pypa/pipenv v2026.10.5 on GitHub

🤖 AI-Generated Changelog

Fixed --trusted-host arguments being flagged as secrets in CodeQL security scanning
Fixed package name parsing in pipenv update to correctly handle requirement specifiers as arguments
Fixed requirements command to emit --trusted-host for sources with verify_ssl = false
Fixed requirements command to correctly join os_markers and markers with and
Fixed requirements command to preserve markers for git/VCS entries
Fixed uninstall command to exit with a non-zero code when pip uninstall fails
Fixed uninstall command to report why it exits 1 when no virtualenv exists
Fixed pylock group name normalization and added rejection of category name collisions
Fixed pylock to preserve all categories when reading from pylock.toml
Fixed pylock to keep custom dependency groups in develop and requires-python as python_version
Fixed pylock to classify packages correctly based on whether they install for default groups
Fixed docs search by replacing stale Algolia search with Sphinx search
Fixed integration tests to fail fast when a different pipenv version would be tested than the checked-out one

Refactored --trusted-host logic to be shared between requirements and install, preserving environment-variable-defined hosts
Raised dependency security version floors and extended Python version support to 3.11–3.15
Dropped Python 3.10 support and addressed related code quality findings

Raised minimum versions of dependencies to address known security vulnerabilities