chore(deps): update dependency pdm to v2.27.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
pdm (changelog)	2.25.9 → 2.27.0

---

Release Notes

pdm-project/pdm (pdm)

v2.27.0

Compare Source

Breaking Changes

• Update the minimum required Python version to 3.10. (#​3787)

Features & Improvements

• Respect existing values of pyproject.toml when running pdm init or pdm new. (#​3786)
• Move project plugin installations from .pdm-plugins under the project root to an isolated cache directory, and add a fixer to migrate existing plugin directories. (#​3790)
• Remove legacy importlib compatibility wrappers and use standard-library importlib.metadata and importlib.resources APIs directly. (#​3796)

Bug Fixes

• Fix a security issue with the installer to disallow installing to paths outside of the scheme directory. (#​3787)
• Refuse to write project-local config and state files (pdm.toml, .pdm-python, .python-version) when the destination is a symlink, preventing an untrusted repository from clobbering files outside the project root. (#​3788)
• Fix a regression issue that PDM_LOCKFILE env var is not respected. (#​3794)
• Allow configuring the default lock --exclude-newer value with strategy.exclude-newer. (#​3795)

v2.26.9

Compare Source

Features & Improvements

• Support exclude-newer in pyproject.toml in the [tool.pdm.resolution] table (#​3776)

Bug Fixes

• Preserve pylock package markers when refreshing lockfile hashes. (#​3773)

v2.26.8

Compare Source

Features & Improvements

• pdm lock --exclude-newer now accepts relative durations in the format N{d|h|w}, such as 7d, 12h, and 3w, in addition to absolute UTC dates and timestamps. (#​3760)

Bug Fixes

• Fixed pdm add --frozen-lockfile --no-sync to skip dependency resolution and update only pyproject.toml without attempting to write the lockfile. (#​3755)
• Fix [tool.pdm.options] being loaded from the current working directory instead of the target project when -p/--project is used. (#​3756)
• Put make_file_executable into pdm.utils to replace the method of the same name in installer. To fix a breakage introduced by installer v1. (#​3764)
• Fix pdm init <template> overwriting the template's additions to build-system.requires when build-system.build-backend matches the user's selection. (#​3766)
• Fixed PySpecSet merging to handle impossible Python version ranges like >=3.6,<3.4 without crashing on empty or inverted gaps. (#​3767)

Documentation

• The latest documentation version now shows a warning banner explaining that it is kept in sync with the main branch and may not match the features available in the latest released version. (#​3765)

v2.26.7

Compare Source

Features & Improvements

• Speed up dependency resolution when there are complex conflicts. (#​3751)

Documentation

• Switch to Zensical as docs generator. (#​3752)

Miscellany

• Add comprehensive tests for completion, show, search, and info commands to improve test coverage (#​3541)

v2.26.6

Compare Source

Bug Fixes

• Support packaging==26.0 changes for version comparison (#​3729)

v2.26.5

Compare Source

Bug Fixes

• Respect the project path when using cookiecutter template in pdm init command. (#​3721)
• Fix a bug that resolution.excludes is not applied when evaluating candidates from the lock file. (#​3726)

Documentation

• Remove chatbot from the docs page footer. (#​3722)
• Generate llms.txt for docs powered by mkdocs-llmstxt. (#​3723)

v2.26.4

Compare Source

Bug Fixes

• Make sure cursor closing for fixing PyPy different gc mode also add PyPy in CI. (#​3708)
• Fix a bug that old HTTP cache directories cause PDM to crash when trying to clear them. (#​3715)

v2.26.3

Compare Source

Features & Improvements

• Port to hishel 1.0.0. (#​3700)

Bug Fixes

• Update .gitignore file in the default template. (#​3686)
• Correct the sysconfig variables for Python standalone build installations. (#​3693)
• Ignore packages.vcs.requested-revision if it's None when formatting pylock.toml. (#​3694)
• Fix test failures with uv test cases using non-venv Python interpreters. (#​3698)

v2.26.2

Compare Source

Features & Improvements

• Only parse TOML document with tomlkit when writing is required. (#​3672)
• Add SHA256 checksums for binary releases during the release workflow and create an installer script that downloads binaries from GitHub releases with automatic platform detection and checksum verification. (#​3679)

Bug Fixes

• Fix test_use_python_write_file_multiple_versions to match PDM's actual behavior. (#​3660)
• Correctly calculate the venv path for UV_PROJECT_ENVIRONMENT env var when using uv mode. (#​3675)
• Ensure implementation.gil_disabled is a boolean in get_current_env_spec. This fix an issue that free-threaded wheels get rejected incorrectly. (#​3677)
• Fix CLI help formatting on Python 3.14+. (#​3683)
• Make PdmBasicAuth a cached_property to accelerate execution. (#​3684)

Removals and Deprecations

• Add deprecation warning for pdm search command as PyPI no longer supports search API. (#​3674)

Miscellany

• Add tests to utils.fs_supports_link_method and utils.convert_to_datetime. (#​3541)

v2.26.1

Compare Source

Bug Fixes

• Substitute missing env vars with empty string in expand_env_vars. (#​3653)
• Constrained hishel to be less than 1.0.0 due to its refactor (#​3657)

v2.26.0

Compare Source

Features & Improvements

• Limit the log file size to 100MB and truncate the log output if exceeded. (#​3633)
• Speed up dependency resolution in the bad path by skipping candidates of the same version when resolving. (#​3647)

Bug Fixes

• Reload project files after running hook scripts. (#​3615)
• Fix a bug when using UV as the resolver does not respect the venv.location configuration. (#​3616)
• Fix publish --skip-existing for Nexus Repository OSS >= 3.70 (#​3617)
• Fix a resolution failure when both prerelease and non-prerelease requirements exist. (#​3634)
• Ignore invalid python requirement during locking. (#​3635)
• Isolate PDM loggers with the root logger to avoid log leakage. (#​3637)
• Fix a crash when resolving URL dependencies under use_uv=true. (#​3640)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "after 2am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.