Sebastian Poxhofer
9fc451c44d
Migrate pub, gleam, helmfile, pixi, mise, poetry, pep621/pdm and
pep621/uv onto `updateLockFile()`, so each manager keeps only its
command and `ExecOptions` construction.
Behaviour changes:
- Artifact error text now comes from `artifactErrorMessageFromExecError`,
i.e. a non-blank `err.stderr`, else a non-blank `err.stdout`, else
`err.message`. Previously pixi used `${err}` ("Error: " prefix), mise
joined stdout, stderr and message, and poetry rendered
"<stdout>\n<stderr>" (literally "undefined\nundefined" when the error
carried neither).
- helmfile, pixi, poetry, pdm and uv now return null instead of an
addition when the lock file is missing or empty after the run, which
is what gleam and mise already did.
- Unchanged/missing lock file debug messages are now uniformly
"<lockFileName> is unchanged" / "No <lockFileName> found". pub gains
such a message, mise loses "Returning updated mise lock file" and
poetry loses "Returning updated <lockFileName>".
Pixi package manager
Currently support channels from anaconda and prefix.dev, other channels are not supported yet.
Whenever the pixi config in pyproject.toml or pixi.toml file is updated, pixi.lock file will be checked for updates as well.
When using pyproject.toml, standard PEP 621 dependencies (e.g. [project.dependencies] or [dependency-groups]) are handled by the pep621 manager, which also updates pixi.lock when those dependencies change.
Trust model for pixi lock file updates
Running pixi lock can execute arbitrary code from conda package hooks, so Renovate treats pixi.lock refreshes as an unsafe execution.
See pixi's security documentation for details.
Self-hosted administrators must explicitly allow this path by including pixi in the global allowedUnsafeExecutions setting.
When pixi is not allowed, the package file is still updated, but pixi.lock is left unchanged.
Renovatebot will pick pixi version in following order:
- renovatebot setting
constraints.pixi requires-pixiinpixi.toml
The minimal support version of pixi is 0.40.0 (pixi lock has only been introduced with that version).
Therefore when you are setting constraints.pixi in your renovatebot config or requires-pixi in pixi.toml, please be careful to pick a supported pixi version.