0 locally and in the PR's lint CI, with coverage at 96%.