[dependabot]

Bumps virtualenv from 21.14.7 to 21.14.11.

Release notes

Sourced from virtualenv's releases.

21.14.11

Bugfixes - 21.14.11

• Search all directories supplied by repeated --extra-search-dir options instead of keeping only the last group. (#3440)
• On Windows, the app data is now migrated into the nested cache directory instead of the migration failing with a warning on every run. (#3441)

PyPI release

Full Changelog: pypa/virtualenv@21.14.10...21.14.11

21.14.10

Bugfixes - 21.14.10

• Always copy seed packages when app-data is temporary, including when symlink seeding is enabled through an environment variable or configuration file. Seeded packages remain available after temporary cache cleanup. (#3437)

PyPI release

Full Changelog: pypa/virtualenv@21.14.9...21.14.10

21.14.9

Bugfixes - 21.14.9

• Parse VIRTUALENV_PERIODIC_UPDATE_INSECURE as a boolean, so 0, false, no and off keep certificate verification enabled. (#3398)

• Reject destinations whose resolved path contains the platform's PATH separator, including separators inherited from the working directory or a directory symlink. (#3399)

• Preserve an existing pyvenv.cfg when a prompt or configuration value cannot be encoded as UTF-8, instead of leaving the file empty after a failed environment creation. The file now ends its lines with LF on every platform.

  Debug logs show each configuration line as a Python string literal, so control characters are visible. (#3400)

• Skip writing a .venv redirect when the environment name contains a line boundary. The environment is still created, and any existing redirect remains unchanged. (#3401)

• Preserve non-ASCII values in activate_this.py when applications read the script with a legacy text encoding before executing it. (#3402)

• Reject malformed seed versions and requirements ending in archive suffixes before starting pip, with an error identifying the invalid value instead of a misleading download or local-file error. (#3403)

• Allow a literal percent sign as a csh prompt and preserve carets in tcsh prompt display instead of interpreting them as control-character notation.

  Separate csh history and prompt escapes from preceding non-ASCII text in legacy locales. (#3404)

• Report an error when an existing pyvenv.cfg is not a regular file, instead of trying to read or write directories, pipes, or devices as configuration files. (#3405)

... (truncated)

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.14.11

• Search all directories supplied by repeated --extra-search-dir options instead of keeping only the last group. (:issue:3440)
• On Windows, the app data is now migrated into the nested cache directory instead of the migration failing with a warning on every run. (:issue:3441)

---

v21.14.10 (2026-10-17)

---

Bugfixes - 21.14.10

• Always copy seed packages when app-data is temporary, including when symlink seeding is enabled through an environment variable or configuration file. Seeded packages remain available after temporary cache cleanup. (:issue:3437)

---

v21.14.9 (2026-10-17)

---

Bugfixes - 21.14.9

• Parse VIRTUALENV_PERIODIC_UPDATE_INSECURE as a boolean, so 0, false, no and off keep certificate verification enabled. (:issue:3398)

• Reject destinations whose resolved path contains the platform's PATH separator, including separators inherited from the working directory or a directory symlink. (:issue:3399)

• Preserve an existing pyvenv.cfg when a prompt or configuration value cannot be encoded as UTF-8, instead of leaving the file empty after a failed environment creation. The file now ends its lines with LF on every platform.

  Debug logs show each configuration line as a Python string literal, so control characters are visible. (:issue:3400)

• Skip writing a .venv redirect when the environment name contains a line boundary. The environment is still created, and any existing redirect remains unchanged. (:issue:3401)

• Preserve non-ASCII values in activate_this.py when applications read the script with a legacy text encoding before executing it. (:issue:3402)

• Reject malformed seed versions and requirements ending in archive suffixes before starting pip, with an error identifying the invalid value instead of a misleading download or local-file error. (:issue:3403)

• Allow a literal percent sign as a csh prompt and preserve carets in tcsh prompt display instead of interpreting them as control-character notation.

  Separate csh history and prompt escapes from preceding non-ASCII text in legacy locales. (:issue:3404)

• Report an error when an existing pyvenv.cfg is not a regular file, instead of trying to read or write directories, pipes, or devices as configuration files. (:issue:3405)

• Preserve percent-containing paths during batch reactivation and show dollar signs literally in command prompts. Skip batch scripts for paths containing line boundaries, and remove stale batch scripts for unsupported paths even when only other activators are selected. (:issue:3406)

... (truncated)

Commits

• 1d1231f release 21.14.11
• b83363b 🐛 fix(app-data): migrate nested cache safely (#3441)
• 8a7de0a Fix repeated --extra-search-dir options (#3440)
• 236f395 release 21.14.10
• cd77476 🐛 fix(test): exclude broken pytest-mock (#3438)
• b81995c 🐛 fix(seed): copy from temporary app-data (#3437)
• e53e30b release 21.14.9
• 2519941 🐛 fix(seed): preserve interpreter paths in console scripts (#3417)
• 70a0102 🐛 fix(seed): preserve shared cache when reseeding with pip (#3423)
• 554d9f9 🐛 fix(create): replace linked output directories (#3429)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)