[dependabot]

Bumps virtualenv from 21.14.7 to 21.14.13.

Release notes

Sourced from virtualenv's releases.

21.14.13

Security

• Stop bash running commands from --prompt or an environment name containing $(...), backticks or a backslash after shopt -s promptvars, set -o posix, or in a child shell that inherits an exported PS1 (GHSA-cx6f-vjhg-g3cc); reported by @​rozzkml. zsh now draws the prompt from psvar[9], which is never parsed as shell syntax. (#3466) by @​gaborbernat.
• Write the .venv redirect and the wheel RECORD with exclusive create, so a link planted after the existence check cannot redirect the write. On POSIX, replace a read-only .venv redirect that points at a virtualenv. (#3466) by @​gaborbernat.

🐍 PyPI release

📜 Full Changelog

21.14.12

Packaging

• Upgrade the embedded setuptools wheel from 84.0.0 to 84.2.1 and the embedded pip wheel from 26.2.1 to 26.2.2. (#3452)

New Contributors

• @​qodelicious made their first contribution in #3460

🐍 PyPI release

📜 Full Changelog

21.14.11

Bug fixes

• Search all directories supplied by repeated --extra-search-dir options instead of keeping only the last group. (#3440) by @​repzakske.
• On Windows, the app data is now migrated into the nested cache directory instead of the migration failing with a warning on every run. (#3441) by @​gaborbernat and @​XXXXXQ-0206.

🐍 PyPI release

📜 Full Changelog

21.14.10

Bug fixes

• Always copy seed packages when app-data is temporary, including when symlink seeding is enabled through an environment variable or configuration file. Seeded packages remain available after temporary cache cleanup. (#3437) by @​gaborbernat.

🐍 PyPI release

📜 Full Changelog

... (truncated)

Changelog

Sourced from virtualenv's changelog.

################# Release History #################

.. towncrier-draft-entries:: [UNRELEASED DRAFT]

.. towncrier release notes start

.. _release-21-15-3:

---

21.15.3 (2026-11-03)

---

.. _release-21-15-3-fixed:

Fixed

• Add the environment's lib/pkgconfig to PKG_CONFIG_PATH when activating from xonsh, and restore the previous value or unset it again on deactivate, as the other activators already do (:pr:3505) by :user:darrenhuai and :user:gaborbernat.
• Read virtualenv.ini values without interpolation, as environment variables and command line flags already are. A value holding a %, such as prompt = 50% done, was ignored without any message. %% and %(name)s are now kept as written, so write a single % (:pr:3501) by :user:darrenhuai and :user:gaborbernat.
• Reject a destination that already exists but is not a directory, such as /dev/null, a FIFO or a socket, or that sits inside one, with a usage error instead of a NotADirectoryError once creation has started. A regular file now gets the same is not a directory message instead of is a file (:pr:3504) by :user:darrenhuai and :user:gaborbernat.
• Set TCL_LIBRARY and TK_LIBRARY to the interpreter's Tcl/Tk paths in activate.nu, as the other activators do. Nushell activation used to leave both variables as they were (:pr:3502) by :user:darrenhuai and :user:gaborbernat.
• Show the environment name in the zsh prompt when KSH_ARRAYS is set at activation. Since 21.14.13 the prompt read an empty psvar entry under that option and showed () instead of the name (:pr:3506) by :user:PDGGK and :user:gaborbernat.
• Treat an empty or blank VIRTUALENV_OVERRIDE_APP_DATA and an empty VIRTUALENV_CONFIG_FILE as unset, as virtualenv already does for its option variables. An empty app-data override, or on Windows one made of spaces, made the current directory the cache, so --reset-app-data deleted it, and an empty config file path logged an error on every run (:pr:3503) by :user:darrenhuai and :user:gaborbernat.

.. _release-21-15-2:

---

21.15.2 (2026-10-30)

---

.. _release-21-15-2-fixed:

Fixed

... (truncated)

Commits

• 6accbd5 release 21.14.13
• 3598e20 🐛 fix(bash): escape the prompt for every PS1 state (#3466)
• f6512a5 release 21.14.12
• b535726 [pre-commit.ci] pre-commit autoupdate (#3455)
• 7e32366 Fix broken pip and code review links in the docs (#3460)
• 632e56f Upgrade embedded pip/setuptools/wheel and CI test tools (#3452)
• a8bd1a9 chore(deps): bump certifi from 2026.7.22 to 2026.10.19 in /tasks (#3462)
• c82323b chore(deps): bump uv from 0.13.0 to 0.13.4 in /tasks (#3461)
• 863ae6c chore(deps): bump the runtime-dependencies group with 3 updates (#3456)
• 79537b3 👷 ci: pin App token action v3.3.0 (#3449)
• Additional commits viewable in compare view