[dependabot]

Bumps virtualenv from 21.7.1 to 21.14.9.

Release notes

Sourced from virtualenv's releases.

21.14.9

Bugfixes - 21.14.9

• Parse VIRTUALENV_PERIODIC_UPDATE_INSECURE as a boolean, so 0, false, no and off keep certificate verification enabled. (#3398)

• Reject destinations whose resolved path contains the platform's PATH separator, including separators inherited from the working directory or a directory symlink. (#3399)

• Preserve an existing pyvenv.cfg when a prompt or configuration value cannot be encoded as UTF-8, instead of leaving the file empty after a failed environment creation. The file now ends its lines with LF on every platform.

  Debug logs show each configuration line as a Python string literal, so control characters are visible. (#3400)

• Skip writing a .venv redirect when the environment name contains a line boundary. The environment is still created, and any existing redirect remains unchanged. (#3401)

• Preserve non-ASCII values in activate_this.py when applications read the script with a legacy text encoding before executing it. (#3402)

• Reject malformed seed versions and requirements ending in archive suffixes before starting pip, with an error identifying the invalid value instead of a misleading download or local-file error. (#3403)

• Allow a literal percent sign as a csh prompt and preserve carets in tcsh prompt display instead of interpreting them as control-character notation.

  Separate csh history and prompt escapes from preceding non-ASCII text in legacy locales. (#3404)

• Report an error when an existing pyvenv.cfg is not a regular file, instead of trying to read or write directories, pipes, or devices as configuration files. (#3405)

• Preserve percent-containing paths during batch reactivation and show dollar signs literally in command prompts. Skip batch scripts for paths containing line boundaries, and remove stale batch scripts for unsupported paths even when only other activators are selected. (#3406)

• Compile shared seed-cache bytecode without loading site customizations from the destination environment or importing modules from the current working directory. (#3407)

• Keep the bundled seed version when a cached periodic update is older, and stop recording downloads below the bundled version during update checks. (#3408)

• Stop activating a moved environment, leaving PATH unchanged, when the shell is not bash, the script is evaluated or read from standard input, a path tool fails, the sourced file is not the environment's own activation script, or the new location has no pyvenv.cfg, instead of continuing with an incorrect environment path. (#3409)

• Reject built-in options with missing values before creating the application-data directory or starting interpreter discovery, instead of reporting the argument error after those operations. (#3410)

• Keep unset-variable bookkeeping out of exported xonsh variables, so child shells do not restore an internal sentinel as PYTHONHOME. Skip xonsh activation for destination names that its PATH handling would expand to a different path.

  Restore unset Tcl/Tk library variables when switching between environments in one xonsh session.

  Preserve non-ASCII paths and prompts when xonsh reads activation scripts with a legacy encoding. (#3411)

• Skip default shell activators with a warning when a POSIX path encoding is incompatible with their UTF-8 scripts. Explicitly requested incompatible shell activators still report an error. Environments created with --activators= or --activators=python remain supported in legacy locales. Undecodable parent paths are now caught before any shell activation script is written. (#3412)

... (truncated)

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.14.9

• Parse VIRTUALENV_PERIODIC_UPDATE_INSECURE as a boolean, so 0, false, no and off keep certificate verification enabled. (:issue:3398)

• Reject destinations whose resolved path contains the platform's PATH separator, including separators inherited from the working directory or a directory symlink. (:issue:3399)

• Preserve an existing pyvenv.cfg when a prompt or configuration value cannot be encoded as UTF-8, instead of leaving the file empty after a failed environment creation. The file now ends its lines with LF on every platform.

  Debug logs show each configuration line as a Python string literal, so control characters are visible. (:issue:3400)

• Skip writing a .venv redirect when the environment name contains a line boundary. The environment is still created, and any existing redirect remains unchanged. (:issue:3401)

• Preserve non-ASCII values in activate_this.py when applications read the script with a legacy text encoding before executing it. (:issue:3402)

• Reject malformed seed versions and requirements ending in archive suffixes before starting pip, with an error identifying the invalid value instead of a misleading download or local-file error. (:issue:3403)

• Allow a literal percent sign as a csh prompt and preserve carets in tcsh prompt display instead of interpreting them as control-character notation.

  Separate csh history and prompt escapes from preceding non-ASCII text in legacy locales. (:issue:3404)

• Report an error when an existing pyvenv.cfg is not a regular file, instead of trying to read or write directories, pipes, or devices as configuration files. (:issue:3405)

• Preserve percent-containing paths during batch reactivation and show dollar signs literally in command prompts. Skip batch scripts for paths containing line boundaries, and remove stale batch scripts for unsupported paths even when only other activators are selected. (:issue:3406)

• Compile shared seed-cache bytecode without loading site customizations from the destination environment or importing modules from the current working directory. (:issue:3407)

• Keep the bundled seed version when a cached periodic update is older, and stop recording downloads below the bundled version during update checks. (:issue:3408)

• Stop activating a moved environment, leaving PATH unchanged, when the shell is not bash, the script is evaluated or read from standard input, a path tool fails, the sourced file is not the environment's own activation script, or the new location has no pyvenv.cfg, instead of continuing with an incorrect environment path. (:issue:3409)

• Reject built-in options with missing values before creating the application-data directory or starting interpreter discovery, instead of reporting the argument error after those operations. (:issue:3410)

• Keep unset-variable bookkeeping out of exported xonsh variables, so child shells do not restore an internal sentinel as PYTHONHOME. Skip xonsh activation for destination names that its PATH handling would expand to a different path.

  Restore unset Tcl/Tk library variables when switching between environments in one xonsh session.

  Preserve non-ASCII paths and prompts when xonsh reads activation scripts with a legacy encoding. (:issue:3411)

• Skip default shell activators with a warning when a POSIX path encoding is incompatible with their UTF-8 scripts. Explicitly requested incompatible shell activators still report an error. Environments created with --activators= or --activators=python remain supported in legacy locales. Undecodable parent paths are now caught before any shell activation script is written. (:issue:3412)

• Keep apostrophes and backslashes in fish activation values separate from preceding non-ASCII characters, so fish 3

... (truncated)

Commits

• e53e30b release 21.14.9
• 2519941 🐛 fix(seed): preserve interpreter paths in console scripts (#3417)
• 70a0102 🐛 fix(seed): preserve shared cache when reseeding with pip (#3423)
• 554d9f9 🐛 fix(create): replace linked output directories (#3429)
• 7babec6 🐛 fix(seed): verify wheels before caching (#3430)
• 2dc8bd8 🐛 fix(subprocess): omit implicit helper import paths (#3416)
• d25f286 🐛 fix(create): replace generated file links (#3431)
• e3cea6f 🐛 fix(seed): contain metadata cleanup (#3428)
• 2bfdc02 🐛 fix(path): preserve link targets on delete errors (#3427)
• 6196d35 🐛 fix(seed): retain the parent installation for updates (#3420)
• Additional commits viewable in compare view

[opentelemetry-pr-dashboard]

Pull request dashboard status

Waiting on reviewers · refreshed 2026-10-22 04:10 UTC

Review the latest changes.

Status above doesn't look right?

• Just replied or pushed? Anything around or after the refresh time above may not be picked up yet — give it a few minutes.
• Anything look wrong? Report it with what you expected; it helps us improve the dashboard.