[serious-scaffold]

This PR contains the following updates:

Package	Change	Age	Confidence
pdm (changelog)	2.25.4 -> 2.29.5

---

Release Notes

pdm-project/pdm (pdm)

v2.29.5

Compare Source

Bug Fixes

• Preserve archive subdirectories when writing or exporting pylock.toml. (#​3964)
• Preserve extras and environment markers on local, URL, Git, and workspace file requirements when translating dependencies for uv. (#​3965)
• Preserve Git source subdirectories and encoded refs when generating, reusing, and reading uv lockfiles. (#​3966)
• Allow sorting installed packages by optional metadata such as homepage when some values are missing or unknown. (#​3967)
• Fill the Homepage in pdm show from the Homepage Project-URL, and stop pdm show failing on a Project-URL that contains a comma. (#​3968)
• Quote the activation script path that pdm venv activate prints for PowerShell, so Invoke-Expression (pdm venv activate) works when the path contains spaces or apostrophes. (#​3970)
• On Windows, quote the extra arguments of a shell script, and the {args} placeholder in it, for cmd.exe instead of with POSIX single quotes. (#​3971)
• Omit missing package versions when exporting to pylock.toml. (#​3972)
• Fill the Homepage in pdm list from the Homepage Project-URL when Home-page is missing or unknown. (#​3973)

v2.29.4

Compare Source

Features & Improvements

• Allow specifying lock.format in pyproject.toml via the [tool.pdm.lock] table. (#​3958)

Bug Fixes

• Import a requirements file that starts with a UTF-8 BOM, which failed with a RequirementError. (#​3937)
• Treat a Pipfile version without an operator, such as requests = "2.31.0", as an exact == pin when importing, like pipenv does, instead of failing with an invalid specifier error. (#​3939)
• Preserve Poetry include entries targeting both source and wheel distributions when importing a project. (#​3941)
• Preserve version and description when importing Flit projects with a src/ layout or an annotated __version__. (#​3942)
• Require certifi>=2026.10.19, which removes the emSign ECC Root CA - G3 root whose eMudhra intermediates had their private keys compromised. (#​3944)
• pdm outdated no longer lists a package whose installed version is newer than the latest one found on the index, such as an installed pre-release or local build. (#​3945)
• Fix pdm lock --check reporting an outdated lockfile when a group is declared in both [dependency-groups] and [tool.pdm.dev-dependencies]. (#​3947)
• Show the license from License-Expression (PEP 639) in pdm show and pdm list --fields licenses. (#​3948)
• Stop pdm lock from excluding packages from a lock target when another target shares its OS and architecture, e.g. manylinux and musllinux. (#​3950)
• Fix a crash when a python_version marker compares against a wildcard version such as python_version == "3.*". (#​3951)
• Send License-Expression and License-File with the upload in pdm publish, so PyPI shows the license of PEP 639 packages. (#​3952)
• Preserve the subdirectory fragment in source archive requirements when resolving dependencies and serializing requirement URLs. (#​3954)
• Preserve archive hashes when reading pylock.toml so they remain available for exports. (#​3956)
• Fix detection of responses served from the HTTP cache, so cached downloads and index pages are reported as cached again. (#​3961)

Dependencies

• Install the download dependencies of pbs-installer so Python installation works with its latest releases. (#​3959)
• Upgrade unearth to >=0.19 and migrate the HTTP client from httpx to httpx2. pdm.models.session.PDMPyPIClient and the transports in pdm.pytest are now built on httpx2, so plugins interacting with them should import httpx2 instead of httpx. (#​3962)

v2.29.3

Compare Source

Features & Improvements

• Add the --venv option to pdm outdated, like the other commands that read the installed packages. (#​3904)

Bug Fixes

• Fix isolated PEP 517 builds skipping packages that are only visible via the host venv's --system-site-packages. (#​3895)
• Fix pdm import of Poetry projects dropping optional dependencies whose extras entry is spelled differently, and importing optional dependencies with multiple constraints as required ones. (#​3899)
• Keep the plain requirement in pdm export when the same package is also locked with extras under a narrower marker, so it is no longer missing from requirements.txt on the other platforms. (#​3900)
• Fix python_version <= "X.Y" markers excluding the patch releases of X.Y, so pdm install skipped such dependencies. (#​3902)
• Fix environment variables set by one task of a composite script, via env or env_file, leaking into the tasks that run after it. (#​3903)
• Convert flit's comma-separated keywords and obsolete dev-requires into valid PEP 621 fields when importing a flit project. (#​3907)
• Import custom Pipfile package categories, such as [docs], as dependency groups instead of dropping them. (#​3909)
• Keep editable requirements in [tool.pdm.dev-dependencies] on pdm import, so the written [dependency-groups] table stays valid per PEP 735. (#​3910)
• Keep Poetry's develop = true as an editable requirement when importing dependency groups. (#​3913)
• Fix pdm import of the project's own Poetry pyproject.toml writing each dependency group to both [tool.pdm.dev-dependencies] and [dependency-groups]. (#​3915)
• Import Pipfile packages declared with a file URL, such as {file = "https://..."}, as URL requirements instead of dropping the URL. (#​3918)
• Preserve Poetry platform restrictions as environment markers when importing dependencies. (#​3920)
• Read an exclude-newer timestamp without a UTC offset as UTC, so pdm lock no longer fails with a TypeError comparing naive and aware datetimes. (#​3922)
• Do not write empty dependency groups, such as dev = [] from an empty [dev-packages] table, when importing from another format. (#​3925)
• Strip every leading and trailing ., _ and - when pdm init derives the project name from the directory, so a folder like __demo__ no longer produces the invalid name _demo_. (#​3927)
• pdm init now writes project.license as a license expression string instead of a {text = ...} table, and no longer rewrites an existing {file = ...} table or license expression into a value the build backend rejects. (#​3929)
• Read the inline metadata of a script that starts with a UTF-8 BOM, which pdm run ignored. (#​3931)
• Convert a space-separated Poetry version constraint such as >=1.0 <2.0 like the comma-separated form instead of aborting the import. (#​3934)
• Resolve relative path entries in a Pipfile against the directory of the Pipfile when importing, instead of the current working directory. (#​3935)

Documentation

• Document what to cache and which install command to use when running PDM on CI platforms other than GitHub Actions. (#​2472)

v2.29.2

Compare Source

Bug Fixes

• Fix writing lock files specified as bare relative filenames with pdm lock --lockfile. (#​3891)
• Preserve local paths containing spaces and their extras and environment markers when importing requirements files. (#​3894)

Documentation

• List the install-pdm.py options the script actually accepts. (#​3889)

v2.29.1

Compare Source

Features & Improvements

• Explain missing lockfile groups and provide group-selection recovery guidance when installing, syncing, or updating groups. (#​2682)
• Allow package-specific overrides for exclude-newer resolution limits. (#​3809)

Bug Fixes

• Keep the separating comma out of the operator and accept a v prefix when converting Poetry version constraints. (#​3860)
• Escape glob characters in the virtualenv lookup prefix, so a project whose directory name contains [ or ] can find its own virtualenv. (#​3869)
• Write pyproject.toml and lockfiles atomically to prevent interrupted writes from truncating them. (#​3870)
• Resolve the workspace root before making member paths relative, so a root given as a relative path or reached through a symlink no longer raises ValueError. (#​3874)
• Replace the destination of an atomic write instead of unlinking it first, so an interrupted write can no longer destroy pyproject.toml or the lockfile. (#​3878)
• Report the version part that could not be read, instead of blaming a postrelease for every parse failure. (#​3880)
• Keep quoted local paths that contain - when parsing requirements files. (#​3885)

Documentation

• Clarify dependency command effects on project declarations, lock metadata, and installed packages in the guide and CLI help. (#​2681)

v2.29.0

Compare Source

Features & Improvements

• Export editable local dependencies with relative paths in requirements files. (#​3294)
• Extend pdm run with --env, --env-file and --working-dir options to set or override the corresponding script options dynamically. (#​3829)

Bug Fixes

• Restrict a locked package to the platform it was resolved for when it doesn't belong to every lock target, so pdm lock --platform ... --append no longer adds entries that get installed on the other targets. (#​3261)
• Keep Poetry include entries restricted to the sdist format when importing, writing them to tool.pdm.build.source-includes instead of dropping them. (#​3854)
• Accept --no-verify-ssl on pdm publish, which was misspelled as --no-very-ssl. The old spelling keeps working as an alias. (#​3857)
• Convert Poetry tilde constraints with fewer than three components to the bounds Poetry means: ~1.2 becomes <1.3 rather than <2.0, and ~1 no longer produces an invalid ~=1 specifier that aborts the import. (#​3858)
• Keep the separating comma out of the operator and accept a v prefix when converting Poetry version constraints. (#​3860)
• Keep importing a Poetry project when an author or maintainer entry does not fit the Name <email> pattern. (#​3861)
• Skip requires-python when a Pipfile [requires] table has no python version, instead of writing >=None. (#​3862)
• Leave the version and description empty instead of aborting when a flit module cannot be parsed. (#​3864)
• Respect dependency group selection options when exporting to pylock.toml, producing a single-use lock file that contains only the selected packages. (#​3866)

v2.28.2

Compare Source

Bug Fixes

• Keep environment inspection working for Python 3.9 targets when PDM uses dep-logic 0.7 or newer. (#​3838)
• Cache the update check timestamp even when the version lookup fails, so that pdm no longer appears to hang on every command when PyPI is unreachable. (#​3840)
• Don't crash with an IndexError when listing scripts and one of them is blank. A blank script is now listed as <BLANK_SCRIPT>. (#​3842)
• Keep the whole template URL when pdm new is given an ssh:// or credentialed Git URL, instead of truncating it at the userinfo @. (#​3843)
• Strip comments preceded by any whitespace, not only a plain space, when importing a requirements.txt file. (#​3844)
• Match --trusted-host on host and port when importing a requirements.txt file, and keep the port when exporting one. (#​3845)
• Expand a ~ prefix in the venv.location config so pdm venv list/remove/activate/purge find virtualenvs created under it. (#​3847)
• Convert a Poetry caret constraint on a 0.x version to the upper bound Poetry documents, so ^0.2.3 becomes <0.3.0 and ^0.0.3 becomes <0.0.4 instead of <1.0.0. (#​3848)
• Fill in a placeholder project.name and project.version for the pyproject.toml generated for uv, so pdm lock/pdm install work with use_uv on a project that declares neither. (#​3849)
• Resolve nested requirement paths relative to remote requirements file URLs. (#​3850)

v2.28.1

Compare Source

Features & Improvements

• Defer command action and Python installer imports until their corresponding runtime paths execute. (#​3673)
• Add {run_cwd} placeholder for scripts to reference the original working directory. (#​3734)
• Add opt-in canonical lock input freshness via tool.pdm.resolution.lock_inputs while retaining sticky lockfile behavior and legacy hash fallback for existing lock files. (#​3821)
• Integrate argcomplete for simplified command-line completion scripts. (#​3823)

Bug Fixes

• Keep workspace members in their explicitly declared dependency groups instead of adding them to default in the lockfile. (#​3816)
• Keep the cached parsed version intact when stripping the local segment in comparable_version(). (#​3817)
• Make use_uv support adding local files. (#​3822)
• Add a Poetry optional dependency to every extra that lists it when importing, instead of only the first one. (#​3831)
• Do not write null values into the generated pyproject.toml when importing a flit project that omits author-email/maintainer-email or sets only one of include and exclude in [tool.flit.sdist]. (#​3832)

Miscellany

• Add Python 3.15 preview version to the CI matrix. (#​3827)

v2.28.0

Compare Source

Features & Improvements

• Add experimental workspace support for managing local member projects in a shared root lock file. (#​1505)
• Defer startup-time imports for Python, virtualenv, and self-management commands. (#​3673)

Bug Fixes

• Fix pdm completion bash printing __ltrim_colon_completions: command not found (and a similar error for _get_comp_words_by_ref) when the generated script is sourced in a bash without the bash-completion package loaded, such as Git Bash on Windows or minimal Linux containers. The script now defines small fallbacks for both helpers when they are not already available. (#​3793)
• Avoid forwarding duplicate SIGINT in pdm run on POSIX. (#​3808)

Documentation

• Fix the Windows installation instructions for a specific version. Invoke-Expression (iex) does not accept an -Args parameter and cannot forward arguments to a piped script, so the documented command failed. Use the $env:PDM_VERSION environment variable, which the install script reads, instead. (#​3792)

v2.27.0

Compare Source

Breaking Changes

• Update the minimum required Python version to 3.10. (#​3787)

Features & Improvements

• Respect existing values of pyproject.toml when running pdm init or pdm new. (#​3786)
• Move project plugin installations from .pdm-plugins under the project root to an isolated cache directory, and add a fixer to migrate existing plugin directories. (#​3790)
• Remove legacy importlib compatibility wrappers and use standard-library importlib.metadata and importlib.resources APIs directly. (#​3796)

Bug Fixes

• Fix a security issue with the installer to disallow installing to paths outside of the scheme directory. (#​3787)
• Refuse to write project-local config and state files (pdm.toml, .pdm-python, .python-version) when the destination is a symlink, preventing an untrusted repository from clobbering files outside the project root. (#​3788)
• Fix a regression issue that PDM_LOCKFILE env var is not respected. (#​3794)
• Allow configuring the default lock --exclude-newer value with strategy.exclude-newer. (#​3795)

v2.26.9

Compare Source

Features & Improvements

• Support exclude-newer in pyproject.toml in the [tool.pdm.resolution] table (#​3776)

Bug Fixes

• Preserve pylock package markers when refreshing lockfile hashes. (#​3773)

v2.26.8

Compare Source

Features & Improvements

• pdm lock --exclude-newer now accepts relative durations in the format N{d|h|w}, such as 7d, 12h, and 3w, in addition to absolute UTC dates and timestamps. (#​3760)

Bug Fixes

• Fixed pdm add --frozen-lockfile --no-sync to skip dependency resolution and update only pyproject.toml without attempting to write the lockfile. (#​3755)
• Fix [tool.pdm.options] being loaded from the current working directory instead of the target project when -p/--project is used. (#​3756)
• Put make_file_executable into pdm.utils to replace the method of the same name in installer. To fix a breakage introduced by installer v1. (#​3764)
• Fix pdm init <template> overwriting the template's additions to build-system.requires when build-system.build-backend matches the user's selection. (#​3766)
• Fixed PySpecSet merging to handle impossible Python version ranges like >=3.6,<3.4 without crashing on empty or inverted gaps. (#​3767)

Documentation

• The latest documentation version now shows a warning banner explaining that it is kept in sync with the main branch and may not match the features available in the latest released version. (#​3765)

v2.26.7

Compare Source

Features & Improvements

• Speed up dependency resolution when there are complex conflicts. (#​3751)

Documentation

• Switch to Zensical as docs generator. (#​3752)

Miscellany

• Add comprehensive tests for completion, show, search, and info commands to improve test coverage (#​3541)

v2.26.6

Compare Source

Bug Fixes

• Support packaging==26.0 changes for version comparison (#​3729)

v2.26.5

Compare Source

Bug Fixes

• Respect the project path when using cookiecutter template in pdm init command. (#​3721)
• Fix a bug that resolution.excludes is not applied when evaluating candidates from the lock file. (#​3726)

Documentation

• Remove chatbot from the docs page footer. (#​3722)
• Generate llms.txt for docs powered by mkdocs-llmstxt. (#​3723)

v2.26.4

Compare Source

Bug Fixes

• Make sure cursor closing for fixing PyPy different gc mode also add PyPy in CI. (#​3708)
• Fix a bug that old HTTP cache directories cause PDM to crash when trying to clear them. (#​3715)

v2.26.3

Compare Source

Features & Improvements

• Port to hishel 1.0.0. (#​3700)

Bug Fixes

• Update .gitignore file in the default template. (#​3686)
• Correct the sysconfig variables for Python standalone build installations. (#​3693)
• Ignore packages.vcs.requested-revision if it's None when formatting pylock.toml. (#​3694)
• Fix test failures with uv test cases using non-venv Python interpreters. (#​3698)

v2.26.2

Compare Source

Features & Improvements

• Only parse TOML document with tomlkit when writing is required. (#​3672)
• Add SHA256 checksums for binary releases during the release workflow and create an installer script that downloads binaries from GitHub releases with automatic platform detection and checksum verification. (#​3679)

Bug Fixes

• Fix test_use_python_write_file_multiple_versions to match PDM's actual behavior. (#​3660)
• Correctly calculate the venv path for UV_PROJECT_ENVIRONMENT env var when using uv mode. (#​3675)
• Ensure implementation.gil_disabled is a boolean in get_current_env_spec. This fix an issue that free-threaded wheels get rejected incorrectly. (#​3677)
• Fix CLI help formatting on Python 3.14+. (#​3683)
• Make PdmBasicAuth a cached_property to accelerate execution. (#​3684)

Removals and Deprecations

• Add deprecation warning for pdm search command as PyPI no longer supports search API. (#​3674)

Miscellany

• Add tests to utils.fs_supports_link_method and utils.convert_to_datetime. (#​3541)

v2.26.1

Compare Source

Bug Fixes

• Substitute missing env vars with empty string in expand_env_vars. (#​3653)
• Constrained hishel to be less than 1.0.0 due to its refactor (#​3657)

v2.26.0

Compare Source

Features & Improvements

• Limit the log file size to 100MB and truncate the log output if exceeded. (#​3633)
• Speed up dependency resolution in the bad path by skipping candidates of the same version when resolving. (#​3647)

Bug Fixes

• Reload project files after running hook scripts. (#​3615)
• Fix a bug when using UV as the resolver does not respect the venv.location configuration. (#​3616)
• Fix publish --skip-existing for Nexus Repository OSS >= 3.70 (#​3617)
• Fix a resolution failure when both prerelease and non-prerelease requirements exist. (#​3634)
• Ignore invalid python requirement during locking. (#​3635)
• Isolate PDM loggers with the root logger to avoid log leakage. (#​3637)
• Fix a crash when resolving URL dependencies under use_uv=true. (#​3640)

v2.25.9

Compare Source

No significant changes.

v2.25.8

Compare Source

Bug Fixes

• Fix a careless error by fast apply in AI coding. (#​3612)

v2.25.7

Compare Source

Features & Improvements

• Show the path to site-packages in the output of pdm info. (#​3600)

Bug Fixes

• Fix uv python dir path resolution on Windows (#​3603)
• Strip local version in version specifiers when writing package locks. (#​3605)
• Show an error message when 'default' is used in optional dependencies or dependency groups. (#​3609)
• Prevent hash clearing when appending to lockfile with env_spec. (#​3610)

v2.25.6

Compare Source

Features & Improvements

• The pdm python install -v command now shows the download URL for the Python interpreter. (#​3552)

Bug Fixes

• Ensure make_array always returns a tomlkit array type. (#​3586)
• Preserve multi-line help text in the CLI help output. (#​3587)
• Re-caculate artifact files and hashes when the lock target changes. (#​3595)

Dependencies

• Require packaging>22.0 and remove conditional PACKAGING_22 version checks. (#​3601)
• Bump truststore to version 0.10.4. (#​3602)

v2.25.5

Compare Source

Features & Improvements

• Tell the difference between free-threaded Python and normal ones. Users need to request for free-threaded versions explicitly by adding t to the version string, otherwise the normal build will be preferred. (#​3562)

Bug Fixes

• Fix a bug that editable local package URLs are empty when using pylock.toml. (#​3565)
• Fix a bug where pdm export with --lockfile pylock.toml produced empty requirements.txt files due to missing group information extraction from pylock format markers. (#​3573)
• Read metadata from installed distribution when using reuse-installed strategy. (#​3579)
• Fix a lockfile writing error when locking git dependencies in the pylock.toml format. (#​3582)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.