🤖 AI-Generated Changelog

Fixed

• Exit with a non-zero status code when safety cannot be installed or run during check/scan, ensuring failures are properly signaled to calling processes
• Read Pipfile as UTF-8 in check, scan, and --support commands, preventing errors with non-ASCII characters in Pipfile content
• Render dependency graph using only characters supported by the terminal's stdout encoding, avoiding display errors in non-UTF-8 environments

Removed

• Cleaned up unused internal code with no user-facing impact

🔗 Full Changelog: v2026.10.5...v2026.10.6

🤖 AI-Generated Changelog

Fixed

• Fixed --trusted-host arguments being flagged as secrets in CodeQL security scanning
• Fixed package name parsing in pipenv update to correctly handle requirement specifiers as arguments
• Fixed requirements command to emit --trusted-host for sources with verify_ssl = false
• Fixed requirements command to correctly join os_markers and markers with and
• Fixed requirements command to preserve markers for git/VCS entries
• Fixed uninstall command to exit with a non-zero code when pip uninstall fails
• Fixed uninstall command to report why it exits 1 when no virtualenv exists
• Fixed pylock group name normalization and added rejection of category name collisions
• Fixed pylock to preserve all categories when reading from pylock.toml
• Fixed pylock to keep custom dependency groups in develop and requires-python as python_version
• Fixed pylock to classify packages correctly based on whether they install for default groups
• Fixed docs search by replacing stale Algolia search with Sphinx search
• Fixed integration tests to fail fast when a different pipenv version would be tested than the checked-out one

Changed

• Refactored --trusted-host logic to be shared between requirements and install, preserving environment-variable-defined hosts
• Raised dependency security version floors and extended Python version support to 3.11–3.15
• Dropped Python 3.10 support and addressed related code quality findings

Security

• Raised minimum versions of dependencies to address known security vulnerabilities

🔗 Full Changelog: v2026.10.4...v2026.10.5

🤖 AI-Generated Changelog

Added

• Added interactive pipenv init command for creating a Pipfile with guided prompts

Fixed

• Fixed pipenv install -r to decode requirements files using the same encoding detection as pip
• Fixed pipenv audit to exit with a non-zero status code when pip-audit cannot be run
• Fixed pipenv graph to print the missing virtualenv warning to stderr instead of stdout
• Fixed pipenv outdated to correctly interpolate the required version in skipped-update messages
• Fixed lockfile replacement to be atomic, preventing corruption on interrupted writes
• Fixed pipenv install to restore the Pipfile byte-for-byte when installation fails, including rolling back changes made by pipenv init
• Fixed Pipfile to be read and written as UTF-8 consistently across all operations

🔗 Full Changelog: v2026.10.3...v2026.10.4

🤖 AI-Generated Changelog

Fixed

• Forward extra keyword arguments in the Windows rmtree test shim to ensure compatibility with Python 3.14.9

Security

• Bump pip dependency to latest version (includes 3 updates)
• Bump certifi in the /examples directory to address potential security vulnerabilities

🔗 Full Changelog: v2026.10.2...v2026.10.3

🤖 AI-Generated Changelog

Fixed

• Read Pipfile, Pipfile.lock, pylock.toml, and pyproject.toml as UTF-8 with BOM support (utf-8-sig) to handle files with byte order marks
• Include the tasks package in the sdist distribution
• Resolve security quality alerts in pipenv's non-vendored code

Changed

• Vendor pip 26.2.2
• Update certifi to 2026.10.19
• Enable mypy type checking for pipenv's own code
• Record runner hardware in benchmark results

🔗 Full Changelog: v2026.10.1...v2026.10.2

🤖 AI-Generated Changelog

Fixed

• Skip * (wildcard) versions when pinning resolved default dependencies as constraints, preventing invalid constraint generation
• Write a single pylock.toml entry for packages that are locked in both default and develop groups, avoiding duplicate entries
• Brace bare $VAR references in source URLs when generating requirements with --no-lock, ensuring proper shell variable expansion
• Preserve non-group conditions in pylock.toml markers for dependencies that reference a dependency group
• Correct artifact metadata (hashes) in pylock.toml output from locked package data

Changed

• Prefetch pure-Python index manifests in parallel to speed up cold resolver performance
• Reuse resolver manifests when prefetching installable wheels, reducing redundant network requests
• Avoid redundant cold index refetches during wheel prefetch operations

🔗 Full Changelog: v2026.10.0...v2026.10.1

🤖 AI-Generated Changelog

Added

• Support file:// URLs as package index and mirror sources
• Support non-Git local VCS schemes in URL unpacking
• Accept newer minor pylock.toml lock versions with a warning instead of failing

Fixed

• Correctly check pylock.toml requires-python and environments fields before installing
• Pick the correct matching entry for packages listed more than once in pylock.toml
• Preserve local, VCS, and file sources when generating pylock.toml
• Convert file:// requirements.txt URLs to paths before resolving
• Fix malformed pip line for file URL extras on --skip-lock path
• Fix file:// Pipfile entries being mis-handled as filesystem paths on Windows
• Fix VCS Pipfile entries collapsing when the name also resolves via the index
• Fix broken pip line when building file=...+extras=[...] dependencies
• Preserve existing Pipfile sources during requirements import
• Preserve requirements-file source order during deduplication
• Make requirements.txt -i <url> replace the default index rather than add to it
• Skip --trusted-host for hostless source URLs regardless of verify_ssl
• Fix insecure verify_ssl=false handling on hardcoded file:// source blocks
• Recalculate lock hash after writing temporary Pipfile source

Changed

• Vendor bumps: packaging to 26.3, plette to 2.4.0, build to 1.6.1, pyproject_hooks to 1.3.3, dotenv to 1.2.4
• Vendor tomli for hatchling's build isolation on Python < 3.11
• Consolidate VCS_SCHEMES into pipenv.utils.constants
• Migrate integration tests off real network dependencies to offline file://-based fixtures

🔗 Full Changelog: v2026.9.1...v2026.10.0

🤖 AI-Generated Changelog

Fixed

• Fixed a crash in the pure-Python resolver backend when checking hashes for sdist packages
• Resolved incorrect resolver backend precedence when resolver_backend is set in [pipenv] configuration outside of a lock operation

Changed

• The resolver_backend setting in [pipenv] is now honored consistently outside of lock operations
• Improved resolver performance by memoizing pure-Python find_matches results during backtracking and caching parsed package manifests
• Both resolver backends are now benchmarked for better performance comparison and selection

🔗 Full Changelog: v2026.9.0...v2026.9.1

🤖 AI-Generated Changelog

Added

• pipenv sync --clean: New flag to automatically uninstall packages that are present in the environment but missing from the lockfile, keeping environments in sync with declared dependencies
• Pure-Python resolver backend: New experimental --backend CLI flag and [pipenv] resolver_backend Pipfile setting to opt into an alternative pure-Python dependency resolver (Initiative G), featuring:
  • PEP 517 isolated environment builds for sdist metadata extraction
  • PEP 658 metadata fetching with wheel-head fallback
  • Parallel wheel pre-fetch before installation (~30% cold-install speedup)
  • Transitive marker propagation via Requirement.introducing_marker
  • Hash collection from all distfile siblings
  • Yanked release support per PEP 592
• Per-package config settings: pipenv install now persists configuration settings on a per-package basis, isolating options between packages

Changed

• Pipfile package name recasing is now opt-in via [pipenv] package_name_case Pipfile setting (previously controlled by PIPENV_RECASE_PIPFILE env var); recasing is disabled by default for performance
• virtualenv minimum version raised to >=21.14.6
• Resolver round cap raised to pip's 200_000 to handle complex dependency graphs

Fixed

• Requirements export: PyPI mirror selection is now honored when exporting requirements, fixing cases where the configured mirror was ignored
• Dependency markers: not in exclusions for python_version are no longer incorrectly collapsed; legacy not in exclusions are preserved exactly, and == version groups are version-sorted
• pipenv sync --dry-run: No longer uninstalls packages; all lockfile sections are preserved during dry runs
• pipenv --envs: Fixed broken documentation URL to point to a valid page
• Redundant --upgrade flag dropped from pip install calls during sync
• sdist archive names are now sanitized and urllib3 timeouts are applied correctly
• Effective resolver backend is now included in the resolution cache key, preventing stale cache hits across backend switches
• Pure-Python resolver now correctly threads extras through find_matches/get_dependencies and applies pip's narrow requirement selection

Documentation

• Added note that pipenv sync does not remove packages missing from the lockfile (addressed by new --clean flag)

🔗 Full Changelog: v2026.8.0...v2026.9.0

🤖 AI-Generated Changelog

Added

• Parallel index manifest prefetching (PIPENV_PREFETCH_INDEX_MANIFESTS): New experimental feature that fetches package index manifests concurrently during lock operations, significantly reducing resolution time for large dependency sets
• PEP 691 JSON Simple API support: Native parsing of PEP 691 JSON responses from package indexes alongside existing PEP 503 HTML parsing
• Disk-based manifest cache (ParsedManifestCache): JSON-on-disk cache with TTL and atomic writes to avoid redundant index fetches across lock operations
• Pluggable resolver backend scaffolding: Foundation for swappable resolver backends, enabling future customization of dependency resolution strategies
• Per-source verify_ssl fan-out for prefetcher: Each index source now independently respects its SSL verification and certificate settings during parallel prefetch
• peek_etag stale-cache short-circuit: Resolver can now skip full manifest fetches when ETags indicate cached data is still fresh
• prefetch_index_manifests setting: New boolean configuration option to enable/disable the parallel prefetch feature
• Reject Pipfile entries with unrecognized keys, providing clearer errors on misconfiguration

Changed

• Pipfile subsystem extracted from Project: Internal refactor completing Initiative D; project.build_script and related attributes now live on project.pipfile
• Lockfile subsystem extracted from Project: Lockfile state management is now a dedicated subsystem
• unpack_url / get_http_url moved to pipenv/utils/unpack.py; legacy requirementslib.py removed
• Resolver backend selection is now stamped onto resolver requests for improved traceability
• Prior Pipfile.lock pins are fed as pip constraints on warm relock to speed up re-locking (reverted and re-landed with fixes)
• Resolver subprocess skipped entirely for empty Pipfile categories, reducing unnecessary process overhead
• Vendor pip updated to 26.2.1

Fixed

• Corrupt lockfile recovery: Fixed return path when recovering from a corrupt lockfile
• Editable VCS extras now resolve correctly with pip 26.2
• netrc login handling: Quote-only netrc credentials are now treated as empty on Python 3.10+, preventing auth failures
• Manifest cache retry on Windows: os.replace is retried on ERROR_ACCESS_DENIED with a wall-clock budget, fixing cache write failures on Windows
• Missing Pipfile hashes are now handled gracefully instead of raising an error
• Plette Pipfile attribute delegation fixed after subsystem refactor
• resolver_backend is now correctly plumbed through the venv_resolve_deps call chain
• Prerelease versions are now allowed as a fallback at final lower bounds
• Stale project.build_script call sites migrated to project.pipfile.build_script
• Test for Pipfile version warning updated after subsystem extraction
• test_lockfile_location_is_pipfile_plus_lock made OS-portable
• Fixed latest hash and virtualenv guidance in documentation/output
• Fixed first-party CodeQL reliability errors
• Deferred pip-internal imports (InstallCommand, unpack, Downloader, network imports) to improve startup performance

Security

• CodeQL reliability improvements to reduce false negatives in static analysis

🔗 Full Changelog: v2026.7.1...v2026.8.0