deps: bump the dev-tooling group with 5 updates

[dependabot]

Updates the requirements on pytest, pytest-cov, pytest-xdist, ruff and mkdocs-material to permit the latest version.
Updates pytest to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

• #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
• #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
• #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
• #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

Commits

• cf470ec Prepare release version 9.1.1
• e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
• 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
• 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
• b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
• 9a567e0 [automated] Update plugin list (#14617) (#14618)
• ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
• 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
• 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
• 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
• Additional commits viewable in compare view

Updates pytest-cov to 7.1.0

Changelog

Sourced from pytest-cov's changelog.

7.1.0 (2026-03-21)

• Fixed total coverage computation to always be consistent, regardless of reporting settings. Previously some reports could produce different total counts, and consequently can make --cov-fail-under behave different depending on reporting options. See [#641](https://github.com/pytest-dev/pytest-cov/issues/641) <https://github.com/pytest-dev/pytest-cov/issues/641>_.

• Improve handling of ResourceWarning from sqlite3.

  The plugin adds warning filter for sqlite3 ResourceWarning unclosed database (since 6.2.0). It checks if there is already existing plugin for this message by comparing filter regular expression. When filter is specified on command line the message is escaped and does not match an expected message. A check for an escaped regular expression is added to handle this case.

  With this fix one can suppress ResourceWarning from sqlite3 from command line::

  pytest -W "ignore:unclosed database in <sqlite3.Connection object at:ResourceWarning" ...

• Various improvements to documentation. Contributed by Art Pelling in [#718](https://github.com/pytest-dev/pytest-cov/issues/718) <https://github.com/pytest-dev/pytest-cov/pull/718>_ and "vivodi" in [#738](https://github.com/pytest-dev/pytest-cov/issues/738) <https://github.com/pytest-dev/pytest-cov/pull/738>. Also closed [#736](https://github.com/pytest-dev/pytest-cov/issues/736) <https://github.com/pytest-dev/pytest-cov/issues/736>.

• Fixed some assertions in tests. Contributed by in Markéta Machová in [#722](https://github.com/pytest-dev/pytest-cov/issues/722) <https://github.com/pytest-dev/pytest-cov/pull/722>_.

• Removed unnecessary coverage configuration copying (meant as a backup because reporting commands had configuration side-effects before coverage 5.0).

7.0.0 (2025-09-09)

• Dropped support for subprocesses measurement.

  It was a feature added long time ago when coverage lacked a nice way to measure subprocesses created in tests. It relied on a .pth file, there was no way to opt-out and it created bad interations with coverage's new patch system <https://coverage.readthedocs.io/en/latest/config.html#run-patch>_ added in 7.10 <https://coverage.readthedocs.io/en/7.10.6/changes.html#version-7-10-0-2025-07-24>_.

  To migrate to this release you might need to enable the suprocess patch, example for .coveragerc:

  .. code-block:: ini

  [run] patch = subprocess

  This release also requires at least coverage 7.10.6.

• Switched packaging to have metadata completely in pyproject.toml and use hatchling <https://pypi.org/project/hatchling/>_ for building. Contributed by Ofek Lev in [#551](https://github.com/pytest-dev/pytest-cov/issues/551) <https://github.com/pytest-dev/pytest-cov/pull/551>_ with some extras in [#716](https://github.com/pytest-dev/pytest-cov/issues/716) <https://github.com/pytest-dev/pytest-cov/pull/716>_.

• Removed some not really necessary testing deps like six.

... (truncated)

Commits

• 66c8a52 Bump version: 7.0.0 → 7.1.0
• f707662 Make the examples use pypy 3.11.
• 6049a78 Make context test use the old ctracer (seems the new sysmon tracer behaves di...
• 8ebf20b Update changelog.
• 861d30e Remove the backup context manager - shouldn't be needed since coverage 5.0, ...
• fd4c956 Pass the precision on the nulled total (seems that there's some caching goion...
• 78c9c4e Only run the 3.9 on older deps.
• 4849a92 Punctuation.
• 197c35e Update changelog and hopefully I don't forget to publish release again :))
• 14dc1c9 Update examples to use 3.11 and make the adhoc layout example look a bit more...
• Additional commits viewable in compare view

Updates pytest-xdist to 3.8.0

Changelog

Sourced from pytest-xdist's changelog.

pytest-xdist 3.8.0 (2025-06-30)

Features

• [#1083](https://github.com/pytest-dev/pytest-xdist/issues/1083) <https://github.com/pytest-dev/pytest-xdist/issues/1083>_: Add --no-loadscope-reorder and --loadscope-reorder option to control whether to automatically reorder tests in loadscope for tests where relative ordering matters. This only applies when using loadscope.

  For example, [test_file_1, test_file_2, ..., test_file_n] are given as input test files, if --no-loadscope-reorder is used, for either worker, the test_file_a will be executed before test_file_b only if a < b.

  The default behavior is to reorder the tests to maximize the number of tests that can be executed in parallel.

pytest-xdist 3.7.0 (2025-05-26)

Features

• [#1142](https://github.com/pytest-dev/pytest-xdist/issues/1142) <https://github.com/pytest-dev/pytest-xdist/issues/1142>_: Added support for Python 3.13.

• [#1144](https://github.com/pytest-dev/pytest-xdist/issues/1144) <https://github.com/pytest-dev/pytest-xdist/issues/1144>_: The internal steal command is now atomic - it unschedules either all requested tests or none.

  This is a prerequisite for group/scope support in the worksteal scheduler, so test groups won't be broken up incorrectly.

• [#1170](https://github.com/pytest-dev/pytest-xdist/issues/1170) <https://github.com/pytest-dev/pytest-xdist/issues/1170>_: Add the --px arg to create proxy gateways.

  Proxy gateways are passed to additional gateways using the via keyword. They can serve as a way to run multiple workers on remote machines.

• [#1200](https://github.com/pytest-dev/pytest-xdist/issues/1200) <https://github.com/pytest-dev/pytest-xdist/issues/1200>_: Now multiple xdist_group markers are considered when assigning tests to groups (order does not matter).

  Previously, only the last marker would assign a test to a group, but now if a test has multiple xdist_group marks applied (for example via parametrization or via fixtures), they are merged to make a new group.

Removals

• [#1162](https://github.com/pytest-dev/pytest-xdist/issues/1162) <https://github.com/pytest-dev/pytest-xdist/issues/1162>_: Dropped support for EOL Python 3.8.

Trivial Changes

• [#1092](https://github.com/pytest-dev/pytest-xdist/issues/1092) <https://github.com/pytest-dev/pytest-xdist/issues/1092>_: Update an error message to better indicate where users should go for more information.

• [#1190](https://github.com/pytest-dev/pytest-xdist/issues/1190) <https://github.com/pytest-dev/pytest-xdist/issues/1190>_: Switched to using a SPDX license identifier introduced in PEP 639.

pytest-xdist 3.6.1 (2024-04-28)

... (truncated)

Commits

• 1e3e4dc Release 3.8.0
• 600aad5 Ensure all xdist group names are strings (#1216)
• 9d7ba5b Add --no-loadscope-reorder and --loadscope-reorder options (#1217)
• 532f07f Merge pull request #1210 from pytest-dev/pre-commit-ci-update-config
• 0883ad0 Fix Path usage in test_rsync_roots_no_roots
• 58a51bc [pre-commit.ci] pre-commit autoupdate
• 59a2ad0 Merge pull request #1220 from pytest-dev/dependabot/github_actions/github-act...
• d42b9c7 build(deps): bump hynek/build-and-inspect-python-package
• ebfcb99 Merge pull request #1206 from pytest-dev/release-3.7.0
• 23b7fd6 [pre-commit.ci] pre-commit autoupdate (#1207)
• Additional commits viewable in compare view

Updates ruff to 0.16.4

Release notes

Sourced from ruff's releases.

0.16.4

Release Notes

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

• [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
• [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
• [syntax-errors] Detect duplicate keyword arguments (#17804)
• [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

• Offer display-only fixes and mark safe fixes preferred (#27807)
• Support pull diagnostics for notebook cells (#27779)

Documentation

• Add default indicator to rules table (#27724)
• Fix broken link to Python docs (#27757)

Other changes

• Fix s390x stacker assembly in release builds (#27776)
• Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
• Reduce configuration deserialization code size (#27924)
• Check packed AST index bounds (#27849)

Contributors

• @​AbhinavMir
• @​eduardorittner
• @​royb3
• @​MichaReiser
• @​carljm
• @​rosstitmarsh
• @​ntBre

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.4

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

• [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
• [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
• [syntax-errors] Detect duplicate keyword arguments (#17804)
• [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

• Offer display-only fixes and mark safe fixes preferred (#27807)
• Support pull diagnostics for notebook cells (#27779)

Documentation

• Add default indicator to rules table (#27724)
• Fix broken link to Python docs (#27757)

Other changes

• Fix s390x stacker assembly in release builds (#27776)
• Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
• Reduce configuration deserialization code size (#27924)
• Check packed AST index bounds (#27849)

Contributors

• @​AbhinavMir
• @​eduardorittner
• @​royb3
• @​MichaReiser
• @​carljm
• @​rosstitmarsh
• @​ntBre
• @​zaniebot

... (truncated)

Commits

• 11c76bf Bump 0.16.4 (#27937)
• d53c8c5 Isolate playground builds from deployment credentials (#27839)
• cab001e Disable uv preview for releases and pre-commit hooks (#27939)
• f8d575f [ty] Clarify writing guidance for human readers (#27912)
• ca45fae Set --preview and --default-index for the uv-lock hook (#27935)
• 4827bf7 Export UV_DEFAULT_INDEX in release.sh (#27934)
• d1087a4 [ty] Handle assignment expressions in string annotations (#27921)
• 680cce4 [ty] Optimize inherited recursive protocol comparisons (#27922)
• 974d3cb Upgrade ecosystem-analyzer and mypy_primer to the latest upstream pins (#27932)
• b169b40 Install cargo tools locked (#27929)
• Additional commits viewable in compare view

Updates mkdocs-material to 9.7.7

Release notes

Sourced from mkdocs-material's releases.

mkdocs-material-9.7.7

[!WARNING]

Material for MkDocs is approaching end of life

Material for MkDocs is scheduled to reach end of life on November 5, 2026. Until then, maintenance is limited to critical bug fixes and security updates. After this date, the project will remain available on PyPI and GitHub, but no further maintenance is planned except in exceptional circumstances.

For users looking for a long-term, actively developed successor, we're building Zensical – a next-generation static site generator designed for technical documentation. If you're planning a new documentation project or evaluating your long-term options, we invite you to take a look.

Organizations requiring support beyond this date are welcome to get in touch to discuss available options.

Read the full announcement on our blog

Changes

• Fixed a DOM-based XSS vulnerability in search suggestions

Thanks to @​p- for responsibly reporting this issue.

Changelog

Sourced from mkdocs-material's changelog.

mkdocs-material-9.7.7 (2026-07-17)

• Fixed DOM-based XSS vulnerability in search suggestions

mkdocs-material-9.7.6 (2026-03-19)

• Automatically disable MkDocs 2.0 warning for forks of MkDocs

mkdocs-material-9.7.5 (2026-03-10)

• Limited version range of mkdocs to <2
• Updated MkDocs 2.0 incompatibility warning (clarify relation with MkDocs)

mkdocs-material-9.7.4 (2026-03-03)

• Hardened social cards plugin by switching to sandboxed environment
• Updated MkDocs 2.0 incompatibility warning

mkdocs-material-9.7.3 (2026-02-24)

• Fixed #8567: Print MkDocs 2.0 incompatibility warning to stderr

mkdocs-material-9.7.2 (2026-02-18)

• Opened up version ranges of optional dependencies for forward-compatibility
• Added warning to 'mkdocs build' about impending MkDocs 2.0 incompatibility

mkdocs-material-9.7.1 (2025-12-18)

• Updated requests to 2.30+ to mitigate CVE in urllib
• Fixed privacy plugin not picking up protocol-relative URLs
• Fixed #8542: false positives and negatives captured in privacy plugin

mkdocs-material-9.7.0 (2025-11-11)

⚠️ Material for MkDocs is now in maintenance mode

This is the last release of Material for MkDocs that will receive new features. Going forward, the Material for MkDocs team focuses on Zensical, a next-gen static site generator built from first principles. We will provide critical bug fixes and security updates for Material for MkDocs for 12 months at least.

Read the full announcement on our blog: https://squidfunk.github.io/mkdocs-material/blog/2025/11/05/zensical/

This release includes all features that were previously exclusive to the Insiders edition. These features are now freely available to everyone.

Note on deprecated plugins: The projects and typeset plugins are included in this release, but must be considered deprecated. Both plugins proved

... (truncated)

Commits

• b3e6dd8 Prepare 9.7.7 release
• 52fb6be Merge commit from fork
• 901e633 Added SECURITY.md with EOL notice
• 5b36f2a Bump js-yaml from 4.1.1 to 4.2.0 (#8598)
• 2d11e7b Bump form-data from 3.0.4 to 3.0.5 (#8597)
• ae05a53 Bump esbuild from 0.27.2 to 0.28.1 (#8596)
• 434af93 Bump shell-quote from 1.7.3 to 1.8.4 (#8593)
• 4447cda Documentation (#8590)
• 8f8d551 Updated copyright year (#8588)
• 08d8514 Bump fast-uri from 3.0.3 to 3.1.2 (#8587)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[DenisDrobyshev]

Closing for the same reason as #17, with a different package.

lint + fast tests (py3.9)  ->  fail, 44s

pytest 9.1.1 requires Python ≥3.10. The 3.9 leg fails at install before a test runs, while 3.10 through 3.13 pass.

The rest of the group is fine — ruff 0.16.4 still supports 3.7, pytest-cov 7.1.0 supports 3.9 — so this is one package holding up four harmless bumps.

That is now twice in one day: mypy in #17, pytest here. The underlying question is not which package to ignore next, and I have opened #30 for it rather than continuing to close these one at a time.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml