Pex

Latest version: v2.24.1

Safety actively analyzes 682404 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 2 of 54

2.22.0

This release adds support for `--pip-version 24.3.1`.

* Add support for `--pip-version 24.3.1`. (2582)

2.21.0

This release adds support for `--pip-version 24.3`.

* Add support for `--pip-version 24.3`. (2580)

2.20.4

This release carries several bug fixes and a performance improvement for
lock deletes.

Although there were no direct reports in the wild, iritkatriel noticed
by inspection the Pex `safe_mkdir` utility function would mask any
`OSError` besides `EEXIST`. This is now fixed.

It was observed by b-x that when `PEX_ROOT` was contained in a
symlinked path, PEXes would fail to execute. The most likely case
leading to this would be a symlinked `HOME` dir. This is now fixed.

This release also fixes a bug where `--pip-log <path>`, used multiple
times in a row against the same file could lead to `pex3 lock` errors.
Now the specified path is always truncated before use and a note has
been added to the option `--help` that using the same `--pip-log` path
in concurrent Pex runs is not supported.

In addition, `pex3 lock {update,sync}` is now optimized for the cases
where all the required updates are deletes. In this case neither Pip nor
the network are consulted leading to speed improvements proportional to
the size of the resolve.

* Fix `safe_mkdir` swallowing non-`EEXIST` errors. (2575)
* Fix `PEX_ROOT` handling for symlinked paths. (2574)
* Fix `--pip-log` re-use. (2570)
* Optimize pure delete lock updates. (2568)

2.20.3

This release fixes both PEX building and lock creation via
`pex3 lock {create,sync}` to be reproducible in more cases. Previously,
if a requirement only available in source form (an sdist, a local
project or a VCS requirement) had a build that was not reproducible due
to either file timestamps (where the `SOURCE_DATE_EPOCH` standard was
respected) or random iteration order (e.g.: the `setup.py` used sets in
certain in-opportune ways), Pex's outputs would mirror the problematic
requirement's non-reproducibility. Now Pex plumbs a fixed
`SOURCE_DATE_EPOCH` and `PYTHONHASHSEED` to all places sources are
built.

* Plumb reproducible build env vars more thoroughly. (2554)

2.20.2

This release fixes an old bug handling certain sdist zips under
Python 2.7 as well missing support for Python 3.13's `PYTHON_COLORS`
env var.

* Fix Zip extraction UTF-8 handling for Python 2.7. (2546)
* Add repl support for `PYTHON_COLORS`. (2545)

2.20.1

This release fixes Pex `--interpreter-constraint` handling such that
any supplied interpreter constraints which are in principle
unsatisfiable either raise an error or else cause a warning to be issued
when other viable interpreter constraints have also been specified. For
example, `--interpreter-constraint ==3.11.*,==3.12.*` now errors and
`--interpreter-constraint '>=3.8,<3.8' --interpreter-constraint ==3.9.*`
now warns, culling `>3.8,<3.8` and continuing using only `==3.9.*`.

* Pre-emptively cull unsatisfiable interpreter constraints. (2542)

Page 2 of 54

Links

Releases

Has known vulnerabilities

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.