Summary

Fixes #5642

Previously, pipenv silently ignored unrecognized keys in Pipfile package entries. For example, writing commit = "hash" instead of ref = "hash" for a VCS dependency would be silently ignored, causing the dependency to point at HEAD instead of the intended commit.

Changes

This adds validation at two levels:

1. plette layer (PackageSpecfiers.validate in pipenv/vendor/plette/models/packages.py): Defines KNOWN_PACKAGE_KEYS — a frozenset of all recognized keys for a Pipfile package entry — and validates against it when the Pipfile is loaded via plette.Pipfile.load().

2. dependencies layer (_validate_pipfile_entry in pipenv/utils/dependencies.py): Validates package entries when install_req_from_pipfile() processes them during install/lock operations, raising PipenvUsageError with a clear message.

Example

Given this Pipfile:

[packages]
requests = { git = "ssh://git@github.com/psf/requests", commit = "foo" }

Pipenv will now produce:

Unrecognized option(s) in Pipfile for package 'requests': commit.
Valid options include: version, extras, editable, markers, ref, git, svn, hg, bzr,
path, file, index, subdirectory, hashes, no_binary, and PEP 508 marker keys.

Testing

All 375 existing unit tests continue to pass.

Pull Request opened by Augment Code with guidance from the PR author