Niels Pardon
c3c70b8cdb
* feat(managers/pep621): update pixi.lock if present
* test(managers/pep621): cover pixi requires-pixi from workspace table
* refactor(manager/pixi): extract shared pixi.lock update helper
* test(manager/pep621): use arrange-act-assert spacing in pixi tests
* refactor(manager/pixi): revert shared pixi.lock helper extraction
Move the extraction of the shared pixi.lock update helper into a
follow-up PR, as requested in review. The pep621 pixi processor and the
pixi manager again carry their own lock-update logic.
This reverts commit 743db204f2.
* feat(manager/pep621): gate pixi.lock updates behind allowedUnsafeExecutions
`pixi lock` can execute arbitrary code from conda package hooks, so the
pep621 manager now only updates `pixi.lock` when `pixi` is included in the
global `allowedUnsafeExecutions` option, following the same pattern as the
`mise` manager. When `pixi` is not allowed, PEP 621 dependencies in
`pyproject.toml` are still updated but `pixi.lock` is left unchanged.
https://pixi.prefix.dev/latest/security/#4-treat-package-hooks-as-code-execution
* feat(manager/pixi)!: gate pixi.lock updates behind allowedUnsafeExecutions
The pixi manager runs `pixi lock`, which can execute arbitrary code from
conda package hooks. Like the pep621 manager, it now only updates
`pixi.lock` when `pixi` is included in the global `allowedUnsafeExecutions`
option. When it is not allowed, the package file is still updated but
`pixi.lock` is left unchanged.
https://pixi.prefix.dev/latest/security/#4-treat-package-hooks-as-code-execution
BREAKING CHANGE: The `pixi` manager no longer updates `pixi.lock`
automatically. To keep `pixi.lock` updated, add `pixi` to the global
`allowedUnsafeExecutions` option.
1.8 KiB
This manager supports updating dependencies inside pyproject.toml files.
In addition to standard dependencies, these toolsets are also supported:
pdm(includingpdm.lockfiles)uv(includinguv.lockfiles anduvworkspaces)hatchpixi(includingpixi.lockfiles)
Trust model for pixi lock file updates
Running pixi lock can execute arbitrary code from conda package hooks, so Renovate treats pixi.lock refreshes as an unsafe execution.
See pixi's security documentation for details.
Self-hosted administrators must explicitly allow this path by including pixi in the global allowedUnsafeExecutions setting.
When pixi is not allowed, dependencies in pyproject.toml are still updated, but pixi.lock is left unchanged.
Private Modules Authentication
Before running the pdm or uv commands to update the pdm.lock or uv.lock respectively, Renovate exports git insteadOf directives in environment variables.
Renovate uses this logic before it updates any "artifacts":
The token from the hostRules entry matching hostType=github and matchHost=api.github.com is added as the default authentication for github.com.
For those running against github.com, this token will be the default platform token.
Next, all hostRules with both a token or username/password and matchHost will be fetched, except for any github.com one from above.
Rules from this list are converted to environment variable directives if they match any of these characteristics:
- No
hostTypeis defined, or hostTypeispep621, orhostTypeis a platform (github,gitlab,azure, etc.)