🤖 AI-Generated Changelog

Fixed

• Fixed host package leakage into project installs, preventing system-level packages from incorrectly being available in virtual environments
• Fixed interrupted releases to be resumable, improving reliability of the release pipeline
• Fixed cross-platform compatibility in packaging regression tests by using proper quoting
• Fixed locked transitive dependency installation behavior

🔗 Full Changelog: v2026.7.0...v2026.7.1

🤖 AI-Generated Changelog

Added

• Added wall-clock timeout enforcement for the resolver subprocess via PIPENV_RESOLVER_TIMEOUT_S environment variable, making hung resolver processes recoverable
• Added structured diagnostic logging from the resolver subprocess, populating Diagnostics.resolver_log with resolve records for improved debugging
• Added support for major-only Python version specifiers (e.g., python_version = "3") in environment markers

Changed

• Unified in-process and subprocess resolver paths into a single resolve_for_pipenv function, simplifying the resolver architecture
• Resolver subprocess now communicates using typed ResolverRequest/ResolverResponse schemas, improving protocol stability and error surfacing
• Improved resolver error reporting: subprocess errors are now surfaced via response file with structured messages
• PIPENV_PYPI_MIRROR credentials are now written to the resolver's netrc, fixing authentication in mirrored index scenarios
• Indexes without upload times are now tolerated by the resolver
• Marker-skipped dependency entries are now tolerated during resolution, and subprocess stderr is forwarded again

Fixed

• Fixed crash when locking for the first time or adding a new dependency category (old_lock_data initialization)
• Fixed do_init so that ignore_pipfile/skip_lock flags are only pinned during initialization, not propagated to dependency installation
• Fixed Sources.all to always return a list
• Fixed is_virtual_environment to tolerate virtual environment directories without a bin/Scripts subdirectory
• Fixed resolver to bootstrap pipenv on sys.path before importing the schema module
• Fixed resolver subprocess to correctly rehydrate resolved_default_deps as a dict rather than a list
• Fixed -r flag missing from README requirements.txt example

Security

• Updated pip and cryptography dependencies to address security vulnerabilities

Deprecated

• Scheduled removal of legacy check command behaviors targeting the 2027 major release

🔗 Full Changelog: v2026.6.2...v2026.7.0

🤖 AI-Generated Changelog

Added

• Support cool-down-period configuration in the [pipenv] section of the Pipfile

Fixed

• Credentials defined in Pipfile now take precedence over .netrc; environment variables in pylock source URLs are now expanded correctly
• Re-lock all Pipfile entries when running pipenv update with no packages specified

Changed

• Bump plette vendor dependency to 2.2.1
• Bump idna dependency in the pip group

🔗 Full Changelog: v2026.6.1...v2026.6.2

🤖 AI-Generated Changelog

Fixed

• Prevent mutation of cached parsed Pipfile data during dependency locking, resolving potential issues with corrupted lock state across operations

Changed

• Updated development dependencies (pip group)

🔗 Full Changelog: v2026.6.0...v2026.6.1

🤖 AI-Generated Changelog

Security

• Strip credentials from pip argument vectors to prevent credential exposure in logs and process listings (GHSA-8xgg-v3jj-95m2)
• Validate tar link targets in data_filter fallback to prevent path traversal during package installation (GHSA-p4qx-p8p6-4gjf)

Added

• Add documentation for git+ssh package sources in Pipfile

Fixed

• Fix PIPENV_PROJECT_DIR not being expanded correctly in Pipfile script definitions
• Fix pipenv shell breaking terminal input echo after exit
• Fix three regressions introduced in a prior release affecting resolver and marker environment handling
• Restore target_marker_version helper alias for backwards compatibility
• Fix _target_marker_environment returning incorrect value when allow_global=True

Changed

• Vendor in Pip 26.1
• Cache Pipfile parsing and parallelize hash and candidate lookups for improved performance

Dependencies

• Bump pygments from 2.19.2 to 2.20.0
• Bump pytest (development dependency)

🔗 Full Changelog: v2026.5.2...v2026.6.0

🤖 AI-Generated Changelog

Fixed

• Fixed pipenv audit --locked failing when used with Pipfile.lock and the legacy shell completion environment variable

Changed

• Updated shell completion to use argcomplete instead of the legacy implementation
• Improved shell completion documentation with migration guide and Git Bash instructions

🔗 Full Changelog: v2026.5.1...v2026.5.2

🤖 AI-Generated Changelog

Fixed

• Resolved CLI regressions introduced by the argparse migration, including broken command-line options and argument handling
• Restored environment variable expansion behavior that was lost during the argparse migration
• Fixed shell history functionality that was affected by recent CLI changes

Changed

• Skipped fork_compat history test on Windows where pexpect.spawn is unavailable, improving cross-platform test reliability
• Updated pygments dependency from 2.19.2 to 2.20.0 in examples

🔗 Full Changelog: v2026.5.0...v2026.5.1

🤖 AI-Generated Changelog

Added

• Add "Did You Mean" suggestions for mistyped subcommands, helping users quickly identify and correct typos in CLI commands
• Add shell completion support via argcomplete
• Unvendor click and click_didyoumean, reducing bundled dependencies in favor of external packages

Changed

• Migrate CLI infrastructure from click to argparse, introducing argparse alongside the existing CLI

Removed

• Remove vendored importlib-metadata and zipp following Python 3.9 end-of-life
• Remove cached_property Python 3.7 compatibility fallback
• Remove colorama Windows console ANSI fix for Windows
• Remove sphinx-click and vendored click remnants from documentation tooling

Fixed

• Strip dependency_groups markers before passing dependencies to pip during locking, preventing resolution errors
• Prevent duplicate dependency_groups markers from being written on pylock re-generation
• Restore correct ruff linting behavior
• Ensure PipenvException calls super().__init__() so str(exc) returns the properly formatted message
• Mark man page test as skipped on Windows to avoid false failures

🔗 Full Changelog: v2026.4.0...v2026.5.0

🤖 AI-Generated Changelog

Added

• --extras CLI option: Specify optional dependency categories directly from the command line
• --exclude-index flag for requirements command: Exclude index URLs from generated requirements output
• PIPENV_PYENV_ONLY environment variable: Restrict Python discovery exclusively to pyenv, ignoring other Python installations
• PIPENV_KEYRING_PROVIDER environment variable: Enable Windows Credential Manager and other keyring backends for private index authentication
• PEP 440 version specifiers in python_version: Pipfile now accepts full PEP 440 specifiers (e.g., >=3.10) for Python version constraints
• [build-system] requires support in Pipfile: Define build system requirements directly in Pipfile
• pipenv sync from pylock.toml: Sync environments using pylock.toml without requiring Pipfile.lock
• Patch files for pip customizations: Vendored pip customizations are now tracked as patch files for transparency

Changed

• pipenv sync and install --ignore-pipfile now work without a Pipfile present
• --system flag support improved across multiple commands
• --all flag for update and upgrade commands fixed to correctly target all packages
• PyPI proper_case lookup timeout increased from 0.3s to 3s to reduce failures on slow networks
• PIPENV_VERSION environment variable is now ignored when running --version flag
• Fish shell completion now supports file path completion for pipenv run arguments

Fixed

• Shell detection on Windows: pipenv shell now correctly launches bash or PowerShell instead of defaulting to cmd
• Shell suspension: pipenv shell now properly suspends with Ctrl+Z (job control restored)
• Shell startup with interactive prompts: pipenv shell activates correctly even when shell startup scripts produce interactive output
• PTY echo restore race condition: Fixed synchronization issue in Docker and similar environments
• Cross-category dependency resolution: Resolved conflicting version pins when resolving dependencies across multiple categories
• Package name normalization in Pipfile hash: Package names are normalized before computing the Pipfile hash, preventing spurious lockfile invalidation
• URL-encoded credentials in Pipfile source URLs: Expanded credentials are now URL-encoded to avoid parsing errors
• sys_platform shorthand markers: Short-form platform markers are now correctly included in pip requirement lines
• Python version marker evaluation: Fixed resolution failures caused by incorrect python_full_version in marker evaluation, including major-only python_version values
• Windows py-launcher full-version matching: Correctly matches python_full_version specifiers when using the Windows py launcher
• Pipfile whitespace and category corruption: Upgrades no longer corrupt unrelated Pipfile sections or strip formatting
• Symlink preservation: Normalizing the Pipfile path no longer resolves symlinks unexpectedly
• Transitive PEP 508 file:// URL dependencies: File-scheme dependencies are now correctly recorded during locking
• Pipfile python_version mismatch with venv: Records the correct Python version when the venv Python and PATH Python disagree
• Editable local-path handling: Hardened handling of editable installs for local paths
• distutils missing fallback: Falls back to sysconfig when distutils is unavailable (Python 3.12+)
• Wheel metadata case preservation: Header install paths now use the wheel metadata package name to preserve original casing
• pip.conf extra-index hash collection: Hashes from pip.conf extra-index URLs are now collected during locking
• pip.conf index suppression at install time: Prevents hash mismatch errors caused by pip.conf injecting extra indexes during install
• Partial updates preserve transitive dependencies: Pinned packages' transitive dependencies are no longer removed during partial updates
• Private index resolution for dev packages: index_lookup is now populated from all Pipfile sections when locking non-default categories
• --where exit code: Fixed incorrect exit code for the --where flag
• _create_builtin_venv_cmd: No longer incorrectly prepends a drive letter to Unix paths when run on Windows
• venv fallback for alternative interpreters: Falls back to built-in venv when virtualenv fails for non-standard interpreters
• ResolutionTooDeepError: Fixed excessive recursion caused by incorrect marker evaluation during resolution
• fix --where exit code: Corrected exit behavior for the requirements --where option

Security

• Cryptography dependency bumped to 46.0.6
• Requests dependency bumped to 2.33.0

🔗 Full Changelog: v2026.2.2...v2026.4.0

🤖 AI-Generated Changelog

Added

• Add pipenv remove command as a dedicated subcommand for removing virtualenvs

Deprecated

• Deprecate the --rm option in favor of the new pipenv remove command

Fixed

• Restore --pre flag behavior with pip 26+ by calling check_release_control_exclusive in Resolver.pip_options
• Guard against empty resolution in _clean_unused_dependencies to prevent errors during upgrade cleanup (#6002)
• Run python -m virtualenv from an empty directory to prevent PYTHONPATH pollution affecting virtual environment creation (#6568)

🔗 Full Changelog: v2026.2.1...v2026.2.2