Fix for #5134

news/5134.bugfix.rst

@@ -0,0 +1 @@
+Stopped expanding environment variables when using ``pipenv requirements``

pipenv/cli/command.py

@@ -768,7 +768,7 @@ def requirements(state, dev=False, dev_only=False, hash=False):
 
     from pipenv.utils.dependencies import convert_deps_to_pip
 
-    lockfile = state.project.lockfile_content
+    lockfile = state.project.load_lockfile(expand_env_vars=False)
 
     for i, package_index in enumerate(lockfile["_meta"]["sources"]):
         prefix = "-i" if i == 0 else "--extra-index-url"

tests/integration/test_requirements.py

@@ -1,6 +1,9 @@
 import json
+import os
 import pytest
 
+from pipenv.utils.shell import temp_environ
+
 
 @pytest.mark.requirements
 def test_requirements_generates_requirements_from_lockfile(PipenvInstance):
@@ -91,3 +94,36 @@ def test_requirements_with_git_requirements(PipenvInstance):
         assert c.returncode == 0
         assert req_name in c.stdout
         assert req_hash in c.stdout
+
+
+@pytest.mark.requirements
+def test_requirements_generates_requirements_from_lockfile_without_env_var_expansion(
+    PipenvInstance,
+):
+    lockfile = {
+        "_meta": {
+            "sources": [
+                {
+                    "name": "private_source",
+                    "url": "https://${redacted_user}:${redacted_pwd}@private_source.org",
+                    "verify_ssl": True,
+                }
+            ]
+        },
+        "default": {},
+    }
+
+    with PipenvInstance(chdir=True) as p:
+        with open(p.lockfile_path, "w") as f:
+            json.dump(lockfile, f)
+
+        with temp_environ():
+            os.environ['redacted_user'] = "example_user"
+            os.environ['redacted_pwd'] = "example_pwd"
+            c = p.pipenv("requirements")
+            assert c.returncode == 0
+
+            assert (
+                "-i https://${redacted_user}:${redacted_pwd}@private_source.org"
+                in c.stdout
+            )