🤖 AI-Generated Changelog
Fixed
- Fixed
--trusted-hostarguments being flagged as secrets in CodeQL security scanning - Fixed package name parsing in
pipenv updateto correctly handle requirement specifiers as arguments - Fixed
requirementscommand to emit--trusted-hostfor sources withverify_ssl = false - Fixed
requirementscommand to correctly joinos_markersandmarkerswithand - Fixed
requirementscommand to preserve markers for git/VCS entries - Fixed
uninstallcommand to exit with a non-zero code when pip uninstall fails - Fixed
uninstallcommand to report why it exits 1 when no virtualenv exists - Fixed pylock group name normalization and added rejection of category name collisions
- Fixed pylock to preserve all categories when reading from
pylock.toml - Fixed pylock to keep custom dependency groups in
developandrequires-pythonaspython_version - Fixed pylock to classify packages correctly based on whether they install for default groups
- Fixed docs search by replacing stale Algolia search with Sphinx search
- Fixed integration tests to fail fast when a different
pipenvversion would be tested than the checked-out one
Changed
- Refactored
--trusted-hostlogic to be shared betweenrequirementsandinstall, preserving environment-variable-defined hosts - Raised dependency security version floors and extended Python version support to 3.11–3.15
- Dropped Python 3.10 support and addressed related code quality findings
Security
- Raised minimum versions of dependencies to address known security vulnerabilities
🔗 Full Changelog: v2026.10.4...v2026.10.5