Niels Pardon f60995a404 feat(manager/pixi): gate pixi.lock updates behind allowedUnsafeExecutions (#44939) ...

feat(manager/pixi): gate pixi.lock updates behind allowedUnsafeExecutions

The pixi manager runs `pixi lock`, which can execute arbitrary code from
conda package hooks. It now only updates `pixi.lock` when `pixi` is
included in the global `allowedUnsafeExecutions` option, following the same
pattern as the `mise` manager. When `pixi` is not allowed, the package file
is still updated but `pixi.lock` is left unchanged.

https://pixi.prefix.dev/latest/security/#4-treat-package-hooks-as-code-execution

2026-07-29 09:18:02 +00:00

..

config

feat(manager/pixi): gate pixi.lock updates behind allowedUnsafeExecutions (#44939)

2026-07-29 09:18:02 +00:00

constants

build: lazy load and initialize logger (#41425)

2026-03-10 16:57:29 +00:00

data

feat(data): automatic update of static data (#44850)

2026-07-26 06:49:42 +00:00

instrumentation

feat(instrumentation): allow exporting OTLP JSON file (#42284)

2026-07-22 12:26:16 +00:00

logger

chore(deps): update dependency oxlint-tsgolint to v0.25.0 (main) (#44424)

2026-07-28 07:04:21 +00:00

modules

feat(manager/pixi): gate pixi.lock updates behind allowedUnsafeExecutions (#44939)

2026-07-29 09:18:02 +00:00

types

fix(package-rules): respect each dep update's fetchChangeLogs value (#42671)

2026-04-27 15:28:15 +00:00

util

feat(exec): support custom stream output writers (#44910)

2026-07-29 07:10:32 +00:00

workers

refactor(types): make currentVersionTimestamp a Timestamp (#44917)

2026-07-28 13:03:28 +00:00

commander.d.ts

chore(types): add missing ambient module setup (#40546)

2026-01-22 19:51:10 +00:00

config-validator.spec.ts

test(config-validation): add a test harness for renovate-config-validator (#44038)

2026-06-16 13:56:45 +00:00

config-validator.ts

feat(logging): do not use dynamic fields in log messages with severity WARN or higher (#44560)

2026-07-16 06:53:37 +00:00

expose.ts

refactor: replace better-sqlite3 with node:sqlite (#40697)

2026-05-09 11:57:10 +00:00

globals.d.ts

build: lazy load initialization modules (#41408)

2026-02-23 14:17:18 +00:00

proxy.spec.ts

refactor: Rewrite imports with .ts extensions (#40700)

2026-01-26 22:48:17 +00:00

proxy.ts

refactor: Rewrite imports with .ts extensions (#40700)

2026-01-26 22:48:17 +00:00

punycode.cjs

refactor(lint): Switch to Oxlint (#42384)

2026-04-07 14:42:23 +00:00

renovate.spec.ts

fix(cli): avoid printing logs on --version/--help (#42183)

2026-03-27 09:25:06 +00:00

renovate.ts

fix: initialise logger before proxy (#44152)

2026-07-13 16:34:59 +00:00