mirror of
https://github.com/renovatebot/renovate.git
synced 2026-10-31 17:51:49 +00:00
Niels Pardon
c3c70b8cdb
* feat(managers/pep621): update pixi.lock if present
* test(managers/pep621): cover pixi requires-pixi from workspace table
* refactor(manager/pixi): extract shared pixi.lock update helper
* test(manager/pep621): use arrange-act-assert spacing in pixi tests
* refactor(manager/pixi): revert shared pixi.lock helper extraction
Move the extraction of the shared pixi.lock update helper into a
follow-up PR, as requested in review. The pep621 pixi processor and the
pixi manager again carry their own lock-update logic.
This reverts commit 743db204f2.
* feat(manager/pep621): gate pixi.lock updates behind allowedUnsafeExecutions
`pixi lock` can execute arbitrary code from conda package hooks, so the
pep621 manager now only updates `pixi.lock` when `pixi` is included in the
global `allowedUnsafeExecutions` option, following the same pattern as the
`mise` manager. When `pixi` is not allowed, PEP 621 dependencies in
`pyproject.toml` are still updated but `pixi.lock` is left unchanged.
https://pixi.prefix.dev/latest/security/#4-treat-package-hooks-as-code-execution
* feat(manager/pixi)!: gate pixi.lock updates behind allowedUnsafeExecutions
The pixi manager runs `pixi lock`, which can execute arbitrary code from
conda package hooks. Like the pep621 manager, it now only updates
`pixi.lock` when `pixi` is included in the global `allowedUnsafeExecutions`
option. When it is not allowed, the package file is still updated but
`pixi.lock` is left unchanged.
https://pixi.prefix.dev/latest/security/#4-treat-package-hooks-as-code-execution
BREAKING CHANGE: The `pixi` manager no longer updates `pixi.lock`
automatically. To keep `pixi.lock` updated, add `pixi` to the global
`allowedUnsafeExecutions` option.
34 lines
1.8 KiB
Markdown
34 lines
1.8 KiB
Markdown
This manager supports updating dependencies inside `pyproject.toml` files.
|
|
|
|
In addition to standard dependencies, these toolsets are also supported:
|
|
|
|
- `pdm` (including `pdm.lock` files)
|
|
- `uv` (including `uv.lock` files and `uv` workspaces)
|
|
- `hatch`
|
|
- `pixi` (including `pixi.lock` files)
|
|
|
|
### Trust model for pixi lock file updates
|
|
|
|
Running `pixi lock` can execute arbitrary code from conda package hooks, so Renovate treats `pixi.lock` refreshes as an unsafe execution.
|
|
See [pixi's security documentation](https://pixi.prefix.dev/latest/security/#4-treat-package-hooks-as-code-execution) for details.
|
|
|
|
Self-hosted administrators must explicitly allow this path by including `pixi` in the global [`allowedUnsafeExecutions`](../../../self-hosted-configuration.md#allowedunsafeexecutions) setting.
|
|
When `pixi` is not allowed, dependencies in `pyproject.toml` are still updated, but `pixi.lock` is left unchanged.
|
|
|
|
### Private Modules Authentication
|
|
|
|
Before running the `pdm` or `uv` commands to update the `pdm.lock` or `uv.lock` respectively, Renovate exports `git` [`insteadOf`](https://git-scm.com/docs/git-config#Documentation/git-config.txt-urlltbasegtinsteadOf) directives in environment variables.
|
|
|
|
Renovate uses this logic before it updates any "artifacts":
|
|
|
|
The token from the `hostRules` entry matching `hostType=github` and `matchHost=api.github.com` is added as the default authentication for `github.com`.
|
|
For those running against `github.com`, this token will be the default platform token.
|
|
|
|
Next, all `hostRules` with both a token or username/password and `matchHost` will be fetched, except for any `github.com` one from above.
|
|
|
|
Rules from this list are converted to environment variable directives if they match _any_ of these characteristics:
|
|
|
|
- No `hostType` is defined, or
|
|
- `hostType` is `pep621`, or
|
|
- `hostType` is a platform (`github`, `gitlab`, `azure`, etc.)
|