v2.28.2

Keep environment inspection working for Python 3.9 targets when PDM uses dep-logic 0.7 or newer. (#3838)
Cache the update check timestamp even when the version lookup fails, so that pdm no longer appears to hang on every command when PyPI is unreachable. (#3840)
Don't crash with an IndexError when listing scripts and one of them is blank. A blank script is now listed as <BLANK_SCRIPT>. (#3842)
Keep the whole template URL when pdm new is given an ssh:// or credentialed Git URL, instead of truncating it at the userinfo @. (#3843)
Strip comments preceded by any whitespace, not only a plain space, when importing a requirements.txt file. (#3844)
Match --trusted-host on host and port when importing a requirements.txt file, and keep the port when exporting one. (#3845)
Expand a ~ prefix in the venv.location config so pdm venv list/remove/activate/purge find virtualenvs created under it. (#3847)
Convert a Poetry caret constraint on a 0.x version to the upper bound Poetry documents, so ^0.2.3 becomes <0.3.0 and ^0.0.3 becomes <0.0.4 instead of <1.0.0. (#3848)
Fill in a placeholder project.name and project.version for the pyproject.toml generated for uv, so pdm lock/pdm install work with use_uv on a project that declares neither. (#3849)
Resolve nested requirement paths relative to remote requirements file URLs. (#3850)

v2.28.1

Defer command action and Python installer imports until their corresponding runtime paths execute. (#3673)
Add {run_cwd} placeholder for scripts to reference the original working directory. (#3734)
Add opt-in canonical lock input freshness via tool.pdm.resolution.lock_inputs while retaining sticky lockfile behavior and legacy hash fallback for existing lock files. (#3821)
Integrate argcomplete for simplified command-line completion scripts. (#3823)

Keep workspace members in their explicitly declared dependency groups instead of adding them to default in the lockfile. (#3816)
Keep the cached parsed version intact when stripping the local segment in comparable_version(). (#3817)
Make use_uv support adding local files. (#3822)
Add a Poetry optional dependency to every extra that lists it when importing, instead of only the first one. (#3831)
Do not write null values into the generated pyproject.toml when importing a flit project that omits author-email/maintainer-email or sets only one of include and exclude in [tool.flit.sdist]. (#3832)

Add experimental workspace support for managing local member projects in a shared root lock file. (#1505)
Defer startup-time imports for Python, virtualenv, and self-management commands. (#3673)

Fix pdm completion bash printing __ltrim_colon_completions: command not found (and a similar error for _get_comp_words_by_ref) when the generated script is sourced in a bash without the bash-completion package loaded, such as Git Bash on Windows or minimal Linux containers. The script now defines small fallbacks for both helpers when they are not already available. (#3793)
Avoid forwarding duplicate SIGINT in pdm run on POSIX. (#3808)

Fix the Windows installation instructions for a specific version. Invoke-Expression (iex) does not accept an -Args parameter and cannot forward arguments to a piped script, so the documented command failed. Use the $env:PDM_VERSION environment variable, which the install script reads, instead. (#3792)

Respect existing values of pyproject.toml when running pdm init or pdm new. (#3786)
Move project plugin installations from .pdm-plugins under the project root to an isolated cache directory, and add a fixer to migrate existing plugin directories. (#3790)
Remove legacy importlib compatibility wrappers and use standard-library importlib.metadata and importlib.resources APIs directly. (#3796)

Fix a security issue with the installer to disallow installing to paths outside of the scheme directory. (#3787)
Refuse to write project-local config and state files (pdm.toml, .pdm-python, .python-version) when the destination is a symlink, preventing an untrusted repository from clobbering files outside the project root. (#3788)
Fix a regression issue that PDM_LOCKFILE env var is not respected. (#3794)
Allow configuring the default lock --exclude-newer value with strategy.exclude-newer. (#3795)

pdm lock --exclude-newer now accepts relative durations in the format N{d|h|w}, such as 7d, 12h, and 3w, in addition to absolute UTC dates and timestamps. (#3760)

Fixed pdm add --frozen-lockfile --no-sync to skip dependency resolution and update only pyproject.toml without attempting to write the lockfile. (#3755)
Fix [tool.pdm.options] being loaded from the current working directory instead of the target project when -p/--project is used. (#3756)
Put make_file_executable into pdm.utils to replace the method of the same name in installer. To fix a breakage introduced by installer v1. (#3764)
Fix pdm init <template> overwriting the template's additions to build-system.requires when build-system.build-backend matches the user's selection. (#3766)
Fixed PySpecSet merging to handle impossible Python version ranges like >=3.6,<3.4 without crashing on empty or inverted gaps. (#3767)

The latest documentation version now shows a warning banner explaining that it is kept in sync with the main branch and may not match the features available in the latest released version. (#3765)

Add comprehensive tests for completion, show, search, and info commands to improve test coverage (#3541)

Respect the project path when using cookiecutter template in pdm init command. (#3721)
Fix a bug that resolution.excludes is not applied when evaluating candidates from the lock file. (#3726)

Make sure cursor closing for fixing PyPy different gc mode also add PyPy in CI. (#3708)
Fix a bug that old HTTP cache directories cause PDM to crash when trying to clear them. (#3715)