pixi manager: osvVulnerabilityAlerts silently skips every exact-pinned pypi-dependencies entry

[rodmk]

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

40.62.1

Please tell us more about your question or problem

Problem

With enabledManagers: ["pixi"] and osvVulnerabilityAlerts: true, no vulnerability PR is ever created for a [tool.pixi.pypi-dependencies] entry - including deps with well-known CVEs.

Root cause

PypiDependency / CondaDependency store the raw TOML string ("==1.3.9") in currentValue and never set currentVersion. fetchVulnerabilities falls back to currentValue and rejects it via versioningApi.isVersion (== is a constraint, not a version). Regular updates escape this because that path uses isValid(). Still present on main.

Proposed fix

Mirror the pep621 fix (ca80f6c2e): strip the == prefix into currentVersion. ~4 lines per transform plus snapshot coverage.

AI disclosure: drafted with Claude Code; analysis machine-assisted, manually verified against 40.62.1 and main.

Logs (if relevant)

Logs

DEBUG: Skipping vulnerability lookup for package mako due to unsupported version ==1.3.9
  (same line emitted for every exact-pinned pypi-dependency)

[Churro]

-> #42741

[rodmk]

Thank you!