[dependabot]

Bumps virtualenv from 21.2.0 to 21.14.13.

Release notes

Sourced from virtualenv's releases.

21.14.13

Security

• Stop bash running commands from --prompt or an environment name containing $(...), backticks or a backslash after shopt -s promptvars, set -o posix, or in a child shell that inherits an exported PS1 (GHSA-cx6f-vjhg-g3cc); reported by @​rozzkml. zsh now draws the prompt from psvar[9], which is never parsed as shell syntax. (#3466) by @​gaborbernat.
• Write the .venv redirect and the wheel RECORD with exclusive create, so a link planted after the existence check cannot redirect the write. On POSIX, replace a read-only .venv redirect that points at a virtualenv. (#3466) by @​gaborbernat.

🐍 PyPI release

📜 Full Changelog

21.14.12

Packaging

• Upgrade the embedded setuptools wheel from 84.0.0 to 84.2.1 and the embedded pip wheel from 26.2.1 to 26.2.2. (#3452)

New Contributors

• @​qodelicious made their first contribution in #3460

🐍 PyPI release

📜 Full Changelog

21.14.11

Bug fixes

• Search all directories supplied by repeated --extra-search-dir options instead of keeping only the last group. (#3440) by @​repzakske.
• On Windows, the app data is now migrated into the nested cache directory instead of the migration failing with a warning on every run. (#3441) by @​gaborbernat and @​XXXXXQ-0206.

🐍 PyPI release

📜 Full Changelog

21.14.10

Bug fixes

• Always copy seed packages when app-data is temporary, including when symlink seeding is enabled through an environment variable or configuration file. Seeded packages remain available after temporary cache cleanup. (#3437) by @​gaborbernat.

🐍 PyPI release

📜 Full Changelog

... (truncated)

Changelog

Sourced from virtualenv's changelog.

################# Release History #################

.. towncrier-draft-entries:: [UNRELEASED DRAFT]

.. towncrier release notes start

.. _release-21-15-1:

---

21.15.1 (2026-10-28)

---

.. _release-21-15-1-fixed:

Fixed

• Keep the name of a seeded console_scripts entry that contains digits but does not end in a version, such as python3-config or 2to3, instead of truncating it at the first digit; python3-config overwrote the environment's python executable (:pr:3451) by :user:JingHao-Leon and :user:gaborbernat.
• Copy the content of a symlinked directory when a tree is copied into an environment, instead of dropping it (:pr:3454) by :user:JingHao-Leon and :user:gaborbernat.
• Count each -v, -q, -p and --try-first-with option once instead of once per internal parsing pass, so Session.verbosity is 3 rather than 9 for a single -v (:pr:3457) by :user:darrenhuai and :user:gaborbernat.
• Copy the seed packages instead of failing when VIRTUALENV_SYMLINK_APP_DATA or symlink_app_data in the config file turns on symlink seeding on a host that cannot create symlinks, such as Windows without the symlink privilege (:pr:3465) by :user:darrenhuai and :user:gaborbernat.
• Run the interpreter that collects the target debug information (-vv output and Creator.debug) without PYTHONPATH and with the environment passed to cli_run, so the reported sys.path no longer lists the caller's PYTHONPATH entries (:pr:3474) by :user:RaphaelFakhri and :user:gaborbernat.

.. _release-21-15-0:

---

21.15.0 (2026-10-27)

---

.. _release-21-15-0-added:

Added

• Bundle dependencies for Python 3.15 in the standalone zipapp and stop bundling Python 3.8, which is outside the package's supported range (:pr:3458) by :user:gaborbernat.

.. _release-21-15-0-packaging:

... (truncated)

Commits

• 6accbd5 release 21.14.13
• 3598e20 🐛 fix(bash): escape the prompt for every PS1 state (#3466)
• f6512a5 release 21.14.12
• b535726 [pre-commit.ci] pre-commit autoupdate (#3455)
• 7e32366 Fix broken pip and code review links in the docs (#3460)
• 632e56f Upgrade embedded pip/setuptools/wheel and CI test tools (#3452)
• a8bd1a9 chore(deps): bump certifi from 2026.7.22 to 2026.10.19 in /tasks (#3462)
• c82323b chore(deps): bump uv from 0.13.0 to 0.13.4 in /tasks (#3461)
• 863ae6c chore(deps): bump the runtime-dependencies group with 3 updates (#3456)
• 79537b3 👷 ci: pin App token action v3.3.0 (#3449)
• Additional commits viewable in compare view

[claude]

LGTM, a routine uv.lock dependency bump.
What was reviewed: the exclude-newer metadata normalization, the python-discovery version bump (1.2.0 to 1.6.1, dropping its platformdirs dependency), the virtualenv bump (21.2.0 to 21.7.13), and the relaxed exceptiongroup→typing-extensions marker — all mechanical lockfile changes with matching hashes, no application code touched.

Extended reasoning...

The only changed file is uv.lock: a dependabot-driven bump of virtualenv and its transitive python-discovery dependency, plus a normalized exclude-newer timestamp and a loosened version marker on typing-extensions for exceptiongroup. No source, test, or doc files changed; the surface touched is dev/build tooling resolution, not runtime or security-sensitive application code. The version/hash pairs in the diff are internally consistent and the virtualenv release notes describe security fixes, not new risk, so this is a safe, mechanical bump.

[dependabot]

Dependabot can't resolve your Python dependency files. Because of this, Dependabot cannot update this pull request.

[dependabot]

Dependabot can't resolve your Python dependency files. Because of this, Dependabot cannot update this pull request.