Update dependency virtualenv to v20.26.6 [SECURITY] #642

renovate · 2025-08-13T16:54:12Z

This PR contains the following updates:

Package	Change	Age	Confidence
virtualenv	`==20.10.0` -> `==20.26.6`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2024-53899

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

Release Notes

pypa/virtualenv (virtualenv)

`v20.26.6`

Compare Source

What's Changed

release 20.26.5 by @gaborbernat in #2766
Fix #2768: Quote template strings in activation scripts by @y5c4l3 in #2771

New Contributors

@y5c4l3 made their first contribution in #2771

Full Changelog: pypa/virtualenv@20.26.5...20.26.6

`v20.26.5`

Compare Source

What's Changed

release 20.26.4 by @gaborbernat in #2761
Use uv over pip by @gaborbernat in #2765

Full Changelog: pypa/virtualenv@20.26.4...20.26.5

`v20.26.4`

Compare Source

What's Changed

release 20.26.3 by @gaborbernat in #2742
Fix whitespace around backticks in changelog by @edmorley in #2751
Test latest Python 3.13 by @hugovk in #2752
Fix typo in Nushell activation script by @edmorley in #2754
GitHub Actions: Replace deprecated macos-12 with macos-13 by @hugovk in #2756
Fix #2728: Activating venv create unwanted console output by @ShootGan in #2748
Upgrade bundled wheels by @gaborbernat in #2760

New Contributors

@ShootGan made their first contribution in #2748

Full Changelog: pypa/virtualenv@20.26.3...20.26.4

`v20.26.3`

Compare Source

What's Changed

release 20.26.2 by @gaborbernat in #2724
Bump embeded wheels by @gaborbernat in #2741

Full Changelog: pypa/virtualenv@20.26.2...20.26.3

`v20.26.2`

Compare Source

What's Changed

Release 20.26.1 by @gaborbernat in #2713
Update activate_this.py documentation to use runpy instead of exec by @FredStober in #2716
Apply ruff/bugbear new rules by @DimitriPapadopoulos in #2718
Fix the CI by @HandSonic in #2721
Fix #1949: zipapp virtual environment creation fails if zipapp path is symlinked by @HandSonic in #2722
Fix bad return code in bash activation if hashing is disabled by @fenkes-ibm in #2717

New Contributors

@FredStober made their first contribution in #2716
@HandSonic made their first contribution in #2721
@fenkes-ibm made their first contribution in #2717

Full Changelog: pypa/virtualenv@20.26.1...20.26.2

`v20.26.1`

Compare Source

What's Changed

release 20.26.0 by @gaborbernat in #2710
Fix PATH-based Python discovery on Windows by @ofek in #2712

Full Changelog: pypa/virtualenv@20.26.0...20.26.1

`v20.26.0`

Compare Source

What's Changed

release 20.25.3 by @gaborbernat in #2704
Fixed a case when template variable is WindowsPath by @NtWriteCode in #2707
Allow builtin interpreter discovery to find specific Python versions given a general spec by @flying-sheep in #2709

New Contributors

@NtWriteCode made their first contribution in #2707
@flying-sheep made their first contribution in #2709

Full Changelog: pypa/virtualenv@20.25.3...20.26.0

`v20.25.3`

Compare Source

What's Changed

release 20.25.2 by @gaborbernat in #2703
Fix for tests: Python 3.13.0a6 renamed pathmod to parser by @befeleme in #2702

New Contributors

@befeleme made their first contribution in #2702

Full Changelog: pypa/virtualenv@20.25.2...20.25.3

`v20.25.2`

Compare Source

What's Changed

release 20.25.1 by @gaborbernat in #2692
Fix windows utf8 encoding issue by @PzaThief in #2687
Update changelog.rst by @Callek in #2701
Fix indentation in activate.fish by @junzh0u in #2700

New Contributors

@PzaThief made their first contribution in #2687
@Callek made their first contribution in #2701
@junzh0u made their first contribution in #2700

Full Changelog: pypa/virtualenv@20.25.1...20.25.2

`v20.25.1`

Compare Source

What's Changed

release 20.25.0 by @gaborbernat in #2675
Upgrade embeded wheels by @gaborbernat in #2681
Resolve symbolic links for environment metadata by @ofek in #2686
Avoid importing contextlib in _virtualenv by @hauntsaninja in #2688

Full Changelog: pypa/virtualenv@20.25.0...20.25.1

`v20.25.0`

Compare Source

What's Changed

release 20.24.6 by @gaborbernat in #2657
Allow platformdirs v4 by @alex in #2664
Bump wheels package by @gaborbernat in #2665
Bump setuptools and wheels by @gaborbernat in #2669
Run CI tests on Python 3.13, fix tests by @hroncok in #2673

Full Changelog: pypa/virtualenv@20.24.6...20.25.0

`v20.24.7`

Compare Source

What's Changed

release 20.24.6 by @gaborbernat in #2657
Allow platformdirs v4 by @alex in #2664
Bump wheels package by @gaborbernat in #2665

Full Changelog: pypa/virtualenv@20.24.6...20.24.7

`v20.24.6`

Compare Source

What's Changed

release 20.24.5 by @gaborbernat in #2643
Change "Virtualenv" to "virtualenv" to match style by @jackiekazil in #2646
[test] Use get_hookimpls method instead of the private attribute by @danigm in #2649
Remove extra closing parenthesis by @patrick-csliu in #2651
Fix the CI by @gaborbernat in #2655
Upgrade pip and setuptools by @gaborbernat in #2656

New Contributors

@jackiekazil made their first contribution in #2646
@danigm made their first contribution in #2649
@patrick-csliu made their first contribution in #2651

Full Changelog: pypa/virtualenv@20.24.5...20.24.6

`v20.24.5`

Compare Source

What's Changed

release 20.24.4 by @gaborbernat in #2633
Fix brew cannot copy by @gaborbernat in #2640
Test with 3.12 rc by @gaborbernat in #2641
Upgrade setuptools by @gaborbernat in #2642
GitHub Actions: Add PyPy 3.10 to testing by @cclauss in #2638

New Contributors

@cclauss made their first contribution in #2639

Full Changelog: pypa/virtualenv@20.24.4...20.24.5

`v20.24.4`

Compare Source

What's Changed

Fix typo found by codespell by @DimitriPapadopoulos in #2624
Updating extend.rst typo by @sagardesai1 in #2626

New Contributors

@DimitriPapadopoulos made their first contribution in #2624
@sagardesai1 made their first contribution in #2626

Full Changelog: pypa/virtualenv@20.24.3...20.24.4

`v20.24.3`

Compare Source

What's Changed

release 20.24.2 by @gaborbernat in #2615
Update compatibility docs by @jugmac00 in #2618
fix ResourceWarning on process exit (#2472) by @sigma67 in #2617
added scripts in tasks directory to sdist on build (#2610) by @sigma67 in #2620
Bump wheel by @gaborbernat in #2622

New Contributors

@sigma67 made their first contribution in #2617

Full Changelog: pypa/virtualenv@20.24.2...20.24.3

`v20.24.2`

Compare Source

What's Changed

release 20.24.1 by @gaborbernat in #2612
Bump pip and wheel by @gaborbernat in #2614

Full Changelog: pypa/virtualenv@20.24.1...20.24.2

`v20.24.1`

Compare Source

What's Changed

release 20.24.0 by @gaborbernat in #2608
Upgrade pip by @arielkirkwood in #2611

New Contributors

@arielkirkwood made their first contribution in #2611

Full Changelog: pypa/virtualenv@20.24.0...20.24.1

`v20.24.0`

Compare Source

What's Changed

release 20.23.1 by @gaborbernat in #2590
Fix the CI by @gaborbernat in #2593
Quickstart guide by @AlvesJorge in #2599
Updated CLI documentation with config file name by @nathanczh in #2602
Exclude dependabot and pre-commit ci from release notes by @gaborbernat in #2603
Export VIRTUAL_ENV_PROMPT in activation scripts (#2194) by @jimporter in #2606
Upgrade setuptools by @gaborbernat in #2607

New Contributors

@AlvesJorge made their first contribution in #2599
@nathanczh made their first contribution in #2602
@jimporter made their first contribution in #2606

Full Changelog: pypa/virtualenv@20.23.1...20.24.0

`v20.23.1`

Compare Source

What's Changed

release 20.23.0 by @gaborbernat in #2563
Bump pypa/gh-action-pypi-publish from 1.8.5 to 1.8.6 by @dependabot in #2566
feat: ✨ update and simplify nushell activation by @melMass in #2572
Fix deprecation warning by @jugmac00 in #2575
Replace unmaintained pytest-freezegun by @jugmac00 in #2576
Update cli_interface.rst by @uberFoo in #2586
Add ruff, test latest OS and bump setuptools by @gaborbernat in #2588

New Contributors

@melMass made their first contribution in #2572
@jugmac00 made their first contribution in #2575
@uberFoo made their first contribution in #2586

Full Changelog: pypa/virtualenv@20.23.0...20.23.1

`v20.23.0`

Compare Source

What's Changed

release 20.22.0 by @gaborbernat in #2549
Clarify that v20.22.0 dropped support for Python 3.6 too by @pquentin in #2552
Add trusted-publish by @gaborbernat in #2559
prevent PermissionError when using venv creator on some systems by @kulikjak in #2543
upgrade pip and setuptools (#2560) by @gaborbernat in #2562
3.12 support and no setuptools/wheel on 3.12+ by @chrysle in #2558

New Contributors

@pquentin made their first contribution in #2552
@chrysle made their first contribution in #2558

Full Changelog: pypa/virtualenv@20.22.0...20.23.0

`v20.22.0`

Compare Source

What's Changed

release 20.21.1 by @gaborbernat in #2547
Drop Python 2 support by @gaborbernat in #2548

Full Changelog: pypa/virtualenv@20.21.1...20.22.0

`v20.21.1`

Compare Source

What's Changed

Bump pypa/gh-action-pypi-publish from 1.6.4 to 1.7.1 by @dependabot in #2521
release 20.21.0 by @gaborbernat in #2519
Add tox.ini to sdist by @mtelka in #2520
Bump pypa/gh-action-pypi-publish from 1.7.1 to 1.8.1 by @dependabot in #2524
Update Nushell 'let' syntax by @jntrnr in #2527
Bump pypa/gh-action-pypi-publish from 1.8.1 to 1.8.3 by @dependabot in #2530
update nushell's str collect command to str join by @fdncred in #2532
Bump pypa/gh-action-pypi-publish from 1.8.3 to 1.8.5 by @dependabot in #2536
docs: fix attribution in v20.11 by @d3dave in #2539
Bump embeded wheels by @gaborbernat in #2546
Bump deps and tools by @gaborbernat in #2545

New Contributors

@mtelka made their first contribution in #2520
@jntrnr made their first contribution in #2527
@fdncred made their first contribution in #2532

Full Changelog: pypa/virtualenv@20.21.0...20.21.1

`v20.21.0`

Compare Source

What's Changed

release 20.20.0 by @gaborbernat in #2510
Using explicit closure syntax by @WindSoilder in #2512
Add print command to print_prompt for nushell by @NotLebedev in #2514
Sepcify the encoding by @FFY00 in #2515
Make ReentrantFileLock thread-safe and, thereby, fix race condition in virtualenv.cli_run by @radoering in #2517
Add pyproject-fmt by @gaborbernat in #2518

New Contributors

@WindSoilder made their first contribution in #2512
@NotLebedev made their first contribution in #2514
@FFY00 made their first contribution in #2515
@radoering made their first contribution in #2517

Full Changelog: pypa/virtualenv@20.20.0...20.21.0

`v20.20.0`

Compare Source

What's Changed

release 20.19.0 by @gaborbernat in #2503
Fix Tox environment name for running linting tools in PR template by @faph in #2505
Simplify environment lookup in Nushell activation by @kubouch in #2506
Support Windows CPython interpreters distributed by non-standard orgs by @faph in #2504
Bump embeded pip and setuptools by @gaborbernat in #2509

New Contributors

@faph made their first contribution in #2505

Full Changelog: pypa/virtualenv@20.19.0...20.20.0

`v20.19.0`

Compare Source

What's Changed

release 20.18.0 by @gaborbernat in #2497
Fix HTML title docs by @oleksis in #2500
Bump platformdirs dependency to <4 by @gaborbernat in #2502

New Contributors

@oleksis made their first contribution in #2500

Full Changelog: pypa/virtualenv@20.18.0...20.19.0

`v20.18.0`

Compare Source

What's Changed

release 20.17.1 by @gaborbernat in #2462
Bump pypa/gh-action-pypi-publish from 1.6.1 to 1.6.3 by @dependabot in #2464
Bump pypa/gh-action-pypi-publish from 1.6.3 to 1.6.4 by @dependabot in #2465
Fix Nushell installation failures by @kubouch in #2475
Move to hatchling, drop 3.6 support by @gaborbernat in #2474
Fix coverage reporting by @gaborbernat in #2477
Fix wrong prompt in Nushell activation script by @kubouch in #2481
Don't run scheduled workflow jobs on forks by @nsoranzo in #2490
Improve activator documentation by @adamchainz in #2488
Bump embedded pip and setuptools by @gaborbernat in #2489
Use furo docs theme by @gaborbernat in #2496

New Contributors

@adamchainz made their first contribution in #2488

Full Changelog: pypa/virtualenv@20.17.1...20.18.0

`v20.17.1`

Compare Source

What's Changed

release 20.17.0 by @gaborbernat in #2452
Bump pypa/gh-action-pypi-publish from 1.5.1 to 1.5.2 by @dependabot in #2454
Bump pypa/gh-action-pypi-publish from 1.5.2 to 1.6.1 by @dependabot in #2459
Py marker means any python not CPython by @gaborbernat in #2460
Respect VIRTUAL_ENV_DISABLE_PROMPT in nushell activation script by @m-lima in #2458

New Contributors

@m-lima made their first contribution in #2458

Full Changelog: pypa/virtualenv@20.17.0...20.17.1

`v20.17.0`

Compare Source

What's Changed

release 20.16.7 by @gaborbernat in #2445
Change Nushell activation script to module by @kubouch in #2422
Fix operator in Nushell activation script by @kubouch in #2450
Do not use deprecated API by @gaborbernat in #2448
Bump setuptools by @gaborbernat in #2451

Full Changelog: pypa/virtualenv@20.16.7...20.17.0

`v20.16.7`

Compare Source

What's Changed

release 20.16.6 by @gaborbernat in #2437
Replace six in tests/unit/test_run.py by @cjmayo in #2439
Try to fix Nushell install by @kubouch in #2444
Try alternate filenames for system_executable by @vfazio in #2442
Bump embedded by @gaborbernat in #2443
Set 'home' to parent directory of system_executable by @vfazio in #2441

New Contributors

@cjmayo made their first contribution in #2439
@vfazio made their first contribution in #2442

Full Changelog: pypa/virtualenv@20.16.6...20.16.7

`v20.16.6`

Compare Source

What's Changed

release 20.16.5 by @gaborbernat in #2413
fix building python3.10 virtualenvs on debian derivatives by @asottile in #2415
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #2423
Allow empty string as version for find_compatible_in_house by @schaap in #2430
Fix test_csh when running with the original csh by @kulikjak in #2418
Remove outdated PyPy stdlib overrides by @mattip in #2426
Upgrade pip and setuptools by @gaborbernat in #2434

New Contributors

@schaap made their first contribution in #2430
@kulikjak made their first contribution in #2418

Full Changelog: pypa/virtualenv@20.16.5...20.16.6

`v20.16.5`

Compare Source

What's Changed

release 20.16.4 by @gaborbernat in #2407
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #2410
Do not turn echo off for subsequent commands in batch activators (#2411) by @pawelszramowski in #2412