Latest Results
Bump virtualenv from 21.7.9 to 21.7.14 (#13761)
Bumps [virtualenv](https://github.com/pypa/virtualenv) from 21.7.9 to
21.7.14.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/virtualenv/releases">virtualenv's
releases</a>.</em></p>
<blockquote>
<h2>21.7.14</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>🐛 fix(activation): escape ! for csh history expansion by <a
href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3256">pypa/virtualenv#3256</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pypa/virtualenv/compare/21.7.13...21.7.14">https://github.com/pypa/virtualenv/compare/21.7.13...21.7.14</a></p>
<h2>21.7.13</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>👷 ci: correct a stale checkout pin comment by <a
href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3254">pypa/virtualenv#3254</a></li>
<li>🔧 chore: drop misc as a changelog fragment type by <a
href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3255">pypa/virtualenv#3255</a></li>
<li>👷 ci: scope the nushell apt key to its own repo by <a
href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3253">pypa/virtualenv#3253</a></li>
<li>🐛 fix(activation): stop path command injection in bash and fish by
<a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a>
in <a
href="https://redirect.github.com/pypa/virtualenv/pull/3252">pypa/virtualenv#3252</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pypa/virtualenv/compare/21.7.12...21.7.13">https://github.com/pypa/virtualenv/compare/21.7.12...21.7.13</a></p>
<h2>21.7.12</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>🔧 chore(changelog): drop dead CVE-2026-24049 fragment by <a
href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3249">pypa/virtualenv#3249</a></li>
<li>🐛 fix(activation): escape batch quote() against injection by <a
href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3250">pypa/virtualenv#3250</a></li>
<li>🐛 fix(seed): verify downloaded wheel digests by <a
href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3251">pypa/virtualenv#3251</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pypa/virtualenv/compare/21.7.11...21.7.12">https://github.com/pypa/virtualenv/compare/21.7.11...21.7.12</a></p>
<h2>21.7.11</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>Add OpenSSF Scorecard workflow by <a
href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3238">pypa/virtualenv#3238</a></li>
<li>Document AI-assisted contributions and licensing policy by <a
href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3239">pypa/virtualenv#3239</a></li>
<li>👷 ci(release): attest and sign release provenance by <a
href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3242">pypa/virtualenv#3242</a></li>
<li>👷 ci: harden Scorecard-scored checks in CI by <a
href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3241">pypa/virtualenv#3241</a></li>
<li>🐛 fix(ci): parallelize graalpy tests, recover crashed workers by <a
href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3240">pypa/virtualenv#3240</a></li>
<li>🐛 fix(ci): mark real-shell activation tests as slow by <a
href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3243">pypa/virtualenv#3243</a></li>
<li>👷 ci: run macOS jobs on macos-26 by <a
href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3244">pypa/virtualenv#3244</a></li>
<li>🐛 fix(activation): undo a live activation before activate.bat saves
values by <a
href="https://github.com/darrenhuai"><code>@darrenhuai</code></a> in <a
href="https://redirect.github.com/pypa/virtualenv/pull/3245">pypa/virtualenv#3245</a></li>
<li>🐛 fix(create): keep pyvenv.cfg values on a single line by <a
href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3247">pypa/virtualenv#3247</a></li>
<li>🔧 chore(test): add opt-in Atheris fuzz harness by <a
href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3246">pypa/virtualenv#3246</a></li>
<li>📝 docs(readme): add OpenSSF Best Practices badge by <a
href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3248">pypa/virtualenv#3248</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pypa/virtualenv/compare/21.7.10...21.7.11">https://github.com/pypa/virtualenv/compare/21.7.10...21.7.11</a></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst">virtualenv's
changelog</a>.</em></p>
<blockquote>
<h1>Bugfixes - 21.7.14</h1>
<ul>
<li>Fix <code>activate.csh</code> failing with <code>Event not
found</code> when the virtual environment path contains <code>!</code>.
(:issue:<code>3256</code>)</li>
</ul>
<hr />
<p>v21.7.13 (2026-09-18)</p>
<hr />
<h1>Bugfixes - 21.7.13</h1>
<ul>
<li>Fix <code>activate</code> and <code>activate.fish</code> running
commands embedded in the virtual environment path or in the
interpreter's Tcl/Tk library paths. (:issue:<code>3252</code>)</li>
</ul>
<hr />
<p>v21.7.12 (2026-09-18)</p>
<hr />
<h1>Bugfixes - 21.7.12</h1>
<ul>
<li>Fix <code>activate.bat</code> running arbitrary commands from a
crafted <code>--prompt</code>, <code>VIRTUALENV_PROMPT</code>, or config
file
value. (:issue:<code>3250</code>)</li>
<li>Verify a downloaded seed wheel's sha256 against PyPI before seeding
it into a virtual environment, skipped when a
custom pip index is configured. (:issue:<code>3251</code>)</li>
</ul>
<hr />
<p>v21.7.11 (2026-09-17)</p>
<hr />
<h1>Bugfixes - 21.7.11</h1>
<ul>
<li>Running <code>activate.bat</code> again before
<code>deactivate</code> no longer makes <code>deactivate</code> leave
the environment's
<code>PKG_CONFIG_PATH</code>, <code>TCL_LIBRARY</code> and
<code>TK_LIBRARY</code> behind, or lose values the user had set before
the first
activation - by :user:<code>darrenhuai</code>.
(:issue:<code>3245</code>)</li>
<li>Write <code>pyvenv.cfg</code> values on a single line, so a prompt
carrying a line boundary can no longer inject configuration.
<code>--prompt</code>, the <code>VIRTUALENV_PROMPT</code> environment
variable and the config file all set the prompt, and
<code>pyvenv.cfg</code> has no escape syntax, so a newline, a carriage
return, or any other boundary <code>str.splitlines</code>
recognizes, such as <code>U+2028</code>, started a new configuration
line. Reading the file back picked up those lines as keys,
and since the last value for a key wins, they replaced anything written
earlier, including <code>home</code>. (:issue:<code>3247</code>)</li>
</ul>
<h1>Improved Documentation - 21.7.11</h1>
<ul>
<li>Document the policy for AI-assisted contributions and the licensing
rules for dependencies. (:issue:<code>3239</code>)</li>
</ul>
<p>Misc - 21.7.11</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/virtualenv/commit/9baea3c1212d8f8b083337afcb28005ecb27385d"><code>9baea3c</code></a>
release 21.7.14</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/ab3dcff43d7ba8abc516e58c24f9bbb6e408d971"><code>ab3dcff</code></a>
🐛 fix(activation): escape ! for csh history expansion (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3256">#3256</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/0c295ff1a5f298e8e11935e3588f59f7455c1f8f"><code>0c295ff</code></a>
release 21.7.13</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6"><code>4d5a105</code></a>
🐛 fix(activation): stop path command injection in bash and fish (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3252">#3252</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/0525dcea21865059ffedc70054f6f982be723992"><code>0525dce</code></a>
👷 ci: scope the nushell apt key to its own repo (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3253">#3253</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/aa8323a907834e9c16fb734613ce41a6d7e27260"><code>aa8323a</code></a>
🔧 chore: drop misc as a changelog fragment type (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3255">#3255</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/a43547765e017f3a13f029e24c6e6f73882e15bc"><code>a435477</code></a>
👷 ci: correct a stale checkout pin comment (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3254">#3254</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/9666b42afc8d6103e765d77958d7bae782f5406e"><code>9666b42</code></a>
release 21.7.12</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/a01ed3e2f239d6ab1fce62c5c7664ccf268fff6d"><code>a01ed3e</code></a>
🐛 fix(seed): verify downloaded wheel digests (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3251">#3251</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/d721ff140ce4afdc2a9b76751e4584e25d9fbea6"><code>d721ff1</code></a>
🐛 fix(activation): escape batch quote() against injection (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3250">#3250</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pypa/virtualenv/compare/21.7.9...21.7.14">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Latest Branches
0%
muhammad-a-dev:docs/unix-connector-url-examples 0%
dependabot/pip/virtualenv-21.7.14 0%
dependabot/pip/python-discovery-1.6.1 © 2026 CodSpeed Technology