🐛 fix(env): strip PYTHONPATH from isolated builds (#1024)

gaborbernat · web-flow · commit 27b67b2db180 · 2026-04-10T12:40:34.000-07:00
diff --git a/docs/changelog/405.bugfix.rst b/docs/changelog/405.bugfix.rst
@@ -0,0 +1,2 @@
+Strip ``PYTHONPATH`` from the environment during isolated builds to prevent host packages from leaking into the build -
+by :user:`gaborbernat`
diff --git a/src/build/env.py b/src/build/env.py
@@ -154,7 +154,11 @@ def make_extra_environ(self) -> dict[str, str]:
         return {
             'PATH': os.pathsep.join([self._env_backend.scripts_dir, path])
             if path is not None
-            else self._env_backend.scripts_dir
+            else self._env_backend.scripts_dir,
+            # Set PYTHONPATH to empty to override any host value. An empty
+            # PYTHONPATH is treated as unset by CPython's path initialization
+            # (the ``if pythonpath_env:`` check makes it a no-op).
+            'PYTHONPATH': '',
         }
 
     def install(self, requirements: Collection[str], constraints: Collection[str] = []) -> None:
@@ -383,7 +387,9 @@ def install_dependencies(  # pragma: no cover -- uv tests are skipped on PyPy, c
 
                 cmd += ['-c', os.path.abspath(constraint_file.name)]
 
-            run_subprocess(cmd, env={**os.environ, 'VIRTUAL_ENV': self._env_path})
+            env = {k: v for k, v in os.environ.items() if k != 'PYTHONPATH'}
+            env['VIRTUAL_ENV'] = self._env_path
+            run_subprocess(cmd, env=env)
 
     @property
     def display_name(self) -> str:
diff --git a/tests/test_env.py b/tests/test_env.py
@@ -28,6 +28,25 @@
 MISSING_VIRTUALENV = importlib.util.find_spec('virtualenv') is None
 
 
+def test_make_extra_environ_overrides_pythonpath() -> None:
+    with build.env.DefaultIsolatedEnv() as env:
+        extra = env.make_extra_environ()
+        assert extra['PYTHONPATH'] == ''
+        assert env._env_backend.scripts_dir in extra['PATH']
+
+
+def test_uv_install_strips_pythonpath(
+    mocker: pytest_mock.MockerFixture,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setenv('PYTHONPATH', '/some/leaky/path')
+    run_subprocess = mocker.patch('build.env.run_subprocess')
+    with build.env.DefaultIsolatedEnv(installer='uv') as env:
+        env.install(['some-package'])
+    (install_call,) = run_subprocess.call_args_list
+    assert 'PYTHONPATH' not in install_call.kwargs['env']
+
+
 @pytest.mark.isolated
 def test_isolation() -> None:
     subprocess.check_call([sys.executable, '-c', 'import build.env'])

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	+Strip ``PYTHONPATH`` from the environment during isolated builds to prevent host packages from leaking into the build -
	`2`	+by :user:`gaborbernat`