Bump pipenv from 2026.6.2 to 2026.7.1

[dependabot]

Bumps pipenv from 2026.6.2 to 2026.7.1.

Release notes

Sourced from pipenv's releases.

Release v2026.7.1

🤖 AI-Generated Changelog

Fixed

• Fixed host package leakage into project installs, preventing system-level packages from incorrectly being available in virtual environments
• Fixed interrupted releases to be resumable, improving reliability of the release pipeline
• Fixed cross-platform compatibility in packaging regression tests by using proper quoting
• Fixed locked transitive dependency installation behavior

---

🔗 Full Changelog: pypa/pipenv@v2026.7.0...v2026.7.1

Release v2026.7.0

🤖 AI-Generated Changelog

Added

• Added wall-clock timeout enforcement for the resolver subprocess via PIPENV_RESOLVER_TIMEOUT_S environment variable, making hung resolver processes recoverable
• Added structured diagnostic logging from the resolver subprocess, populating Diagnostics.resolver_log with resolve records for improved debugging
• Added support for major-only Python version specifiers (e.g., python_version = "3") in environment markers

Changed

• Unified in-process and subprocess resolver paths into a single resolve_for_pipenv function, simplifying the resolver architecture
• Resolver subprocess now communicates using typed ResolverRequest/ResolverResponse schemas, improving protocol stability and error surfacing
• Improved resolver error reporting: subprocess errors are now surfaced via response file with structured messages
• PIPENV_PYPI_MIRROR credentials are now written to the resolver's netrc, fixing authentication in mirrored index scenarios
• Indexes without upload times are now tolerated by the resolver
• Marker-skipped dependency entries are now tolerated during resolution, and subprocess stderr is forwarded again

Fixed

• Fixed crash when locking for the first time or adding a new dependency category (old_lock_data initialization)
• Fixed do_init so that ignore_pipfile/skip_lock flags are only pinned during initialization, not propagated to dependency installation
• Fixed Sources.all to always return a list
• Fixed is_virtual_environment to tolerate virtual environment directories without a bin/Scripts subdirectory
• Fixed resolver to bootstrap pipenv on sys.path before importing the schema module
• Fixed resolver subprocess to correctly rehydrate resolved_default_deps as a dict rather than a list
• Fixed -r flag missing from README requirements.txt example

Security

• Updated pip and cryptography dependencies to address security vulnerabilities

Deprecated

• Scheduled removal of legacy check command behaviors targeting the 2027 major release

... (truncated)

Changelog

Sourced from pipenv's changelog.

2026.7.1 (2026-08-03)

pipenv 2026.7.1 (2026-08-03)

Features & Improvements

• Added support for cool-down-period in the [pipenv] section of the Pipfile. Setting cool-down-period = "30d" instructs the resolver to only consider package versions uploaded at least the specified number of days ago, via pip's --uploaded-prior-to flag.

Behavior Changes

• Added a configurable timeout for the resolver subprocess invoked by pipenv install, pipenv lock, and pipenv sync. A hung mirror or stuck pip download previously caused the resolver to block forever from the user's perspective; the wait is now bounded by PIPENV_RESOLVER_TIMEOUT_S (default 1800 seconds = 30 minutes, chosen generously so normal resolutions are unaffected). On timeout the subprocess is killed and a clear error is surfaced that names the environment variable so users with legitimately large resolutions can extend it.
• Resolver subprocess now produces structured error messages on dependency conflicts, surfacing the conflicting packages and the specific requirements that cause the conflict instead of a wall of unstructured pip output. #T_F.3 <https://github.com/pypa/pipenv/issues/T_F.3>_
• Pipenv now enforces a wall-clock timeout on the resolver across both the subprocess and in-process branches. The deadline is resolved with the precedence [pipenv] resolver_timeout_seconds (Pipfile) > PIPENV_RESOLVER_TIMEOUT_S (env var) > default (1800 seconds), and is stamped onto RequestMetadata.deadline_seconds so the resolver subprocess sees the same value the parent uses for subprocess.wait(timeout=...). A hung resolver is now killed and a structured error surfaced naming the override, instead of hanging indefinitely. The in-process debug branch (PIPENV_RESOLVER_PARENT_PYTHON=1) enforces the same deadline via SIGALRM on Unix; Windows continues to rely on the subprocess path for enforcement. #T_F.6 <https://github.com/pypa/pipenv/issues/T_F.6>_

Bug Fixes

• Fixed a latent bug in pipenv.utils.dependencies.pep423_name whose scheme-token guard had an inverted predicate, making the branch that preserves URL/VCS specifiers (e.g. git+ssh://host/path/some_repo) from underscore-mangling unreachable. The predicate is now correct;

... (truncated)

Commits

• dce192c Release v2026.7.1
• 86f8d5f Bumped version to 2026.7.1.
• 3c3f314 check pt
• 91f2b49 Merge pull request #6695 from pypa/fix/release-pipeline-recovery-2026-08
• bf2e7d6 Merge pull request #6700 from pypa/fix/locked-transitive-install
• b7f10c1 Use cross-platform quoting in packaging regression test
• f164657 Fix host package leakage into project installs
• 3f32f08 fix(release): make interrupted releases resumable
• 43170bf Bumped version to 2026.7.0.
• 8dccef6 Merge pull request #6694 from pypa/dependabot/pip/pip-0f79532196
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud