pypa/pipenv v2026.8.0 on GitHub

🤖 AI-Generated Changelog

Parallel index manifest prefetching (PIPENV_PREFETCH_INDEX_MANIFESTS): New experimental feature that fetches package index manifests concurrently during lock operations, significantly reducing resolution time for large dependency sets
PEP 691 JSON Simple API support: Native parsing of PEP 691 JSON responses from package indexes alongside existing PEP 503 HTML parsing
Disk-based manifest cache (ParsedManifestCache): JSON-on-disk cache with TTL and atomic writes to avoid redundant index fetches across lock operations
Pluggable resolver backend scaffolding: Foundation for swappable resolver backends, enabling future customization of dependency resolution strategies
Per-source verify_ssl fan-out for prefetcher: Each index source now independently respects its SSL verification and certificate settings during parallel prefetch
peek_etag stale-cache short-circuit: Resolver can now skip full manifest fetches when ETags indicate cached data is still fresh
prefetch_index_manifests setting: New boolean configuration option to enable/disable the parallel prefetch feature
Reject Pipfile entries with unrecognized keys, providing clearer errors on misconfiguration

Pipfile subsystem extracted from Project: Internal refactor completing Initiative D; project.build_script and related attributes now live on project.pipfile
Lockfile subsystem extracted from Project: Lockfile state management is now a dedicated subsystem
unpack_url / get_http_url moved to pipenv/utils/unpack.py; legacy requirementslib.py removed
Resolver backend selection is now stamped onto resolver requests for improved traceability
Prior Pipfile.lock pins are fed as pip constraints on warm relock to speed up re-locking (reverted and re-landed with fixes)
Resolver subprocess skipped entirely for empty Pipfile categories, reducing unnecessary process overhead
Vendor pip updated to 26.2.1

Corrupt lockfile recovery: Fixed return path when recovering from a corrupt lockfile
Editable VCS extras now resolve correctly with pip 26.2
netrc login handling: Quote-only netrc credentials are now treated as empty on Python 3.10+, preventing auth failures
Manifest cache retry on Windows: os.replace is retried on ERROR_ACCESS_DENIED with a wall-clock budget, fixing cache write failures on Windows
Missing Pipfile hashes are now handled gracefully instead of raising an error
Plette Pipfile attribute delegation fixed after subsystem refactor
resolver_backend is now correctly plumbed through the venv_resolve_deps call chain
Prerelease versions are now allowed as a fallback at final lower bounds
Stale project.build_script call sites migrated to project.pipfile.build_script
Test for Pipfile version warning updated after subsystem extraction
test_lockfile_location_is_pipfile_plus_lock made OS-portable
Fixed latest hash and virtualenv guidance in documentation/output
Fixed first-party CodeQL reliability errors
Deferred pip-internal imports (InstallCommand, unpack, Downloader, network imports) to improve startup performance

🔗 Full Changelog: v2026.7.1...v2026.8.0