chore(deps): update dependency pex to v2.90.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
pex (changelog)	2.69.1 → 2.90.1

---

Release Notes

pex-tool/pex (pex)

v2.90.1

Compare Source

This release fixes a Pex caching bug when creating --layout packed PEXes and alternating between
the default (--compress) and --no-compress. Previously this could lead errors building the
packed PEX which necessitated clearing the PEX cache.

• Fix --layout packed bootstrap and wheel caches. (#​3106)

v2.90.0

Compare Source

This release adds support for wrapping PEP-660 build_editable to pex_build.setuptools.build
plugins and dogfoods this.

• Support wrapping build_editable in wrap. (#​3105)

v2.89.1

Compare Source

This release adds better diagnostics for certain Pex filesystem interaction errors.

• Add safe_copy failure diagnostic message. (#​3103)

v2.89.0

Compare Source

This release exports the path of the installed .desktop file as the DESKTOP_FILE environment
variable for commands in --scie-icon and --scie-desktop-file PEX scies. The DESKTOP_FILE
path may not exist, but if it does it can be used to implement desktop application uninstallation
in the PEX scie application code.

• Export DESKTOP_FILE for PEX scie .desktop apps. (#​3100)

v2.88.1

Compare Source

This release fixes .desktop files installed by --scie-icon and --scie-desktop-file PEX scies
to be more robust. They now work even if the original PEX scie they were installed by is (re)moved
as well as properly handling a SCIE_BASE with spaces in the path.

• Fix .desktop files installed by PEX scies. (#​3099)

v2.88.0

Compare Source

This release adds support for --pip-version 26.0.1.

• Add support for --pip-version 26.0.1. (#​3098)

v2.87.0

Compare Source

This release adds support for --pip-version 26.0.

• Add support for --pip-version 26.0. (#​3091)

v2.86.1

Compare Source

This release fixes a bug in constraints file requirement parsing. Previously, Pex tried to validate
constraints beyond its own needs, anticipating Pip's needs, leading to a failure to handle direct
reference URL requirements, including VCS requirements.

• Fix constraints file parsing for URL requirements. (#​3090)

v2.86.0

Compare Source

This release adds support for Linux PEX scies installing themselves with a desktop entry on first
run. This is enabled via either of --scie-icon or --scie-desktop-file. By default, the end-user
is prompted to approve a desktop install but this can be bypassed at build time with
--no-scie-prompt-desktop-install or at runtime using the PEX_DESKTOP_INSTALL environment
variable.

• Add PEX scie Linux .desktop install support. (#​3087)

v2.85.3

Compare Source

This release upgrades vendored `packaginged for Python>=3.8 to the latest release; bringing some bug
fixes and performance improvements.

• Upgrade vendored packaging to 26.0 for Python>=3.8. (#​3083)

v2.85.2

Compare Source

This release makes running a PEX using venv-execution and sh-bootstrapping (that is, build with
--sh-boot --venv) more likely to behave identically with a cold or warm PEX_ROOT cache. This
includes running with PEX_PYTHON=..., PEX_PYTHON_PATH=..., PEX_PATH=..., PEX_VENV=... and
PEX_IGNORE_RCFILES=....

• Avoid fast-path in --sh-boot script for more variables. (#​2729)

v2.85.1

Compare Source

This release upgrades the floor of science to 0.17.2 to pick up better handling for CPython 3.9
which was dropped in new [PBS][PBS] releases at the end of 2025.

• Upgrade science to 0.17.2 (#​3081)

v2.85.0

Compare Source

This release introduces a new --interpreter-selection-strategy option for use when building PEXes
that use --interpreter-constraints. When multiple interpreters satisfy the specified
--interpreter-constraints, the --interpreter-selection-strategy allows you to direct Pex to
select the oldest (the default and the existing behavior) or the newest. In either case, the
highest available patch version will be selected from amongst multiple interpeters with the same
major and minor versions.

• Support an --interpreter-selection-strategy option. (#​3080)

v2.84.0

Compare Source

This release causes pex ... to emit the output path of the generated PEX (and / or scies) on
STDOUT. If --seed verbose is set, then the output path of the PEX is included in the new
"seeded_from" field.

• Emit PEX output path to stdout. (#​3079)

v2.83.0

Compare Source

This release adds support for templating {platform} in PEX file names. When this substitution
token is found, it is replaced with the most specific platform tag(s) of wheels in the PEX. For
example:

:; python -mpex ansicolors -o "ansicolors-{platform}.pex"

:; ./ansicolors-py2.py3-none-any.pex
Pex 2.83.0 hermetic environment with 1 requirement and 1 activated distribution.
Python 3.14.2 (main, Dec  5 2025, 14:39:48) [GCC 15.2.0] on linux
Type "help", "pex", "copyright", "credits" or "license" for more information.
>>> pex()
Running from PEX file: ./ansicolors-py2.py3-none-any.pex
Requirements:
  ansicolors
Activated Distributions:
  ansicolors-1.1.8-py2.py3-none-any.whl
>>>

:; python -mpex \
    --complete-platform package/complete-platforms/linux-x86_64.json \
    --complete-platform package/complete-platforms/macos-aarch64.json ansible \
    -o "ansible-{platform}.pex"

:; ./ansible-cp314-cp314-macosx_11_0_arm64.manylinux2014_x86_64.pex
Pex 2.83.0 hermetic environment with 1 requirement and 10 activated distributions.
Python 3.14.2 (main, Dec  5 2025, 14:39:48) [GCC 15.2.0] on linux
Type "help", "pex", "copyright", "credits" or "license" for more information.
>>> pex()
Running from PEX file: ./ansible-cp314-cp314-macosx_11_0_arm64.manylinux2014_x86_64.pex
Requirements:
  ansible
Activated Distributions:
  ansible-13.2.0-py3-none-any.whl
  ansible_core-2.20.1-py3-none-any.whl
  jinja2-3.1.6-py3-none-any.whl
  markupsafe-3.0.3-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl
  pyyaml-6.0.3-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl
  cryptography-46.0.3-cp311-abi3-manylinux_2_34_x86_64.whl
  cffi-2.0.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl
  pycparser-2.23-py3-none-any.whl
  packaging-25.0-py3-none-any.whl
  resolvelib-1.2.1-py3-none-any.whl
>>>

• Support a {platform} placeholder in PEX file names. (#​3078)

v2.82.1

Compare Source

This release fixes pex3 scie create --dest-dir to work when the specified PEX is a local file
path. Previously --dest-dir only worked when the specified PEX was an URL.

• Fix pex3 scie create --dest-dir handling. (#​3076)

v2.82.0

Compare Source

This release adds support for resource path bindings to plain PEXes as a follow-on to adding
resource binding support for PEX scies in the 2.81.0 release. Resource paths are bound to
environment variables with --bind-resource-path. Additionally, the existing --inject-args option
now supports replacement of {pex.env.<env var name>} placeholders with the corresponding
environment variable value. Notably, the combination of these features allows passing the paths of
files contained in a PEX to third party scripts without extra shim code.

• Support passing PEX file paths to 3rd party scripts. (#​3074)

v2.81.0

Compare Source

This release adds the ability to set a custom scie entrypoint for PEX scies using --scie-exe,
--scie-args and --scie-env, as well as bind resource paths to environment variables using
--scie-bind-resource-path. The combination of these new features allows broad flexibility
defining a PEX scie's boot command.

Additionally, the pex3 scie create command gains the ability to use a URL for the PEX to convert
to a scie and optionally specify a size (via #size=<expected size>) and / or fingerprint (via
#<algorithm>=<expected fingerprint>) to verify the download against.

• Support converting existing Pants PEXes to performant scies. (#​3072)

v2.80.0

Compare Source

This release adds the pex3 scie create tool for creating scies from existing PEX files. This
works for PEXes created by Pex 2.1.25 (released on January 21st, 2021) and newer.

• Add a pex3 scie create command. (#​3070)

v2.79.0

Compare Source

This release adds the CPython[free-threaded] alias for CPython+t and the CPython[gil] alias
for CPython-t when writing interpreter constraints.

• Add CPython[{free-threaded,gil}] aliases for CPython{+,-}t. (#​3068)

v2.78.0

Compare Source

v2.77.3

Compare Source

This release updates vendored Pip's vendored certifi's cacert.pem to that from certifi 2026.1.4.

• Update vendored Pip's CA cert bundle. (#​3065)

v2.77.2

Compare Source

This release fixes venv creation from PEXes to avoid declaring false collisions in __init__.py
files when the venv uses Python 3.9 or greater.

• Compare ASTs of colliding venv __init__.py. (#​3063)

v2.77.1

Compare Source

This release fixes a very old bug where the Pex PEX (or any other PEX created with
--no-strip-pex-env) would, in fact, strip PEX_PYTHON and PEX_PYTHON_PATH.

• Fix PEX_PYTHON{,_PATH} stripping on Pex re-exec. (#​3062)

v2.77.0

Compare Source

This release has no fixes or new features per-se, but just changes the set of distributions that
Pex releases to PyPI. Previously Pex released an sdist and a universal (py2.py3-none-any) .whl.
Pex now releases two wheels in addition to the sdist. The py3.py312-none-any.whl targets
Python>=3.12 and has un-needed vendored libraries elided making it bith a smaller .whl and less
prone to false-positive security scan issues since unused vendored code is now omitted. The other
wheel carries the same contents as prior and supports creating PEXes for Python 2.7 and
Python>=3.5,<3.12.

• Split Pex .whl into two .whls. (#​3057)

v2.76.1

Compare Source

This release fixes bootstrapping of Pips specified via --pip-version to respect Pex Pip
configuration options (like custom indexes) under Python 3.12 and newer.

• Fix Pip bootstrap to respect Pip config for Python >= 3.12. (#​3054)

v2.76.0

Compare Source

This release adds support for --no-scie-pex-entrypoint-env-passthrough to trigger direct execution
of --venv PEX scie script entrypoints. This performance optimization mirrors the existing default
--no-scie-busybox-pex-entrypoint-env-passthrough for busybox scies, but must be selected by
passing --no-scie-pex-entrypoint-env-passthrough explicitly. In addition, the VIRTUAL_ENV env
var is now guaranteed to be set for all --venv PEX scies.

• Add scie support for direct exec of venv scripts. (#​3053)

v2.75.2

Compare Source

This release updates vendored Pip's vendored certifi's cacert.pem to that from certifi 2025.11.12.

• Update vendored Pip's CA cert bundle. (#​3052)

v2.75.1

Compare Source

This release fixes Pex handling of wheels with bad RECORDs that record files that do not exist in
the .whl file.

• Warn when non-existent files in RECORD, but proceed. (#​3051)

v2.75.0

Compare Source

This release adds supoort for --scie-load-dotenv to enable .env file loading in PEX scies.

• Support scie-jump .env loading with --scie-load-dotenv. (#​3046)

v2.74.3

Compare Source

This release fixes a bug gracefully handling a request for --validate-entry-point when no
--entry-point was given.

• Error for missing entry point under --validate-entry-point. (#​3048)

v2.74.2

Compare Source

This release fixes building PEXes from direct URL requirements. Previously, the direct URL
requirement would be recorded incorrectly in PEX-INFO metadata leading to a failure to boot.

• Fix str(req) of direct URLs with known versions. (#​3043)

v2.74.1

Compare Source

This release upgrades the floor of science to 0.17.1 and scie-jump to 1.9.2 to fix a regression
in the breadth of Linux platforms --scie {eager,lazy} PEX scies were compatible with.

• Upgrade science to 0.17.1 & scie-jump to 1.9.2. (#​3038)

v2.74.0

Compare Source

This release adds support for setting custom PEX-INFO build_properties metadata via
--build-property, --build-properties and --record-git-state.

• Support custom PEX-INFO build_properties. (#​3036)

v2.73.1

Compare Source

This release fixes --lock and --pylock subsetting of direct reference and VCS requirements.
Previously, just the project name was matched when subsetting but now the normalized URL is matched.
The previous behavior could lead to subsets succeeding that should have otherwise failed. The new
behavior can lead to a subset failing when URLs differ, but both URLs point to the same content.
Although this too is a bug, it should be a much narrower use case in the wild; so this should be an
improvement.

• Fix URL requirement --lock & --pylock subsetting. (#​3034)

v2.73.0

Compare Source

This release upgrades the floor of science to 0.17.0 and scie-jump to 1.9.1 to pick up support
for producing PEX scies for Linux aarch64 & x86_64 that link against glibc. Previously the embedded
interpreter would link against glibc but the scie-jump at the PEX scie tip was a musl libc static
binary and this could cause problems in those areas where glibc and musl diverge.

• Upgrade science to 0.17.0 & scie-jump to 1.9.1. (#​3033)

v2.72.2

Compare Source

This release fixes a regression introduced in the Pex 2.60.0 release when installing wheels with
*.data/ entries whose top-level name matches a top-level package in the wheel. This regression
only affected default --venv mode PEXes which populate site-packages using symlinks.

• Fix --venv (using symlinks) for some wheels. (#​3031)

v2.72.1

Compare Source

This release fixes Pex lock resolves (--lock and --pylock) to allow exceptions for --no-wheel
and --no-build as a follow-on to the 2.71.1 release fix that enabled the same for Pip resolves.

• Allow exceptions for --no-{wheel,build} with locks. (#​3028)

v2.72.0

Compare Source

This release adds support for building foreign platform musl Linux PEX scies and dogfoods this to
add musl Linux aarch64 & x86_64 Pex PEX scies to the Pex release.

• Support targeting foreign platform musl scies. (#​3025)

v2.71.1

Compare Source

This release fixes Pex to allow blanket disallowing builds but making targeted exceptions and
vice-versa. The underlying Pip machinery has always supported this, but Pex just got in the way for
no reason.

• Allow exceptions for --no-wheel & --no-build. (#​3023)

v2.71.0

Compare Source

This release upgrades the floor of science to 0.16.0 to pick up support for generating PEX scies
for musl Linux aarch64.

• Upgrade science to 0.16.0. (#​3020)

v2.70.0

Compare Source

This release adds a feature for Pex developers. If you want to experiment with a new version of Pip
you can now specify _PEX_PIP_VERSION=adhoc _PEX_PIP_ADHOC_REQUIREMENT=.... N.B.: This feature is
for Pex development only.

• Support adhoc Pip versions in development. (#​3011)

v2.69.2

Compare Source

This release fixes handling of scoped repos. Previously, validation against duplicate scopes was too
aggressive and disallowed multiple un-named indexes and find-links repositories.

• Allow multiple un-named indexes and find-links repos. (#​3009)

---

Configuration

📅 Schedule: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.