[dependabot]

Bumps pixi from v0.82.0 to v0.83.0.

Release notes

Sourced from pixi's releases.

v0.83.0

[0.83.0] - 2026-10-22

✨ Highlights

Soon channels will be able to register virtual package detectors. These detectors allow to introduce virtual packages that Pixi doesn't know about. This Pixi release introduces support for virtual package detectors.

It also fixes an increase in memory usage that 0.82.1 introduced.

Features

• Ask before running detectors and show them in pixi info by @​Hofer-Julian in #7129

Fixes

• run: Only detect the target environment's host up front by @​Hofer-Julian in #7339

Documentation

• Add tombi integration page by @​pavelzw in #7338

v0.82.1

[0.82.1] - 2026-10-20

🔒 Security 🔒

This patch release contains security fixes for the incident described at https://emudhra.we-have-a-problem.com/. All users are encouraged to upgrade to this version immediately.

The affected webpki-root-certs and rustls-webpki dependencies have been bumped to patched releases 1.0.10 and 0.103.16 respectively.

Features

• pixi-build-r: Add CMake and pkg-config when SystemRequirements asks for them by @​roaldarbol in #7256
• spec: Support exemptions in the resolved exclude-newer config by @​pavelzw in #7250
• manifest: Read exemptions from exclude-newer in [workspace] by @​pavelzw in #7246
• Pass arbitrary virtual packages to the solver by @​Hofer-Julian in #7125
• Configure virtual package detectors and write shared config by @​Hofer-Julian in #7127
• Run channel-registered detectors during host detection by @​Hofer-Julian in #7128

Fixes

• config: Reject relative detached-environments paths by @​lucascolley in #7221
• cli: Render colours in log messages instead of escape codes by @​lucascolley in #7295

... (truncated)

Changelog

Sourced from pixi's changelog.

[0.83.0] - 2026-10-22

✨ Highlights

Soon channels will be able to register virtual package detectors. These detectors allow to introduce virtual packages that Pixi doesn't know about. This Pixi release introduces support for virtual package detectors.

It also fixes an increase in memory usage that 0.82.1 introduced.

Features

• Ask before running detectors and show them in pixi info by @​Hofer-Julian in #7129

Fixes

• run: Only detect the target environment's host up front by @​Hofer-Julian in #7339

Documentation

• Add tombi integration page by @​pavelzw in #7338

[0.82.1] - 2026-10-20

🔒 Security 🔒

This patch release contains security fixes for the incident described at https://emudhra.we-have-a-problem.com/. All users are encouraged to upgrade to this version immediately.

The affected webpki-root-certs and rustls-webpki dependencies have been bumped to patched releases 1.0.10 and 0.103.16 respectively.

Features

• pixi-build-r: Add CMake and pkg-config when SystemRequirements asks for them by @​roaldarbol in #7256
• spec: Support exemptions in the resolved exclude-newer config by @​pavelzw in #7250
• manifest: Read exemptions from exclude-newer in [workspace] by @​pavelzw in #7246
• Pass arbitrary virtual packages to the solver by @​Hofer-Julian in #7125
• Configure virtual package detectors and write shared config by @​Hofer-Julian in #7127
• Run channel-registered detectors during host detection by @​Hofer-Julian in #7128

Fixes

• config: Reject relative detached-environments paths by @​lucascolley in #7221
• cli: Render colours in log messages instead of escape codes by @​lucascolley in #7295

... (truncated)

Commits

• 0e967d3 chore: bump version to v0.83.0 (#7341)
• 18d41cf fix(run): only detect the target environment's host up front (#7339)
• 8e2c472 docs: add tombi integration page (#7338)
• b71aebc feat: ask before running detectors and show them in pixi info (#7129)
• d384d7a chore(release): bump version to v0.82.1 (#7328)
• 602ab76 chore(ci): Update Rust crate tokio to v1.53.3 (#7327)
• 1e08f65 fix: bump webpki-root-certs and rustls-webpki for eMudhra intermediate compro...
• a9665aa feat: run channel-registered detectors during host detection (#7128)
• 1539085 chore(ci): Update Rust crate zip to v9 (#7324)
• 6cafd2e feat: configure virtual package detectors and write shared config (#7127)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)