[dependabot]

Bumps pipenv from 2026.10.6 to 2026.11.0.

Release notes

Sourced from pipenv's releases.

Release v2026.11.0

🤖 AI-Generated Changelog

Added

• Added a new uv resolver backend as an alternative to the default pip-based resolver, providing faster dependency resolution

Changed

• Vendored pip 26.3 with rebased Pipenv patches

Fixed

• Fixed suppression of Safety warnings in quiet mode during pipenv scan, preserving stderr output appropriately
• Fixed VCS entries losing their environment markers when using --no-lock
• Fixed latent bugs identified by CodeQL code quality analysis

---

🔗 Full Changelog: pypa/pipenv@v2026.10.6...v2026.11.0

Changelog

Sourced from pipenv's changelog.

2026.11.0 (2026-11-08)

pipenv 2026.11.0 (2026-11-08)

Features & Improvements

• Add a uv resolver backend. pipenv lock --backend uv, PIPENV_RESOLVER=uv or resolver_backend = "uv" in the [pipenv] section of the Pipfile resolves dependencies with uv <https://docs.astral.sh/uv/>_ (which must be on $PATH) while keeping pipenv's index restriction, hashes and markers. See the new "Resolver Backends" documentation page. [#6109](https://github.com/pypa/pipenv/issues/6109) <https://github.com/pypa/pipenv/issues/6109>_

Bug Fixes

• Fixed latent crashes in RequirementError when no requirement is given and in Lockfile.from_data when the project directory is missing, and removed a stray !s from the UninstallError message. [#6781](https://github.com/pypa/pipenv/issues/6781) <https://github.com/pypa/pipenv/issues/6781>_
• Fixed pipenv requirements --no-lock dropping the environment markers of VCS entries. [#6782](https://github.com/pypa/pipenv/issues/6782) <https://github.com/pypa/pipenv/issues/6782>_
• Preserve Safety's error output when running pipenv --quiet check --scan if the scan fails, while keeping successful quiet scans free of stderr warnings. #quiet-scan-stderr <https://github.com/pypa/pipenv/issues/quiet-scan-stderr>_

Vendored Libraries

• Updated the bundled pip to 26.3 and rebased Pipenv's patches for tarfile safety, prerelease handling, command startup, and the distutils fallback. [#6780](https://github.com/pypa/pipenv/issues/6780) <https://github.com/pypa/pipenv/issues/6780>_

Commits

• 3c34948 Release v2026.11.0
• 8686678 Bumped version to 2026.11.0.
• ec9b914 Merge pull request #6773 from matteius/feat/uv-resolver-backend-6109
• afe9aaf Merge pull request #6783 from pcbeingused333/fix/scan-quiet-stderr
• 8564457 fix(scan): suppress Safety warnings on quiet success
• 831d0a5 fix(scan): preserve Safety stderr in quiet mode
• ce84086 Merge pull request #6782 from pcbeingused333/fix-c1828
• 12c2d5f fix(requirements): keep markers on VCS entries with --no-lock
• d2eefa5 Merge pull request #6781 from matteius/codeql-quality-fixes
• 824e517 Add news fragment for PR 6781
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)