[dependabot]

Bumps pipenv from 2026.8.0 to 2026.10.5.

Release notes

Sourced from pipenv's releases.

Release v2026.10.5

🤖 AI-Generated Changelog

Fixed

• Fixed --trusted-host arguments being flagged as secrets in CodeQL security scanning
• Fixed package name parsing in pipenv update to correctly handle requirement specifiers as arguments
• Fixed requirements command to emit --trusted-host for sources with verify_ssl = false
• Fixed requirements command to correctly join os_markers and markers with and
• Fixed requirements command to preserve markers for git/VCS entries
• Fixed uninstall command to exit with a non-zero code when pip uninstall fails
• Fixed uninstall command to report why it exits 1 when no virtualenv exists
• Fixed pylock group name normalization and added rejection of category name collisions
• Fixed pylock to preserve all categories when reading from pylock.toml
• Fixed pylock to keep custom dependency groups in develop and requires-python as python_version
• Fixed pylock to classify packages correctly based on whether they install for default groups
• Fixed docs search by replacing stale Algolia search with Sphinx search
• Fixed integration tests to fail fast when a different pipenv version would be tested than the checked-out one

Changed

• Refactored --trusted-host logic to be shared between requirements and install, preserving environment-variable-defined hosts
• Raised dependency security version floors and extended Python version support to 3.11–3.15
• Dropped Python 3.10 support and addressed related code quality findings

Security

• Raised minimum versions of dependencies to address known security vulnerabilities

---

🔗 Full Changelog: pypa/pipenv@v2026.10.4...v2026.10.5

Release v2026.10.4

🤖 AI-Generated Changelog

Added

• Added interactive pipenv init command for creating a Pipfile with guided prompts

Fixed

• Fixed pipenv install -r to decode requirements files using the same encoding detection as pip
• Fixed pipenv audit to exit with a non-zero status code when pip-audit cannot be run
• Fixed pipenv graph to print the missing virtualenv warning to stderr instead of stdout
• Fixed pipenv outdated to correctly interpolate the required version in skipped-update messages
• Fixed lockfile replacement to be atomic, preventing corruption on interrupted writes
• Fixed pipenv install to restore the Pipfile byte-for-byte when installation fails, including rolling back changes made by pipenv init
• Fixed Pipfile to be read and written as UTF-8 consistently across all operations

---

... (truncated)

Changelog

Sourced from pipenv's changelog.

2026.10.5 (2026-11-01)

pipenv 2026.10.5 (2026-11-01)

Behavior Changes

• Require Python 3.11 or newer and add support for Python 3.15. Project virtualenvs must also use Python 3.11+; the resolver now reports a clear error instead of failing on import under an older interpreter. Raise the minimum versions of virtualenv to 21.14.9, filelock to 4.2.1, and setuptools to 84.1.0 to include their security fixes, and refresh the development lockfiles. [#6771](https://github.com/pypa/pipenv/issues/6771) <https://github.com/pypa/pipenv/issues/6771>_

Bug Fixes

• Fixed pipenv update conflict detection and extra-category lookup for package arguments with extras or version ranges (requests[socks]==2.0, pkg>=2): the package name is now parsed as a requirement instead of splitting on =, and only exact pins are checked for conflicts.
• Preserve custom dependency categories when importing and exporting pylock.toml. Apply the selected groups when validating and installing packages, and retain each category's environment markers for shared dependencies. Parse group markers independently of whitespace so dev-only packages cannot be moved into the default category by compact marker syntax. Convert simple requires-python specifiers to a plain python_version or python_full_version. [#6758](https://github.com/pypa/pipenv/issues/6758) <https://github.com/pypa/pipenv/issues/6758>_
• Normalize the dependency group names written to pylock.toml and record each group's original category under [tool.pipenv.categories] so reading the file restores the same categories, including --dev-groups aliases as develop. Generating pylock.toml now fails when two categories, or a category and one of the --dev-groups, map to the same dependency group, instead of merging them. [#6759](https://github.com/pypa/pipenv/issues/6759) <https://github.com/pypa/pipenv/issues/6759>_
• pipenv requirements now keeps the environment marker of git/VCS dependencies, so they are no longer installed on platforms the Pipfile.lock excludes. [#6760](https://github.com/pypa/pipenv/issues/6760) <https://github.com/pypa/pipenv/issues/6760>_
• pipenv requirements now prints --trusted-host for sources with verify_ssl = false, as pipenv install passes it to pip. [#6761](https://github.com/pypa/pipenv/issues/6761) <https://github.com/pypa/pipenv/issues/6761>_
• pipenv uninstall now exits with a non-zero status when pip uninstall fails for a package. [#6762](https://github.com/pypa/pipenv/issues/6762) <https://github.com/pypa/pipenv/issues/6762>_

Improved Documentation

• Replace the documentation's outdated Algolia search with Sphinx's built-in search, so results point to pages in the documentation version being viewed. [#6661](https://github.com/pypa/pipenv/issues/6661) <https://github.com/pypa/pipenv/issues/6661>_

2026.10.4 (2026-10-28)

pipenv 2026.10.4 (2026-10-28)

Features & Improvements

• Add pipenv init, which creates a Pipfile for a new project through a short dialog (requirements.txt import, Python version, package index, packages and dev packages, and whether to create the virtualenv and lock). --yes accepts the defaults without prompting, and --install / --no-install control the follow-up install. If that install fails, the new Pipfile is removed so pipenv init can be run again. [#5792](https://github.com/pypa/pipenv/issues/5792) <https://github.com/pypa/pipenv/issues/5792>_

Bug Fixes

... (truncated)

Commits

• d9ab0ee Release v2026.10.5
• 93fd6f6 Bumped version to 2026.10.5.
• ebe7f77 Merge pull request #6775 from matteius/fix/code-scanning-27-trusted-host
• cca3f30 Merge pull request #6774 from pcbeingused333/fix/update-detect-conflicts-spec...
• 7c3c13f Merge pull request #6772 from matteius/fix/integration-tests-use-checkout-pipenv
• 3181b6e Name news fragment for PR 6775
• 0c74210 Avoid trusted-host secret naming false positive in CodeQL
• fef0293 Merge pull request #6771 from matteius/fix/dependency-security-locks
• 9fa87a7 fix(update): parse package names in update arguments as requirements
• 00c7144 Add news fragment for PR 6772
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud