[dependabot]

Bumps pdm from 2.29.3 to 2.29.4.

Release notes

Sourced from pdm's releases.

v2.29.4

Features & Improvements

• Allow specifying lock.format in pyproject.toml via the [tool.pdm.lock] table. (#3958)

Bug Fixes

• Import a requirements file that starts with a UTF-8 BOM, which failed with a RequirementError. (#3937)
• Treat a Pipfile version without an operator, such as requests = "2.31.0", as an exact == pin when importing, like pipenv does, instead of failing with an invalid specifier error. (#3939)
• Preserve Poetry include entries targeting both source and wheel distributions when importing a project. (#3941)
• Preserve version and description when importing Flit projects with a src/ layout or an annotated __version__. (#3942)
• Require certifi>=2026.10.19, which removes the emSign ECC Root CA - G3 root whose eMudhra intermediates had their private keys compromised. (#3944)
• pdm outdated no longer lists a package whose installed version is newer than the latest one found on the index, such as an installed pre-release or local build. (#3945)
• Fix pdm lock --check reporting an outdated lockfile when a group is declared in both [dependency-groups] and [tool.pdm.dev-dependencies]. (#3947)
• Show the license from License-Expression (PEP 639) in pdm show and pdm list --fields licenses. (#3948)
• Stop pdm lock from excluding packages from a lock target when another target shares its OS and architecture, e.g. manylinux and musllinux. (#3950)
• Fix a crash when a python_version marker compares against a wildcard version such as python_version == "3.*". (#3951)
• Send License-Expression and License-File with the upload in pdm publish, so PyPI shows the license of PEP 639 packages. (#3952)
• Preserve the subdirectory fragment in source archive requirements when resolving dependencies and serializing requirement URLs. (#3954)
• Preserve archive hashes when reading pylock.toml so they remain available for exports. (#3956)
• Fix detection of responses served from the HTTP cache, so cached downloads and index pages are reported as cached again. (#3961)

Dependencies

• Install the download dependencies of pbs-installer so Python installation works with its latest releases. (#3959)
• Upgrade unearth to >=0.19 and migrate the HTTP client from httpx to httpx2. pdm.models.session.PDMPyPIClient and the transports in pdm.pytest are now built on httpx2, so plugins interacting with them should import httpx2 instead of httpx. (#3962)

Changelog

Sourced from pdm's changelog.

Release v2.29.4 (2026-10-27)

Features & Improvements

• Allow specifying lock.format in pyproject.toml via the [tool.pdm.lock] table. (#3958)

Bug Fixes

• Import a requirements file that starts with a UTF-8 BOM, which failed with a RequirementError. (#3937)
• Treat a Pipfile version without an operator, such as requests = "2.31.0", as an exact == pin when importing, like pipenv does, instead of failing with an invalid specifier error. (#3939)
• Preserve Poetry include entries targeting both source and wheel distributions when importing a project. (#3941)
• Preserve version and description when importing Flit projects with a src/ layout or an annotated __version__. (#3942)
• Require certifi>=2026.10.19, which removes the emSign ECC Root CA - G3 root whose eMudhra intermediates had their private keys compromised. (#3944)
• pdm outdated no longer lists a package whose installed version is newer than the latest one found on the index, such as an installed pre-release or local build. (#3945)
• Fix pdm lock --check reporting an outdated lockfile when a group is declared in both [dependency-groups] and [tool.pdm.dev-dependencies]. (#3947)
• Show the license from License-Expression (PEP 639) in pdm show and pdm list --fields licenses. (#3948)
• Stop pdm lock from excluding packages from a lock target when another target shares its OS and architecture, e.g. manylinux and musllinux. (#3950)
• Fix a crash when a python_version marker compares against a wildcard version such as python_version == "3.*". (#3951)
• Send License-Expression and License-File with the upload in pdm publish, so PyPI shows the license of PEP 639 packages. (#3952)
• Preserve the subdirectory fragment in source archive requirements when resolving dependencies and serializing requirement URLs. (#3954)
• Preserve archive hashes when reading pylock.toml so they remain available for exports. (#3956)
• Fix detection of responses served from the HTTP cache, so cached downloads and index pages are reported as cached again. (#3961)

Dependencies

• Install the download dependencies of pbs-installer so Python installation works with its latest releases. (#3959)
• Upgrade unearth to >=0.19 and migrate the HTTP client from httpx to httpx2. pdm.models.session.PDMPyPIClient and the transports in pdm.pytest are now built on httpx2, so plugins interacting with them should import httpx2 instead of httpx. (#3962)

Commits

• c50dcbc chore: Release 2.29.4
• d40ca7b chore: add PR ids to news fragments
• 49e8058 fix: detect responses served from the HTTP cache (#3961)
• a2a6f4f chore: upgrade unearth to 0.19 and migrate from httpx to httpx2 (#3962)
• 4c2ceb9 feat: enable setting lockfile format in pyproject.toml (#3958)
• 228e560 fix: install pbs-installer download dependencies (#3960)
• 13ce941 fix(lock): don't exclude packages from lock targets sharing the platform (#3950)
• adfdb5d fix: preserve archive hashes when reading pylock.toml (#3956)
• 3b82f52 fix: add bugfix entries to preserve Poetry include entries and subdirectory f...
• 301ca8c fix(markers): handle wildcard versions in python_version markers (#3951)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)