mirror of
https://github.com/renovatebot/renovate.git
synced 2026-11-03 02:53:40 +00:00
Niels Pardon
f60995a404
feat(manager/pixi): gate pixi.lock updates behind allowedUnsafeExecutions The pixi manager runs `pixi lock`, which can execute arbitrary code from conda package hooks. It now only updates `pixi.lock` when `pixi` is included in the global `allowedUnsafeExecutions` option, following the same pattern as the `mise` manager. When `pixi` is not allowed, the package file is still updated but `pixi.lock` is left unchanged. https://pixi.prefix.dev/latest/security/#4-treat-package-hooks-as-code-execution