Pex

Latest version: v2.33.7

Safety actively analyzes 723177 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 7 of 57

2.19.1

This release fixes a regression introduced by 2512 in the 2.19.0
release when building PEXes using abbreviated `--platform` targets.
Instead of failing certain builds that used to succeed, Pex now warns
that the resulting PEX may fail at runtime and that
`--complete-platform` should be used instead.

* Only warn when `--platform` resolves fail tag checks. (2533)

2.19.0

This release adds support for a new `--pre-resolved-dists` resolver as
an alternative to the existing Pip resolver, `--lock` resolver and
`--pex-repository` resolvers. Using `--pre-resolved-dists dists/dir/`
behaves much like `--no-pypi --find-links dists/dir/` except that it is
roughly 3x faster.

* Support `--pre-resolved-dists` resolver. (2512)

2.18.1

This release fixes `--scie-name-style platform-parent-dir` introduced in
2523. Previously the target platform name also leaked into scies
targeting foreign platforms despite using this option.

* Fix `--scie-name-style platform-parent-dir`. (2526)

2.18.0

This release adds support for `pex3 cache {dir,info,purge}` for
inspecting and managing the Pex cache. Notably, the `pex3 cache purge`
command is safe in the face of concurrent PEX runs, waiting for in
flight PEX runs to complete and blocking new runs from starting once the
purge is in progress. N.B.: when using `pex3 cache purge` it is best to
install Pex with the 'management' extra; e.g.:
`pip install pex[management]`. Alternatively, one of the new Pex scie
binary releases can be used.

In order to release a Pex binary that can support the new `pex3` cache
management commands first class, a set of enhancements to project
locking and scie generation were added. When using `--project` you can
now specify extras; e.g.: `--project ./the/project-dir[extra1,extra2]`.
When creating a Pex scie, you can now better control the output files
using `--scie-only` to ensure no PEX file is emitted and
`--scie-name-style` to control how the scie target platform name is
mixed into the scie output file name. Additionally, you can request one
or more shasum-compatible checksum files be emitted for each scie with
`--scie-hash-alg`.

On the locking front, an obscure bug locking project releases that
contain artifacts that mis-report their version number via their file
name has been fixed.

Finally, the vendored Pip has had its own vendored CA cert bundle
upgraded from that in certifi 2024.7.4 to that in certifi 2024.8.30.

* Fix locking of sdists rejected by Pip. (2524)
* Add `--scie-only` & `--scie-name-style`. (2523)
* Support `--project` extras. (2522)
* Support shasum file gen via `--scie-hash-alg`. (2520)
* Update vendored Pip's CA cert bundle. (2517)
* Introduce `pex3 cache {dir,info,purge}`. (2513)

2.17.0

This release brings support for overriding the versions of setuptools
and wheel Pex bootstraps for non-vendored Pip versions (the modern ones
you select with `--pip-version`) using the existing
`--extra-pip-requirement` option introduced in the [2.10.0 release](
https://github.com/pex-tool/pex/releases/tag/v2.10.0).

* Support custom setuptools & wheel versions. (2514)

2.16.2

This release brings a slew of small fixes across the code base.

When creating locks for foreign platforms,
`pex3 lock {create,update,sync}` now allows locking sdists that use
PEP-517 build backends that do not support the
`prepare_metadata_for_build_wheel` hook and whose product is a wheel not
compatible with the foreign platform. This is decidedly a corner case,
but one encountered with the `mesonpy` build backend which seems to have
traction in the scientific computing world in particular.

The recent re-vamp of the PEX REPL is now fixed to respect common
conventions for controlling terminal output via the `NO_COLOR`,
`FORCE_COLOR` and `TERM` environment variables.

The examples in the [buildingpex docs](
https://docs.pex-tool.org/buildingpex.html) had bit-rotted. They have
been refreshed and now all work.

Finally, both the Pex CLI and PEX files support the ambient OS standards
for user cache directories. Instead of using `~/.pex` as the default
`PEX_ROOT` cache location, the default is now `~/.cache/pex` on Linux (
but respecting `XDG_CACHE_HOME` when set) and `~/Library/Caches/pex` on
Mac.

* Lock sdists in more cases for foreign platforms. (2508)
* Respect `NO_COLOR`, `FORCE_COLOR` & `TERM=dumb`. (2507)
* Fix `buildingpex.rst` examples. (2506)
* Respect OS user cache location conventions. (2505)

Page 7 of 57

Links

Releases

Has known vulnerabilities

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.