Pex

Latest version: v2.24.1

Safety actively analyzes 683530 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 3 of 54

2.20.0

This release adds the `--pip-log` alias for the existing
`--preserve-pip-download-log` option as well as the ability to specify
the log file path. So, to debug a resolve, you can now specify
`--pip-log log.txt` and Pex will deposit the Pip resolve log to
`log.txt` in the current directory for easy tailing or post-resolve
inspection. In addition, the log file itself is more useful in some
cases. When you specify any abbreviated `--platform` targets, those
targets calculated wheel compatibility tags are included in the Pip
log. Also, when multiple targets are specified, their log outputs are
now merged at the end of the resolve in a serialized fashion with
prefixes on each log line indicating which target the log line
corresponds to.

In addition, a race in Pex's PEP-517 implementation that could (rarely)
lead to spurious metadata generation errors or sdist creation errors is
fixed.

* Fix intermittent PEP-517 failures. (2540)
* Plumb `--pip-version` to Platform tag calculation. (2538)
* Add the ability to specify the `--pip-log` path. (2536)

2.19.1

This release fixes a regression introduced by 2512 in the 2.19.0
release when building PEXes using abbreviated `--platform` targets.
Instead of failing certain builds that used to succeed, Pex now warns
that the resulting PEX may fail at runtime and that
`--complete-platform` should be used instead.

* Only warn when `--platform` resolves fail tag checks. (2533)

2.19.0

This release adds support for a new `--pre-resolved-dists` resolver as
an alternative to the existing Pip resolver, `--lock` resolver and
`--pex-repository` resolvers. Using `--pre-resolved-dists dists/dir/`
behaves much like `--no-pypi --find-links dists/dir/` except that it is
roughly 3x faster.

* Support `--pre-resolved-dists` resolver. (2512)

2.18.1

This release fixes `--scie-name-style platform-parent-dir` introduced in
2523. Previously the target platform name also leaked into scies
targeting foreign platforms despite using this option.

* Fix `--scie-name-style platform-parent-dir`. (2526)

2.18.0

This release adds support for `pex3 cache {dir,info,purge}` for
inspecting and managing the Pex cache. Notably, the `pex3 cache purge`
command is safe in the face of concurrent PEX runs, waiting for in
flight PEX runs to complete and blocking new runs from starting once the
purge is in progress. N.B.: when using `pex3 cache purge` it is best to
install Pex with the 'management' extra; e.g.:
`pip install pex[management]`. Alternatively, one of the new Pex scie
binary releases can be used.

In order to release a Pex binary that can support the new `pex3` cache
management commands first class, a set of enhancements to project
locking and scie generation were added. When using `--project` you can
now specify extras; e.g.: `--project ./the/project-dir[extra1,extra2]`.
When creating a Pex scie, you can now better control the output files
using `--scie-only` to ensure no PEX file is emitted and
`--scie-name-style` to control how the scie target platform name is
mixed into the scie output file name. Additionally, you can request one
or more shasum-compatible checksum files be emitted for each scie with
`--scie-hash-alg`.

On the locking front, an obscure bug locking project releases that
contain artifacts that mis-report their version number via their file
name has been fixed.

Finally, the vendored Pip has had its own vendored CA cert bundle
upgraded from that in certifi 2024.7.4 to that in certifi 2024.8.30.

* Fix locking of sdists rejected by Pip. (2524)
* Add `--scie-only` & `--scie-name-style`. (2523)
* Support `--project` extras. (2522)
* Support shasum file gen via `--scie-hash-alg`. (2520)
* Update vendored Pip's CA cert bundle. (2517)
* Introduce `pex3 cache {dir,info,purge}`. (2513)

2.17.0

This release brings support for overriding the versions of setuptools
and wheel Pex bootstraps for non-vendored Pip versions (the modern ones
you select with `--pip-version`) using the existing
`--extra-pip-requirement` option introduced in the [2.10.0 release](
https://github.com/pex-tool/pex/releases/tag/v2.10.0).

* Support custom setuptools & wheel versions. (2514)

Page 3 of 54

Links

Releases

Has known vulnerabilities

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.