v4.0.0

Breaking: drop support for Python 3.9.

Apart from that this is mostly bugfixes, in particular fixing breakage from the latest Dulwich release.

What's Changed

• Update actions/checkout action to v5 by @renovate[bot] in #832
• Update zizmorcore/zizmor-action action to v0.1.2 by @renovate[bot] in #833
• [feature] support allow-pypi-requests in environment yaml by @AlbertDeFusco in #836
• Handle Python release candidates in PyPI solver by @lesteve in #837
• Update zizmorcore/zizmor-action action to v0.2.0 by @renovate[bot] in #842
• Drop support for Python 3.9 by @maresb in #845
• Update pytest-split durations by @maresb in #846
• Update actions by @maresb in #848
• chore(deps): update actions/download-artifact action to v5 by @renovate[bot] in #827
• chore(deps): update actions/cache digest to 0057852 by @renovate[bot] in #828
• chore(deps): update codecov/codecov-action digest to 5a10915 by @renovate[bot] in #835
• chore(deps): update mamba-org/setup-micromamba digest to add3a49 by @renovate[bot] in #838
• chore(deps): update pypa/gh-action-pypi-publish action to v1.13.0 by @renovate[bot] in #839
• chore(deps): update actions/setup-python action to v6 by @renovate[bot] in #840
• chore(deps): update conda/actions action to v25.9.2 by @renovate[bot] in #841
• chore(deps): update peter-evans/create-or-update-comment action to v5 by @renovate[bot] in #844
• chore(deps): update conda-incubator/setup-miniconda action to v3.2.0 by @renovate[bot] in #849
• Add 2.18 as a valid glibc version by @romain-intel in #847
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #819
• Preparations for enabling ty type checker by @maresb in #850
• Add --preserve-temp-dirs CLI argument by @maresb in #851
• Remove micromamba test channel by @maresb in #852
• Use ty typechecker for pre-commit, move mypy to CI by @maresb in #853
• Explicitly support and test Python 3.14 by @maresb in #854
• chore(deps): update github artifact actions (major) by @renovate[bot] in #859
• Generate and distribute JSON schema from Pydantic models by @jaimergp in #860
• Fix input-hash in --filename-template by @imLew in #872
• Exclude broken Dulwich version and update CI dependencies by @maresb in #874

New Contributors

• @jaimergp made their first contribution in #860
• @imLew made their first contribution in #872

Full Changelog: v3.0.4...v4.0.0

v3.0.4

What's Changed

This release fixes a major bug that rendered conda-lock install --update essentially unusable because it replaced the extensions of all URLs .tar.bz2, even when the actual builds had the .conda extension.

Major bugfix

• Don't clobber build extensions (.tar.bz2 vs .conda) when running conda-lock update by @maresb in #815

Minor bugfix

• Prevent --update from proceeding if the channel configuration has changed by @maresb in #817

Maintenance

• Update ruff to use Python 3.9, and update codebase accordingly by @pre-commit-ci and @maresb in #805
• Harden GHA security and add zizmor scan by @maresb in #814
• Clean up mkdocs by @maresb in #818
• Resolve sporadic failures of lookup cache test by @maresb in #811, #820

Full Changelog: v3.0.3...v3.0.4

v3.0.3

What's Changed

Highlights:

• Reduce noisy warnings about PyPI packages missing from the lookup
• Fix --check-input-hash to interoperate between conda-lock v2.5.8 and v3.0.3 (avoids relocking when inputs are unchanged)
• Add a mechanism to inspect the internal representation of the environment specification

Bugfix

• Improve compatibility between lockfiles produced by v2 and v3 by @maresb in #797
• Convert noisy warning into debug log when PyPI package is missing from mapping by @maresb in #808

New debug feature

You can now view conda-lock's internal representation of the dependency specification by running

conda-lock render-lock-spec --kind=raw --stdout -f ...

This is useful for troubleshooting how the input files are being parsed. This interface is experimental/unsupported and is meant purely for debugging. Implemented in #808.

Full Changelog: v3.0.2...v3.0.3

v3.0.2

What's Changed

Fix a v3 regression where a pip dependency version specification using ~= fails to parse (#801)

Bugfix

• Revendor grayskull to fix parsing of ~= by @maresb in #802

Full Changelog: v3.0.1...v3.0.2

v3.0.1

What's Changed

This release fixes two longstanding issues with the stripping of authentication credentials:

• ✅ --strip-auth used to disable --check-input-hash for no good reason
• ✅ private PyPI repositories running on a non-standard port would have the port stripped from the URL along with credentials

There is only one known regression in v3, and it only affects --check-input-hash. The fix is still in progress in #797.

• ❌ clean lockfiles created by v2 are mistaken as dirty in v3 with --check-input-hash.

Bugfixes

• Make --check-input-hash work when conda-lock lock --strip-auth --check-input-hash ... is used by @peterbygrave in #792
• Don't also strip port when stripping credentials from a URL by @maresb and @eflebus in #800

Maintenance

• Add type annotations for content_hash computation by @maresb in #799

Full Changelog: v3.0.0...v3.0.1

v3.0.0

What's Changed

Conda-lock v3 introduces support for mamba / micromamba v2, and includes several important bugfixes.

Only mamba / micromamba versions <2 or >=2.0.7 are supported. (2.0.0–2.0.6 are incompatible.) To see which executable conda-lock is detecting, you can add the argument --log-level=DEBUG.

The only intended breaking change is to require at least Python 3.9 (previously 3.8). There are several major underlying changes to be aware of:

• The PyPI solver has been updated to Poetry v2.0.1. (#637, #678, #685, #769)
• Lockfiles now support dependencies with multiple categories. (#697)

pixi

Pixi is an innovative new tool for Conda projects that includes lockfile support. While the project-centric philosophy of pixi is different from the environment-centric approach of conda-lock, in many cases it offers a compelling alternative to conda-lock. For a discussion of conda-lock vs pixi, see #615.

Conda-lock v3 includes a new render-lock-spec subcommand capable of exporting conda-lock lock specifications (including ordinary pyproject.toml files) to pixi.toml configurations. See the pixi migration guide for more information.

Detailed changelog

New features

• Support Multiple Categories for Sub-Dependencies in Lockfile (Rebase #390) by @srilman in #697
• Sort BaseLockedDependency.dependencies when alpha-sorting a Lockfile by @peterbygrave in #654
• Add support for PEP 508 environment markers by @maresb in #684
• Improve loading of PyPI mapping by @maresb in #690
• Add render-lock-spec subcommand for exporting lock specification to pixi.toml by @maresb in #664
• Add pixi.toml configuration by @maresb in #705, #706
• Support Micromamba v2 by @maresb in #713, #717, #723, #720, #721, #788
• Add/improve support for Path dependencies and GIT dependencies by @romain-intel in #712
• Add --force-platform to conda-lock install command. by @jezdez in #753
• Add environment variables for conda/mamba/micromamba by @maresb in #760

Bugfixes

• Fix parsing of Poetry's caret and tilde dependencies by @maresb in #679, #683, #714
• Refactor lock command and fix an edge case by @maresb in #695
• Fix erroneous PyPI to Conda dep name conversion for PyPI deps by @maresb in #701, #704
• Fix KeyError: 'pkgs_dirs' by @maresb in #733
• Minor bugfix: don't truncate the extension in conda-meta filenames by @maresb in #744
• Add --quiet flag in conda command to disable progress bar by @maresb in #756
• Fix an issue that caused transitive dependencies to not have categories by @romain-intel in #768
• Use build_string in build field in fake package by @RSchwan in #776
• Log stderr warnings as warnings by @maresb in #772
• Fix race condition with lookup cache by @maresb in #785

Documentation

• Clarify that existing lockfiles are used for relocking by @sfinkens in #632
• Correct mistake in basic usage documentation by @sfinkens in #647
• Create a basic pixi migration guide by @maresb in #708

Maintenance

• Update Poetry to 2.0.1 by @romain-intel in #637, #678, #685, #769
• Update GHA release workflow to use trusted publishing / OIDC by @maresb in #631, #700
• Replace logger.warn w/ logger.warning by @zklaus in #646
• Fix failing mypy check by @maresb in #648
• Do a strict pkg meta check @ release CD workflow by @webknjaz in #657
• Log the solve command (DEBUG) by @maresb in #662
• Show default values in CLI by @maresb in #661
• Fix vulnerable version of black in test by @maresb in #680
• Update .gitignore for pixi by @maresb in #681
• Split virtual-package repo from LockSpecification by @maresb in #663
• Add vendoring script by @maresb in #682
• Add integration tests by @maresb in #686
• Collect test duration data for various runner configurations by @maresb in #687
• Use a quicker example for the channel-inversion test by @maresb in #688
• Split tests into multiple runners with pytest-split by @maresb in #689
• Simplify pytest GHA workflow by @maresb in #691
• Fix test that fails when cache is deleted by @maresb in #694
• Reduce Ubuntu and MacOS runners from 4 to 3 by @maresb in #696
• Code migrations for Pydantic v2 by @maresb in #692
• Revendor conda by @maresb in #699
• Install conda-lock with pipx in integration tests for better isolation by @maresb in #698
• Refactor to make mapping url explicit and eliminate LookupLoader by @maresb in #703
• Echo bash commands during integration test by @maresb in #711
• Use JSON version of the default PyPI mapping by @maresb in #715
• Improve error message when update fails due to channel conflict by @maresb in #735
• More refactoring of lookup module by @maresb in #738
• Fix deprecation warnings by @maresb in #740
• Fix missing codecov token by @maresb in #745
• Use PAT for PRs when updating lockfile by @maresb in #752
• Channel cleanup by @maresb in #747
• Update miniconda Docker image to use the maintained one. by @jezdez in #755
• Allow to call conda-lock -h (argparse default) instead of conda-lock --help by @basnijholt in #765
• Fix new CI failures by @maresb in #773
• Minor improvements to tests and logging by @maresb in #787
• Generate lockfiles for separate Python versions and test accordingly by @maresb in #789
• Refactor to eliminate code duplication in test by @maresb in #790

New Contributors

• @zklaus made their first contribution in #646
• @peterbygrave made their first contribution in #654
• @webknjaz made their first contribution in #657
• @RSchwan made their first contribution in #776

Full Changelog: v2.5.7...v3.0.0

v2.5.8

What's Changed

Important

This is a backport of a few bugfixes from the v3 release into v2. Most users should instead install conda-lock v3.

• Fix KeyError: 'pkgs_dirs' by @maresb in #733
• Log stderr warnings as warnings by @maresb in #772
• Fix type errors and restrict to mamba<2 by @maresb in #791
• Update GHA release workflow to use trusted publishing / OIDC by @maresb in #631, #700

Full Changelog: v2.5.7...v2.5.8

v2.5.7

This is a bugfix release that fixes a few edge cases. The first issue involves corrupt channel URLs when updating with micromamba. For the second, conda-lock would fail to parse pip lines containing --hash.

What's Changed

Bugfix

• Fix conda-lock --update --micromamba by @maresb in #626
• Add support for pip hash checking by @sfinkens in #629

Maintenance

• Fix mypy precheck failures by @benmoss in #628

New Contributors

• @benmoss made their first contribution in #628
• @sfinkens made their first contribution in #629

Full Changelog: v2.5.6...v2.5.7

v2.5.6

What's Changed

This release fixes a bug where the content hash may not be updated correctly.

Also fixed is a spurious --file argument to the conda-lock install command suggested in the lockfile header.

Bugfix

• Ensure that content hashes are updated for an existing lock file when re-locking by @jeffseif in #618
• Update header cmdlines in generated lockfiles (#518) by @timsnyder in #616

Infrastructure

• Clean up gdal tests by @maresb in #605

New Contributors

• @timsnyder made their first contribution in #616
• @jeffseif made their first contribution in #618

Full Changelog: v2.5.5...v2.5.6

v2.5.5

What's Changed

This is a bugfix so that conda-lock can work in environments where setuptools is not preinstalled.

Bugfix

• Add explicit setuptools dependency by @maresb in #608

Infrastructure

• General infrastructure cleanup by @maresb in #606

Full Changelog: v2.5.4...v2.5.5