Skip to content

fix(manifest): reject channel in package runtime dependencies - #7070

Open
aoright wants to merge 1 commit into
prefix-dev:mainfrom
aoright:fix-package-run-dependencies-channel-validation
Open

aoright wants to merge 1 commit into
prefix-dev:mainfrom
aoright:fix-package-run-dependencies-channel-validation

Conversation

@aoright

@aoright aoright commented Sep 19, 2026

Copy link
Copy Markdown
Contributor

Description

In pixi.toml, package authors could previously specify channel in runtime dependency tables ([package.run-dependencies], [package.run-constraints], [package.extra-dependencies], and [package.run-exports]). However, a built package cannot constrain or add channels to consuming environments; channels are resolved at the workspace/environment level, and top-level environment solves ignore channel qualifiers in package records. This gave package authors a false impression that dependency provenance was constrained.

This PR:

  1. Rejects channel in [package.run-dependencies], [package.run-constraints], [package.extra-dependencies], and [package.run-exports] with clear spans and helpful error diagnostics.
  2. Preserves support for channel in [package.host-dependencies] and [package.build-dependencies] (where build-time environments can respect them).

Fixes #6747

How Has This Been Tested?

  • Added automated unit tests and snapshot assertions in crates/pixi_manifest/src/toml/package_target.rs:
    • test_channel_in_run_dependencies_is_rejected
    • test_channel_in_run_constraints_is_rejected
    • test_channel_in_extra_dependencies_is_rejected
    • test_channel_in_host_and_build_dependencies_is_allowed
  • Ran cargo test -p pixi_manifest package_target (all 13 tests passed).

AI Disclosure

  • This PR contains AI-generated content.
    • I have tested any AI-generated content in my PR.
    • I take responsibility for any AI-generated content in my PR.
      Tools: Claude

Checklist:

  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have added sufficient tests to cover my changes.

Reject `channel` in package runtime dependency tables ([package.run-dependencies], [package.run-constraints], [package.extra-dependencies], and [package.run-exports]).

Conda packages cannot specify channels for downstream consumers; channels must be configured at the workspace or environment level. Top-level environment solves ignore channel qualifiers in package records, giving package authors a false impression that provenance is constrained.

Closes prefix-dev#6747.

Signed-off-by: aoright <102943475+aoright@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

channel in [package.run-dependencies] is accepted but not enforced

1 participant