Breaking Changes

• Update the minimum required Python version to 3.10. (#3787)

Features & Improvements

• Respect existing values of pyproject.toml when running pdm init or pdm new. (#3786)
• Move project plugin installations from .pdm-plugins under the project root to an isolated cache directory, and add a fixer to migrate existing plugin directories. (#3790)
• Remove legacy importlib compatibility wrappers and use standard-library importlib.metadata and importlib.resources APIs directly. (#3796)

Bug Fixes

• Fix a security issue with the installer to disallow installing to paths outside of the scheme directory. (#3787)
• Refuse to write project-local config and state files (pdm.toml, .pdm-python, .python-version) when the destination is a symlink, preventing an untrusted repository from clobbering files outside the project root. (#3788)
• Fix a regression issue that PDM_LOCKFILE env var is not respected. (#3794)
• Allow configuring the default lock --exclude-newer value with strategy.exclude-newer. (#3795)

Features & Improvements

• Support exclude-newer in pyproject.toml in the [tool.pdm.resolution] table (#3776)

Bug Fixes

• Preserve pylock package markers when refreshing lockfile hashes. (#3773)

What's Changed

• Remove dead code by @duriantaco in #3774
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #3780
• chore(deps): bump the actions group with 5 updates by @dependabot[bot] in #3778
• fix: update pdm_scheme to set pep582_base in sysconfig and add corresponding test by @frostming in #3781
• Allow exclude-newer to be defined in pyproject.toml by @sneakers-the-rat in #3782

New Contributors

• @duriantaco made their first contribution in #3774
• @sneakers-the-rat made their first contribution in #3782

Full Changelog: 2.26.8...2.26.9

Features & Improvements

• pdm lock --exclude-newer now accepts relative durations in the format N{d|h|w}, such as 7d, 12h, and 3w, in addition to absolute UTC dates and timestamps. (#3760)

Bug Fixes

• Fixed pdm add --frozen-lockfile --no-sync to skip dependency resolution and update only pyproject.toml without attempting to write the lockfile. (#3755)
• Fix [tool.pdm.options] being loaded from the current working directory instead of the target project when -p/--project is used. (#3756)
• Put make_file_executable into pdm.utils to replace the method of the same name in installer. To fix a breakage introduced by installer v1. (#3764)
• Fix pdm init <template> overwriting the template's additions to build-system.requires when build-system.build-backend matches the user's selection. (#3766)
• Fixed PySpecSet merging to handle impossible Python version ranges like >=3.6,<3.4 without crashing on empty or inverted gaps. (#3767)

Documentation

• The latest documentation version now shows a warning banner explaining that it is kept in sync with the main branch and may not match the features available in the latest released version. (#3765)

Features & Improvements

• Speed up dependency resolution when there are complex conflicts. (#3751)

Documentation

• Switch to Zensical as docs generator. (#3752)

Miscellany

• Add comprehensive tests for completion, show, search, and info commands to improve test coverage (#3541)

Bug Fixes

• Support packaging==26.0 changes for version comparison (#3729)

Bug Fixes

• Respect the project path when using cookiecutter template in pdm init command. (#3721)
• Fix a bug that resolution.excludes is not applied when evaluating candidates from the lock file. (#3726)

Documentation

• Remove chatbot from the docs page footer. (#3722)
• Generate llms.txt for docs powered by mkdocs-llmstxt. (#3723)

Bug Fixes

• Make sure cursor closing for fixing PyPy different gc mode also add PyPy in CI. (#3708)
• Fix a bug that old HTTP cache directories cause PDM to crash when trying to clear them. (#3715)

Features & Improvements

• Port to hishel 1.0.0. (#3700)

Bug Fixes

• Update .gitignore file in the default template. (#3686)
• Correct the sysconfig variables for Python standalone build installations. (#3693)
• Ignore packages.vcs.requested-revision if it's None when formatting pylock.toml. (#3694)
• Fix test failures with uv test cases using non-venv Python interpreters. (#3698)

Features & Improvements

• Only parse TOML document with tomlkit when writing is required. (#3672)
• Add SHA256 checksums for binary releases during the release workflow and create an installer script that downloads binaries from GitHub releases with automatic platform detection and checksum verification. (#3679)

Bug Fixes

• Fix test_use_python_write_file_multiple_versions to match PDM's actual behavior. (#3660)
• Correctly calculate the venv path for UV_PROJECT_ENVIRONMENT env var when using uv mode. (#3675)
• Ensure implementation.gil_disabled is a boolean in get_current_env_spec. This fix an issue that free-threaded wheels get rejected incorrectly. (#3677)
• Fix CLI help formatting on Python 3.14+. (#3683)
• Make PdmBasicAuth a cached_property to accelerate execution. (#3684)

Removals and Deprecations

• Add deprecation warning for pdm search command as PyPI no longer supports search API. (#3674)

Miscellany

• Add tests to utils.fs_supports_link_method and utils.convert_to_datetime. (#3541)

Bug Fixes

• Substitute missing env vars with empty string in expand_env_vars. (#3653)
• Constrained hishel to be less than 1.0.0 due to its refactor (#3657)