Skip to content

chore: bump virtualenv from 21.7.9 to 21.7.14 - #215

Closed
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/pip/develop/virtualenv-21.7.14
Closed

dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/pip/develop/virtualenv-21.7.14

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 21, 2026

Copy link
Copy Markdown
Contributor

Bumps virtualenv from 21.7.9 to 21.7.14.

Release notes

Sourced from virtualenv's releases.

21.7.14

What's Changed

Full Changelog: pypa/virtualenv@21.7.13...21.7.14

21.7.13

What's Changed

Full Changelog: pypa/virtualenv@21.7.12...21.7.13

21.7.12

What's Changed

Full Changelog: pypa/virtualenv@21.7.11...21.7.12

21.7.11

What's Changed

Full Changelog: pypa/virtualenv@21.7.10...21.7.11

... (truncated)

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.7.14

  • Fix activate.csh failing with Event not found when the virtual environment path contains !. (:issue:3256)

v21.7.13 (2026-09-18)


Bugfixes - 21.7.13

  • Fix activate and activate.fish running commands embedded in the virtual environment path or in the interpreter's Tcl/Tk library paths. (:issue:3252)

v21.7.12 (2026-09-18)


Bugfixes - 21.7.12

  • Fix activate.bat running arbitrary commands from a crafted --prompt, VIRTUALENV_PROMPT, or config file value. (:issue:3250)
  • Verify a downloaded seed wheel's sha256 against PyPI before seeding it into a virtual environment, skipped when a custom pip index is configured. (:issue:3251)

v21.7.11 (2026-09-17)


Bugfixes - 21.7.11

  • Running activate.bat again before deactivate no longer makes deactivate leave the environment's PKG_CONFIG_PATH, TCL_LIBRARY and TK_LIBRARY behind, or lose values the user had set before the first activation - by :user:darrenhuai. (:issue:3245)
  • Write pyvenv.cfg values on a single line, so a prompt carrying a line boundary can no longer inject configuration. --prompt, the VIRTUALENV_PROMPT environment variable and the config file all set the prompt, and pyvenv.cfg has no escape syntax, so a newline, a carriage return, or any other boundary str.splitlines recognizes, such as U+2028, started a new configuration line. Reading the file back picked up those lines as keys, and since the last value for a key wins, they replaced anything written earlier, including home. (:issue:3247)

Improved Documentation - 21.7.11

  • Document the policy for AI-assisted contributions and the licensing rules for dependencies. (:issue:3239)

Misc - 21.7.11

... (truncated)

Commits
  • 9baea3c release 21.7.14
  • ab3dcff 🐛 fix(activation): escape ! for csh history expansion (#3256)
  • 0c295ff release 21.7.13
  • 4d5a105 🐛 fix(activation): stop path command injection in bash and fish (#3252)
  • 0525dce 👷 ci: scope the nushell apt key to its own repo (#3253)
  • aa8323a 🔧 chore: drop misc as a changelog fragment type (#3255)
  • a435477 👷 ci: correct a stale checkout pin comment (#3254)
  • 9666b42 release 21.7.12
  • a01ed3e 🐛 fix(seed): verify downloaded wheel digests (#3251)
  • d721ff1 🐛 fix(activation): escape batch quote() against injection (#3250)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [virtualenv](https://github.com/pypa/virtualenv) from 21.7.9 to 21.7.14.
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@21.7.9...21.7.14)

---
updated-dependencies:
- dependency-name: virtualenv
  dependency-version: 21.7.14
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 21, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 28, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #217.

@dependabot dependabot Bot closed this Sep 28, 2026
@dependabot
dependabot Bot deleted the dependabot/pip/develop/virtualenv-21.7.14 branch September 28, 2026 11:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants