build(deps-dev): bump pytest-xdist from 3.6.1 to 3.8.0

[dependabot]

Bumps pytest-xdist from 3.6.1 to 3.8.0.

Changelog

Sourced from pytest-xdist's changelog.

pytest-xdist 3.8.0 (2025-06-30)

Features

• [#1083](https://github.com/pytest-dev/pytest-xdist/issues/1083) <https://github.com/pytest-dev/pytest-xdist/issues/1083>_: Add --no-loadscope-reorder and --loadscope-reorder option to control whether to automatically reorder tests in loadscope for tests where relative ordering matters. This only applies when using loadscope.

  For example, [test_file_1, test_file_2, ..., test_file_n] are given as input test files, if --no-loadscope-reorder is used, for either worker, the test_file_a will be executed before test_file_b only if a < b.

  The default behavior is to reorder the tests to maximize the number of tests that can be executed in parallel.

pytest-xdist 3.7.0 (2025-05-26)

Features

• [#1142](https://github.com/pytest-dev/pytest-xdist/issues/1142) <https://github.com/pytest-dev/pytest-xdist/issues/1142>_: Added support for Python 3.13.

• [#1144](https://github.com/pytest-dev/pytest-xdist/issues/1144) <https://github.com/pytest-dev/pytest-xdist/issues/1144>_: The internal steal command is now atomic - it unschedules either all requested tests or none.

  This is a prerequisite for group/scope support in the worksteal scheduler, so test groups won't be broken up incorrectly.

• [#1170](https://github.com/pytest-dev/pytest-xdist/issues/1170) <https://github.com/pytest-dev/pytest-xdist/issues/1170>_: Add the --px arg to create proxy gateways.

  Proxy gateways are passed to additional gateways using the via keyword. They can serve as a way to run multiple workers on remote machines.

• [#1200](https://github.com/pytest-dev/pytest-xdist/issues/1200) <https://github.com/pytest-dev/pytest-xdist/issues/1200>_: Now multiple xdist_group markers are considered when assigning tests to groups (order does not matter).

  Previously, only the last marker would assign a test to a group, but now if a test has multiple xdist_group marks applied (for example via parametrization or via fixtures), they are merged to make a new group.

Removals

• [#1162](https://github.com/pytest-dev/pytest-xdist/issues/1162) <https://github.com/pytest-dev/pytest-xdist/issues/1162>_: Dropped support for EOL Python 3.8.

Trivial Changes

• [#1092](https://github.com/pytest-dev/pytest-xdist/issues/1092) <https://github.com/pytest-dev/pytest-xdist/issues/1092>_: Update an error message to better indicate where users should go for more information.

• [#1190](https://github.com/pytest-dev/pytest-xdist/issues/1190) <https://github.com/pytest-dev/pytest-xdist/issues/1190>_: Switched to using a SPDX license identifier introduced in PEP 639.

Commits

• 1e3e4dc Release 3.8.0
• 600aad5 Ensure all xdist group names are strings (#1216)
• 9d7ba5b Add --no-loadscope-reorder and --loadscope-reorder options (#1217)
• 532f07f Merge pull request #1210 from pytest-dev/pre-commit-ci-update-config
• 0883ad0 Fix Path usage in test_rsync_roots_no_roots
• 58a51bc [pre-commit.ci] pre-commit autoupdate
• 59a2ad0 Merge pull request #1220 from pytest-dev/dependabot/github_actions/github-act...
• d42b9c7 build(deps): bump hynek/build-and-inspect-python-package
• ebfcb99 Merge pull request #1206 from pytest-dev/release-3.7.0
• 23b7fd6 [pre-commit.ci] pre-commit autoupdate (#1207)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

✅ All necessary CHANGELOG.md files have been updated.

[github-actions]

✅ Conflict Markers Resolved

All conflict markers have been successfully resolved in this pull request.

[github-actions]

🔒 Container Security Scan

Image: prowler:316e558
Last scan: 2026-01-10 10:01:11 UTC

📊 Vulnerability Summary

Severity	Count
🔴 Critical	3
Total	3

3 package(s) affected

⚠️ Action Required

Critical severity vulnerabilities detected. These should be addressed before merging:

• Review the detailed scan results
• Update affected packages to patched versions
• Consider using a different base image if updates are unavailable

---

📋 Resources:

• Download full report (see artifacts)
• View in Security tab
• Scanned with Trivy