[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-python	action	minor	v7.0.0 → v7.1.0
prefix-dev/pixi	uses-with	minor	v0.82.0 → v0.83.0
pypa/gh-action-pypi-publish	action	patch	v1.14.2 → v1.14.3

---

Release Notes

actions/setup-python

v7.1.0

Compare Source

What's Changed

Enhancements

• Add mirror and mirror-token inputs for custom Python distribution sources by @​luhenry in #​1302
• Improve error message clarity by @​v-lmvysakh in #​1351

Dependency Upgrade

• Upgrade browserslist from 4.28.2 to 4.28.9 by @​dependabot in #​1353
• Upgrade @​typescript-eslint/parser from 8.62.0 to 8.70.0 by @​dependabot in #​1343
• Upgrade eslint-plugin-jest from 29.15.2 to 29.16.6 by @​dependabot in #​1342
• Upgrade @​vercel/ncc from 0.44.0 to 0.45.0 by @​dependabot in #​1357
• Upgrade @​types/semver from 7.7.1 to 7.8.0 by @​dependabot in #​1359
• Upgrade undici from 6.28.0 to 6.29.0 by @​dependabot in #​1364
• Upgrade ts-jest from 29.4.11 to 29.4.14 by @​dependabot in #​1361
• Upgrade brace-expansion from 5.0.9 to 5.0.12 by @​dependabot in #​1365
• Upgrade prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 by @​dependabot in #​1363
• Upgrade @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 by @​dependabot in #​1369
• Upgrade actions/checkout from 7.0.0 to 7.0.1 by @​dependabot in #​1345
• Upgrade cache to 6.3.0 by @​v-HarithaVattikuti in #​1370
• Resolve Basic Validation audit failures by @​v-HarithaVattikuti in #​1347
• Resolve npm audit failures by @​v-HarithaVattikuti in #​1350

New Contributors

• @​luhenry made their first contribution in #​1302

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

prefix-dev/pixi

v0.83.0

Compare Source

[0.83.0] - 2026-10-22

✨ Highlights

Soon channels will be able to register virtual package detectors.
These detectors allow to introduce virtual packages that Pixi doesn't know about.
This Pixi release introduces support for virtual package detectors.

It also fixes an increase in memory usage that 0.82.1 introduced.

Features

• Ask before running detectors and show them in pixi info by @​Hofer-Julian in #​7129

Fixes

• run: Only detect the target environment's host up front by @​Hofer-Julian in #​7339

Documentation

• Add tombi integration page by @​pavelzw in #​7338

v0.82.1

Compare Source

[0.82.1] - 2026-10-20

🔒 Security 🔒

This patch release contains security fixes for the incident
described at https://emudhra.we-have-a-problem.com/.
All users are encouraged to upgrade to this version immediately.

The affected webpki-root-certs and rustls-webpki dependencies
have been bumped to patched releases 1.0.10 and 0.103.16 respectively.

Features

• pixi-build-r: Add CMake and pkg-config when SystemRequirements asks for them by @​roaldarbol in #​7256
• spec: Support exemptions in the resolved exclude-newer config by @​pavelzw in #​7250
• manifest: Read exemptions from exclude-newer in [workspace] by @​pavelzw in #​7246
• Pass arbitrary virtual packages to the solver by @​Hofer-Julian in #​7125
• Configure virtual package detectors and write shared config by @​Hofer-Julian in #​7127
• Run channel-registered detectors during host detection by @​Hofer-Julian in #​7128

Fixes

• config: Reject relative detached-environments paths by @​lucascolley in #​7221
• cli: Render colours in log messages instead of escape codes by @​lucascolley in #​7295
• core: Correct muddled post-link / pre-unlink script check by @​lucascolley in #​7296
• workspace: Error when removing a feature that does not exist by @​lucascolley in #​7205
• environment: Detect relocated environments again by @​lucascolley in #​7306
• tasks: Error on undefined environments in task definitions by @​lucascolley in #​7284
• core: Stop printing a panic message for build dispatch errors by @​lucascolley in #​7309
• Bump webpki-root-certs and rustls-webpki for eMudhra intermediate compromise by @​wolfv in #​7326

Documentation

• Artifactory oidc login through pixi by @​pavelzw in #​7168
• Document auth-workload-identity inputs of setup-pixi v0.11.1 by @​pavelzw in #​7264
• [project] is the deprecated alias for [workspace], not the reverse by @​ZainnQureshii in #​7086
• Update setup-pixi docs by @​pavelzw in #​7277
• Note that conda-forge is the only default channel for pixi global by @​alisterburt in #​7285
• cli: Improve descriptions by @​timhoffm in #​7288
• Fix admonition rendering by @​lucascolley in #​7310

Maintenance

• release: Add rust to backends-release env by @​lucascolley in #​7269
• release: Make cargo available in backends-release by @​lucascolley in #​7270
• release: Bump pixi-build-r to 0.2.0 by @​lucascolley in #​7271
• deps: Bump rustls and aws-smithy-json by @​wolfv in #​7274
• release: Add release scope to automated commit messages by @​lucascolley in #​7273
• init: Show source context for pyproject.toml read errors by @​lucascolley in #​7202
• workspace: Detect host capabilities during construction by @​Hofer-Julian in #​7124
• core: Type the activation errors by @​lucascolley in #​7280
• task: Type the task environment errors by @​lucascolley in #​7289
• core: Type the workspace accessor errors by @​lucascolley in #​7290
• core: Type the workspace registry errors by @​lucascolley in #​7292
• core: Type the environment helper errors by @​lucascolley in #​7303
• Network utilities available in rosdistro by @​Timple in #​7301
• core: Type the PyPI resolve errors by @​lucascolley in #​7308
• core: Type the lock-file load, write and prefix errors by @​lucascolley in #​7312

New Contributors

• @​alisterburt made their first contribution in #​7285
• @​ZainnQureshii made their first contribution in #​7086

pypa/gh-action-pypi-publish

v1.14.3

Compare Source

Keeping the community safe is a collaborative effort! 💛💙

[!important]
🚨 This release includes fixes for GHSA-5xjx-3w67-w9x9 patched up by @​sethmlarson💰 in #​427 and in other places across the ecosystem.

Additional ecosystem and related mitigations beyond you might want to watch out for:

• https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576
• https://emudhra.we-have-a-problem.com

🛠️ Security Tightening

@​webknjaz💰 made sure the dependency tree within the action runtime uses hash-checking from now on via #​420.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.2...v1.14.3

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.