[dependabot]

Bumps the pipenv group with 1 update in the /python/helpers directory: pipenv.

Updates pipenv from 2025.1.1 to 2026.10.6

Release notes

Sourced from pipenv's releases.

Release v2026.10.6

🤖 AI-Generated Changelog

Fixed

• Exit with a non-zero status code when safety cannot be installed or run during check/scan, ensuring failures are properly signaled to calling processes
• Read Pipfile as UTF-8 in check, scan, and --support commands, preventing errors with non-ASCII characters in Pipfile content
• Render dependency graph using only characters supported by the terminal's stdout encoding, avoiding display errors in non-UTF-8 environments

Removed

• Cleaned up unused internal code with no user-facing impact

---

🔗 Full Changelog: pypa/pipenv@v2026.10.5...v2026.10.6

Release v2026.10.5

🤖 AI-Generated Changelog

Fixed

• Fixed --trusted-host arguments being flagged as secrets in CodeQL security scanning
• Fixed package name parsing in pipenv update to correctly handle requirement specifiers as arguments
• Fixed requirements command to emit --trusted-host for sources with verify_ssl = false
• Fixed requirements command to correctly join os_markers and markers with and
• Fixed requirements command to preserve markers for git/VCS entries
• Fixed uninstall command to exit with a non-zero code when pip uninstall fails
• Fixed uninstall command to report why it exits 1 when no virtualenv exists
• Fixed pylock group name normalization and added rejection of category name collisions
• Fixed pylock to preserve all categories when reading from pylock.toml
• Fixed pylock to keep custom dependency groups in develop and requires-python as python_version
• Fixed pylock to classify packages correctly based on whether they install for default groups
• Fixed docs search by replacing stale Algolia search with Sphinx search
• Fixed integration tests to fail fast when a different pipenv version would be tested than the checked-out one

Changed

• Refactored --trusted-host logic to be shared between requirements and install, preserving environment-variable-defined hosts
• Raised dependency security version floors and extended Python version support to 3.11–3.15
• Dropped Python 3.10 support and addressed related code quality findings

Security

• Raised minimum versions of dependencies to address known security vulnerabilities

---

🔗 Full Changelog: pypa/pipenv@v2026.10.4...v2026.10.5

... (truncated)

Changelog

Sourced from pipenv's changelog.

2026.10.6 (2026-11-05)

pipenv 2026.10.6 (2026-11-05)

Bug Fixes

• Fixed pipenv check and pipenv scan exiting with status 0 when safety could not be installed (or was still missing after the install): they now exit with status 1, so CI no longer passes without having scanned anything.
• pipenv check, pipenv scan and pipenv --support now read the Pipfile and Pipfile.lock as UTF-8 (with or without a BOM) instead of the locale encoding.
• pipenv graph no longer fails with UnicodeEncodeError when its output is piped or redirected on Windows (pipenv graph > deps.txt): the tree is drawn with ASCII characters when stdout cannot encode box-drawing characters. [#5929](https://github.com/pypa/pipenv/issues/5929) <https://github.com/pypa/pipenv/issues/5929>_

2026.10.5 (2026-11-01)

pipenv 2026.10.5 (2026-11-01)

Behavior Changes

• Require Python 3.11 or newer and add support for Python 3.15. Project virtualenvs must also use Python 3.11+; the resolver now reports a clear error instead of failing on import under an older interpreter. Raise the minimum versions of virtualenv to 21.14.9, filelock to 4.2.1, and setuptools to 84.1.0 to include their security fixes, and refresh the development lockfiles. [#6771](https://github.com/pypa/pipenv/issues/6771) <https://github.com/pypa/pipenv/issues/6771>_

Bug Fixes

• Fixed pipenv update conflict detection and extra-category lookup for package arguments with extras or version ranges (requests[socks]==2.0, pkg>=2): the package name is now parsed as a requirement instead of splitting on =, and only exact pins are checked for conflicts.
• Preserve custom dependency categories when importing and exporting pylock.toml. Apply the selected groups when validating and installing packages, and retain each category's environment markers for shared dependencies. Parse group markers independently of whitespace so dev-only packages cannot be moved into the default category by compact marker syntax. Convert simple requires-python specifiers to a plain python_version or python_full_version. [#6758](https://github.com/pypa/pipenv/issues/6758) <https://github.com/pypa/pipenv/issues/6758>_
• Normalize the dependency group names written to pylock.toml and record each group's original category under [tool.pipenv.categories] so reading the file restores the same categories, including --dev-groups aliases as develop. Generating pylock.toml now fails when two categories, or a category and one of the --dev-groups, map to the same dependency group, instead of merging them. [#6759](https://github.com/pypa/pipenv/issues/6759) <https://github.com/pypa/pipenv/issues/6759>_
• pipenv requirements now keeps the environment marker of git/VCS dependencies, so they are no longer installed on platforms the Pipfile.lock excludes. [#6760](https://github.com/pypa/pipenv/issues/6760) <https://github.com/pypa/pipenv/issues/6760>_
• pipenv requirements now prints --trusted-host for sources with verify_ssl = false, as pipenv install passes it to pip. [#6761](https://github.com/pypa/pipenv/issues/6761) <https://github.com/pypa/pipenv/issues/6761>_
• pipenv uninstall now exits with a non-zero status when pip uninstall fails for a package. [#6762](https://github.com/pypa/pipenv/issues/6762) <https://github.com/pypa/pipenv/issues/6762>_

Improved Documentation

• Replace the documentation's outdated Algolia search with Sphinx's built-in search, so results point to pages in the documentation version being viewed. [#6661](https://github.com/pypa/pipenv/issues/6661) <https://github.com/pypa/pipenv/issues/6661>_

... (truncated)

Commits

• 9540010 Release v2026.10.6
• 061d359 Bumped version to 2026.10.6.
• 294ef46 Merge pull request #6778 from pcbeingused333/fix/scan-check-exit-nonzero-safe...
• ef75aa0 Merge pull request #6779 from b84330808/fix-check-scan-support-pipfile-encoding
• 4491d0b Merge pull request #6777 from nk-batman21/fix/graph-non-utf8-stdout
• 72983d6 Merge pull request #6776 from duriantaco/remove-unused-code
• e300dc9 fix(check): exit non-zero when safety cannot be installed or run
• 688ae10 Read the Pipfile as UTF-8 in check, scan and --support
• e87a719 fix(graph): draw the tree with characters stdout can encode
• caebdc3 chore: remove unused code
• Additional commits viewable in compare view

[JamieMagee]

@dependabot rebase

[JamieMagee]

CI is failing because pipenv 2026.0.3 requires Python >=3.10, and the build installs helpers into every supported Python version including 3.9. The pip install step blows up on the 3.9 environment since there's no compatible wheel.

Two options:

1. Pin to 2025.0.4 — the last version that supports 3.9. Easy fix, but we stay on an older pipenv for all versions.
2. Drop Python 3.9 support — 3.9 hit EOL on October 31, 2025. Removing it would unblock this bump and let us take 2026.0.3 directly. Involves touching the Dockerfile, language.rb, and associated specs.

Option 2 is probably the right call here since 3.9 has been dead for four months, but it's a bigger change than this PR should carry. I'd suggest we either land a separate PR to drop 3.9, then rebase this one — or just pin to 2025.0.4 for now and bump pipenv again after 3.9 is gone.

[JamieMagee]

@dependabot recreate