pex

This release adds support for the Python 3.15 series early. Pex runs on 3.15.0a1, can produce scies for 3.15.0a1, etc.

• Officially begin supporting Python 3.15. (#2952)

This release fixes a regression in the Pex 2.60.0 release when installing wheels with *.data/{purelib,platlib} entries.

• Fix handling of whl *.data/ dirs. (#2946)

This release fixes a backwards compatiility break in 2.60.0 where modern pex-tools would fail to work on PEXes built with Pex prior to 2.60.

• Fix installed wheel re-installation for old PEXes. (#2943)

This release adds support for --no-pre-install-wheels to both the --pex-repository and --venv-repository resolvers, meaning all forms of Pex resolution (including Pip, --lock, --pylock and --pre-resolved-dists) now support this option.

In addition, adding this support improved the fidelity of pex-tools repository extract such that extracted wheels are bytewise identical to the original wheel the PEX was built with. This fidelity also extends to wheels extracted from --pex-repository PEXes and wheels extracted from venvs created from PEXes.

• Implement .whl packing from chroots and venvs. (#2925)

This release optimizes --venv-repository installed wheel caching to only store one copy per unique wheel even when that wheel is resolved from multiple --venv-repositorys.

This release also updates vendored Pip's vendored certifi's cacert.pem to that from certifi 2025.10.5.

• Do not hash installed scripts from --venv-repository. (#2935)
• Update vendored Pip's CA cert bundle. (#2934)

This release fixes a bug in --venv-repository resolution that would lead to resolution failure when the same wheel (that has console script entry points) is installed in multiple venvs and those venvs are used as --venv-repository resolve sources.

• Fix --venv-repository wheel cache copy-pasta bug. (#2932)

This release fixes --venv-repository to work with venvs that have installed wheels with non-conformant WHEEL metadata. Notably, from wheels built with maturin that have a compressed tag set; e.g.: hf-xet-1.1.10-cp37-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl.

• Stabilize non-conformant WHEEL Tag metadata. (#2927)

This release fixes two bugs handling split universal resolves. Previously, when a universal resolve was split by markers other than python_version and python_full_version and no interpreter constraints were specified, locking would fail. Additionally, when a split lock had differing transitive dependencies in splits, lock sub-setting would fail. Both issues are now corrected.

• Fix split universal lock corner cases. (#2922)

This release fixes a regression in VCS URL handling introduced by Pex 2.38.0 when VCS URLs included user info in the authority.

• Fix pex3 lock create/export for VCS URLs with userinfo (#2918)

This release adds support for a --venv-repository resolution source. This allows creating a PEX from a pre-existing venv. By default, all installed venv distributions are included in the PEX, but by specifying requirements, the venv can be subset. The --venv-repository source is also supported by pex3 venv create allowing subsetting an existing venv directly into a new venv as well.

• Add support for --venv-repository resolver. (#2916)

This release fixes a bug building source distributions from locks of local project directories when the local project uses the uv_build backend.

• Fix sdist build of local projects using uv_build. (#2914)

This release adds --derive-sources-from-requirements-files to allow for scoping requirement sources via the structure of requirements files. If any requirements files are specified that contain -f / --find-links, -i / --index-url, or --extra-index-url options, --derive-sources-from-requirements-files will automatically map these repos as the --source for the requirements (if any) declared in the same requirements file.

• Introduce --derive-sources-from-requirements-files. (#2909)

This release adds support for project name regexes to --source scopes for repos. For example, the PyTorch example given in the 2.56.0 release notes can now be shortened to:

pex3 lock create \
    --style universal \
    --target-system linux \
    --target-system mac \
    --elide-unused-requires-dist \
    --interpreter-constraint "CPython==3.13.*" \
    --index pytorch=https://download.pytorch.org/whl/cu129 \
    --source "pytorch=^torch(vision)?$; sys_platform != 'darwin'" \
    --source "pytorch=^nvidia-.*; sys_platform != 'darwin'" \
    --indent 2 \
    -o lock.json \
    torch \
    torchvision

• Support regexes for --source project matching. (#2906)

This release adds support for scoping --index and --find-links repos to only be used to resolve certain projects, environments or a combination of the two. For example, to use the piwheels index but restrict its use to resolves targeting armv7l machines, you can now say: --index piwheels=https://www.piwheels.org/simple --source piwheels=platform_machine == 'armv7l'. See the --help output for --index and --find-links for more syntax details.

Additionally, --style universal locks have been made aware of top-level inputs that can split the lock resolve and such resolves are pre-split and performed in parallel to allow locking for multiple non-overlapping universes at once. Splits can be caused by some scoped repos setups as well locks with multiple differing top-level requirements for the same project. For example, the following will create a universal lock with two locked resolves, one locking cowsay 5.0 for Python 2 and one locking cowsay 6.0 for Python 3:

pex3 lock create \
  --style universal \
  --indent 2 \
  -o lock.json
  "cowsay<6; python_version < '3'" \
  "cowsay==6; python_version >= '3'"

An important use case for this new set of features is creating a universal lock for PyTorch for CUDA enabled Linux and Mac by adding the appropriate pytorch index appropriately scoped. For example, this lock will contain two locked resolves, one for Mac sourced purely from PyPI and one for CUDA 12.9 enabled Linux partially sourced from the PyTorch index for CUDA 12.9:

pex3 lock create \
    --style universal \
    --target-system linux \
    --target-system mac \
    --elide-unused-requires-dist \
    --interpreter-constraint "CPython==3.13.*" \
    --index pytorch=https://download.pytorch.org/whl/cu129 \
    --source "pytorch=torch; sys_platform != 'darwin'" \
    --source "pytorch=torchvision; sys_platform != 'darwin'" \
    --source "pytorch=nvidia-cublas-cu12; sys_platform != 'darwin'" \
    --source "pytorch=nvidia-cuda-cupti-cu12; sys_platform != 'darwin'" \
    --source "pytorch=nvidia-cuda-nvrtc-cu12; sys_platform != 'darwin'" \
    --source "pytorch=nvidia-cuda-runtime-cu12; sys_platform != 'darwin'" \
    --source "pytorch=nvidia-cudnn-cu11; sys_platform != 'darwin'" \
    --source "pytorch=nvidia-cudnn-cu12; sys_platform != 'darwin'" \
    --source "pytorch=nvidia-cufft-cu12; sys_platform != 'darwin'" \
    --source "pytorch=nvidia-cufile-cu12; sys_platform != 'darwin'" \
    --source "pytorch=nvidia-curand-cu12; sys_platform != 'darwin'" \
    --source "pytorch=nvidia-cusolver-cu12; sys_platform != 'darwin'" \
    --source "pytorch=nvidia-cusparse-cu12; sys_platform != 'darwin'" \
    --source "pytorch=nvidia-cusparselt-cu12; sys_platform != 'darwin'" \
    --source "pytorch=nvidia-nccl-cu12; sys_platform != 'darwin'" \
    --source "pytorch=nvidia-nvjitlink-cu12; sys_platform != 'darwin'" \
    --source "pytorch=nvidia-nvtx-cu12; sys_platform != 'darwin'" \
    --indent 2 \
    -o lock.json \
    torch \
    torchvision

• Support scopes for --index and --find-links. (#2903)

This release improves Pex --pylock handling interoperability by accepting the minimum possible dependency information likely to be provided; namely, the dependency name.

• More robust pylock.toml dependency handling. (#2901)

This release fixes a bug present since the inception of pex3 lock create --style universal support. Previously, if the universal lock was created with --interpreter-constraints, the Python implementation information was discarded; so, for example, even with --interpreter-constraint CPython==3.13.*, the lock resolve would consider PyPy in-play.

• Respect --interpreter-constraint impl in locks. (#2898)

This release adds support for --override <project name>=<requirement> wherever --override <requirement> is currently accepted. This can be useful when you need to supply a patch to an existing published project and would prefer to depend on wheels you pre-build instead of using a VCS source dependency --override, which can be slow to build.

• Support dependency replacement with --override. (#2894)

This release fixes pex3 lock create when multiple --index are configured and they provide the same wheel file name, but with different contents. This is a reality in the PyTorch ecosystem, for example, prior to any fixes the WheelNext project may bring.

• Fix pex3 lock create for dup wheels with different hashes. (#2890)

This release fixes --pylock handling to tolerate locked packages with no artifacts and just warn (if PEX warnings are enabled) that the package is being skipped for lack of artifacts.

• Handle pylock.toml packages with no artifacts. (#2888)

This release adds a Pex PEX scie for riscv64.

• Add a Pex PEX scie for riscv64. (#2883)

This release adds support to pex3 run for --with-requirements to complement --with for specifying additional run requirements via a requirements file. In addition, --constraints can now be specified to constrain versions with a constraints file.

• Support -r & --constraints in pex3 run. (#2879)

This release fixes some cases of creating PEXes from a --pylock when no requirements are specified.

• Fix --pylock with no reqs roots calculation. (#2878)

This release adds pex3 run --locked {auto,require} support for both local and remote scripts. In either case a sibling pylock.<script name>.toml and then a sibling pylock.toml are searched for and, if found, are subsetted with PEP-723 script requirements or explicit --with or --from requirements if present.

• Support sibling script locks in pex3 run. (#2870)

This release fixes a bug in Pex's HTTP server used for serving pex --docs and pex3 docs when running on Python 2.7.

Also, pylock.toml subsets are now fixed to fully honor subset requirement specifiers and markers.

• Fix HTTP Server for Python 2.7. (#2871)
• Fix pylock.toml subsetting. (#2872)

This release augments pex3 run with the ability to run both local and remote scripts as well as augmenting the run environment with additional requirements specified via --with.

• Support running both local & remote scripts. (#2861)

This release fixes a bug introduced by #2828 that would assign PEX scies a SCIE_BASE of the current user's PEX_ROOT at PEX scie build time. PEX scies now only get a custom SCIE_BASE when --scie-base or --runtime-pex-root are specified when building the PEX scie.

• Fix PEX scie --runtime-pex-root handling. (#2866)

This release fixes handling of cycles both when exporting Pex lock files to PEP-751 pylock.toml format as well as when creating PEXes from --pylock locks with cycles. This should complete the cycle-handling fix work started in #2835 by @pimdh.

• Fix pylock.toml cycle handling. (#2863)

This release fixes creating --scie {eager,lazy} PEX scies when no specific --scie-pbs-release is specified by upgrading to science 0.12.9.

Pex's vendored Pip's vendored certifi's cacert.pem is also updated to that from certifi 2025.8.3 (Good luck parsing that!).

• Update vendored Pip's CA cert bundle. (#2857)
• Fix CPython scies with no --scie-pbs-release. (#2859)

This release fixes pex3 run handling of local project directory requirements. For example, you can now pex3 run . -V in the Pex project directory successfully.

• Fix pex3 run for local projects. (#2854)

This release introduces the pex.build_backend.wrap build backend useable for embedding console script locks in your project distributions for use by tools like pex3 run (see: #2841). Pex dogfoods this backend to embed its own console script lock for its extras.

• Introduce pex.build_backend.wrap build backend. (#2850)

This release adds support for --pip-version 25.2

• Add support for --pip-version 25.2. (#2849)

This release brings a fix for Pex entry-point parsing. Previously, entry-points specifying an extra like blackd = blackd:patched_main [d] would be parsed as having the extra as part of the module or object reference leading to errors when executing the entry point.

• Fix Pex entry-point parsing. (#2846)

This release fixes the failure mode of pex3 run --locked require. Previously, subsequent runs with --locked auto would not fall back to using no lock, but instead error with a malformed venv from the failed run prior.

• Fix pex3 run --locked require failure mode. (#2843)

This release adds support for pex3 run akin to pipx run and uvx. By default, pex3 run <tool> will look for an embedded [PEP-751 pylock.toml][PEP-751] in the wheel or sdist <tool> is resolved from and, if found, use that lock to create the tool venv from. More information is available in the pex3 run --help output for the --locked option. See the thread here for the embedded lock idea and ongoing discussion: https://discuss.python.org/t/pre-pep-add-ability-to-install-a-package-with-reproducible-dependencies

• Add pex3 run. (#2841)

Support for Python PI. Pex started testing against Python 3.14 on October 26th, 2024 and now officially advertises support with the 3.14.0rc1 release candidate just published.

• Support Python PI. (#2838)

This release brings a fix from @pimdh for --pylock handling that allows Pex to work with pylock.toml locks containing dependency cycles.

• Handle cyclic dependencies in pylock.toml (#2835)

This release updates vendored Pip's vendored certifi's cacert.pem to that from certifi 2025.7.14 and fixes the default scie base when --runtime-pex-root is used to be a pex3 cache managed directory.

• Update vendored Pip's CA cert bundle. (#2831)
• Re-organize default --runtime-pex-root scie base. (#2830)

This release follows up on 2.45.3 to ensure --venv PEXes also participate in temporary PEX_ROOT cleanup. Previously these leaked the temporary PEX_ROOT.

• Fix --venv PEXes to clean fallback PEX_ROOT. (#2826)

This release adds support for setting a custom --scie-base when building PEX scies. The default scie base is the same as used by the scie-jump natively; e.g. ~/.cache/nce on Linux. When specifying a custom --runtime-pex-root, the scie base now will live under it in the scie-base directory. To specify a custom scie base, --scie-base can be used, and it will trump all these defaults.

• Add --scie-base to control the PEX scie cache dir. (#2828)

This release fixes a bug introduced in 2.45.2 by #2820 that would cause a temporary PEX_ROOT ( these are created when the default PEX_ROOT directory is not writeable) to be cleaned up too early, leading to PEX boot failures.

• Do not clean fallback PEX_ROOT prematurely. (#2823)

This release fixes a long-standing temporary directory resource leak when running PEXes built with --no-pre-install-wheels.

• Fix temp dir leak on boot of --no-pre-install-wheels PEX. (#2820)

This release updates vendored Pip's vendored certifi's cacert.pem to that from certifi 2025.7.9.

• Update vendored Pip's CA cert bundle. (#2816)

This release adds support for --scie-assets-base-url if you've used science download ... to set up a local repository for ptex, scie-jump and science interpreter providers.

This release also fixes PEX scie creation to use either of --proxy or --cert if set when building scies. Previously, these options were only honored when downloading the science binary itself but not when running it subsequently to build scies.

Finally, PEX scies built on Windows for Linux or Mac now should work more often. That said, Windows is still not officially supported!

• Add --scie-assets-base-url & honor --{proxy,cert}. (#2811)

This release expands PEX scie support on Windows to more cases by changing how the PEX_ROOT is handled for PEX scies on all operating systems. Previously, the PEX_ROOT was constrained to be in a special location inside the scie nce cache direcgtory structure. Now PEX scies install their PEXes inside the normal system PEX_ROOT like other PEXes do. This leads to shorted PEX cache paths that work on more Windows systems in particular.

All that said, Windows is still not officially supported!

• Let PEX scies install PEXes in the PEX_ROOT. (#2807)

This release fixes PEP-723 script metadata parsing handling of the file encoding of the script.

• Fix PEP-723 script parsing file encoding handling. (#2806)

This release adds support for pex3 wheel [--lock|--pylock] [requirements args] .... This allows resolving and building wheels that satisfy a resolve directly or through a lock. Foreign targets via --platform and --complete-platform are supported as well as sub-setting when a lock is used. This compliments pex3 download introduced in Pex 2.41.0.

• Add pex3 wheel for resolving & building wheels. (#2803)

This release is a follow-up to 2.42.1 that again attempts a fix for missing License-Expression METADATA in Pex distributions.

• Really fix License-Expression METADATA field. (#2800)

This release just fixes missing License-Expression METADATA in Pex distributions.

• Fix missing License-Expression METADATA field. (#2798)

This release expands --platform support to Windows. Windows is still not officially supported though!

• Add --platform support for Windows. (#2794)

This release fixes pex3 download to require a -d / --dest-dir be set.

• Require --dest-dir is set for pex3 download. (#2793)

This release adds support for pex3 download [--lock|--pylock] [requirements args] .... This allows downloading distributions that satisfy a resolve directly or through a lock. Foreign targets via --platform and --complete-platform are supported as well as sub-setting when a lock is used.

• Add pex3 download. (#2791)

This release updates vendored Pip's vendored certifi's cacert.pem to that from certifi 2025.6.15.

• Update vendored Pip's CA cert bundle. (#2787)

This relase fixes Pex to work in more scenarios on Windows. Windows is still not officially supported though!

• Fix some Windows cross-drive issues. (#2781)

This release fixes pex --pylock for locked sdist and wheel artifacts whose locked URL path basename does not match the optional sdist or wheel name field when present. Notably, this fixes interop with uv which appears to use the name field to store the normalized name of the wheel when the wheel name is not normalized already in the index URL basename.

• Fix --pylock handling of sdist and wheel name. (#2775)

This release fills out --pylock support with --pylock-extra and --pylock-group to have Pex resolve extras and dependency groups defined for a PEP-751 lock. This support only works when Pex is run under Python 3.8 or newer.

• Support PEP-751 extras and dependency groups. (#2770)

This release adds support for pex --pylock and pex3 venv create --pylock for building PEXes and venvs from [pylock.toml][PEP-751] locks. In both cases PEX supports subsetting the lock if it provides dependencies metadata for its locked packages, but this metadata is optional in the spec; so your mileage may vary. If the metadata is not available and was required, Pex will let you know with an appropriate error post-resolve and pre-building the final PEX or venv.

• Add support for pex --pylock. (#2766)

This release fixes a long-standing bug parsing requirements files that included other requirements files.

• Fix requirement file includes relative path handling. (#2764)

This release adds support for pex3 lock export --format pep-751 to export Pex locks in the new pylock.toml format. pex3 lock export-subset also supports pylock.toml and both forms of export respect universal locks, leveraging the optional marker package field to make packages installable or not based on the environment the exported lock is used to install in.

This release does not include support for building PEXes using PEP-751 locks. Add your concrete use case to #2756 if you have one.

• Add pex3 lock export --format pep-751 support. (#2760)