Skip to content

fix(deps): bump virtualenv from 21.14.12 to 21.14.13 - #135

Merged
stefan-jansen merged 2 commits into
mainfrom
dependabot/uv/virtualenv-21.14.13
Oct 25, 2026
Merged

stefan-jansen merged 2 commits into
mainfrom
dependabot/uv/virtualenv-21.14.13

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 25, 2026 •

Copy link
Copy Markdown
Contributor

Bumps virtualenv from 21.14.12 to 21.14.13.

Release notes

Sourced from virtualenv's releases.

21.14.13

Bugfixes - 21.14.13

  • Stop bash running commands from --prompt or an environment name containing $(...), backticks or a backslash after shopt -s promptvars, set -o posix, or in a child shell that inherits an exported PS1 (GHSA-cx6f-vjhg-g3cc); reported by rozzkml. zsh now draws the prompt from psvar[9], which is never parsed as shell syntax.

    Write the .venv redirect and the wheel RECORD with exclusive create, so a link planted after the existence check cannot redirect the write. On POSIX, a read-only .venv redirect that points at a virtualenv is replaced. (#3466)

PyPI release

Full Changelog: pypa/virtualenv@21.14.12...21.14.13

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.14.13

  • Stop bash running commands from --prompt or an environment name containing $(...), backticks or a backslash after shopt -s promptvars, set -o posix, or in a child shell that inherits an exported PS1 (GHSA-cx6f-vjhg-g3cc); reported by :user:rozzkml. zsh now draws the prompt from psvar[9], which is never parsed as shell syntax.

    Write the .venv redirect and the wheel RECORD with exclusive create, so a link planted after the existence check cannot redirect the write. On POSIX, a read-only .venv redirect that points at a virtualenv is replaced. (:issue:3466)


v21.14.12 (2026-10-21)


Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Maintainer verification

The final reviewed head df80d41123a479ae4113eb65f0a0b32b97b6599d incorporates current main through a normal guarded update. Its complete exported requirements differ only in the virtualenv patch version; the other lockfile edits preserve the same dependency markers. Three actual interactive Bash activation workflows execute a harmless marker with 21.14.12 and keep it inert with 21.14.13. Fresh default seeded environment creation, pip and the isolated interpreter also pass.

Both full local lanes pass 4,583 tests, with 85.78% coverage; the second lane treats resource warnings as errors. The complete dependency audit, source quality checks and locked-tool hooks pass. All 28 hosted checks completed with 27 successful and the validated Python 3.15 exclusion. Ordinary pinned-head merge produced d4f33bcabcc038ff4b84b934b1cd5c0c764ff6d8, whose entire tree matches the qualified head. Original Dependabot attribution and history are preserved. This PR includes no release or deployment.

AI assistance: Codex reviewed and verified this maintainer-directed update and its actual regression workflows. Dependabot produced the dependency diff; the maintainer owns the qualification and merge decision.

@dependabot dependabot Bot added dependencies Dependency updates python:uv Pull requests that update python:uv code labels Oct 25, 2026
@stefan-jansen
stefan-jansen merged commit d4f33bc into main Oct 25, 2026
28 checks passed
@stefan-jansen
stefan-jansen deleted the dependabot/uv/virtualenv-21.14.13 branch October 25, 2026 22:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Dependency updates python:uv Pull requests that update python:uv code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant