Skip to content

chore(deps): bump virtualenv from 21.3.3 to 21.7.13 - #75

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/virtualenv-21.7.13
Closed

chore(deps): bump virtualenv from 21.3.3 to 21.7.13#75
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/virtualenv-21.7.13

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 6, 2026

Copy link
Copy Markdown
Contributor

Bumps virtualenv from 21.3.3 to 21.7.13.

Release notes

Sourced from virtualenv's releases.

21.7.13

What's Changed

Full Changelog: pypa/virtualenv@21.7.12...21.7.13

21.7.12

What's Changed

Full Changelog: pypa/virtualenv@21.7.11...21.7.12

21.7.11

What's Changed

Full Changelog: pypa/virtualenv@21.7.10...21.7.11

21.7.10

What's Changed

... (truncated)

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.7.13

  • Fix activate and activate.fish running commands embedded in the virtual environment path or in the interpreter's Tcl/Tk library paths. (:issue:3252)

v21.7.12 (2026-09-18)

Bugfixes - 21.7.12

  • Fix activate.bat running arbitrary commands from a crafted --prompt, VIRTUALENV_PROMPT, or config file value. (:issue:3250)
  • Verify a downloaded seed wheel's sha256 against PyPI before seeding it into a virtual environment, skipped when a custom pip index is configured. (:issue:3251)

v21.7.11 (2026-09-17)

Bugfixes - 21.7.11

  • Running activate.bat again before deactivate no longer makes deactivate leave the environment's PKG_CONFIG_PATH, TCL_LIBRARY and TK_LIBRARY behind, or lose values the user had set before the first activation - by :user:darrenhuai. (:issue:3245)
  • Write pyvenv.cfg values on a single line, so a prompt carrying a line boundary can no longer inject configuration. --prompt, the VIRTUALENV_PROMPT environment variable and the config file all set the prompt, and pyvenv.cfg has no escape syntax, so a newline, a carriage return, or any other boundary str.splitlines recognizes, such as U+2028, started a new configuration line. Reading the file back picked up those lines as keys, and since the last value for a key wins, they replaced anything written earlier, including home. (:issue:3247)

Improved Documentation - 21.7.11

  • Document the policy for AI-assisted contributions and the licensing rules for dependencies. (:issue:3239)

Misc - 21.7.11

  • :issue:3238, :issue:3240, :issue:3241, :issue:3242, :issue:3243, :issue:3244, :issue:3246

v21.7.10 (2026-09-15)

Bugfixes - 21.7.10

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump virtualenv from 21.3.3 to 21.7.13
7652ea3 
Bumps [virtualenv](https://github.com/pypa/virtualenv) from 21.3.3 to 21.7.13.
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@21.3.3...21.7.13)

---
updated-dependencies:
- dependency-name: virtualenv
  dependency-version: 21.7.13
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 6, 2026
@labro-bot

labro-bot Bot commented Oct 7, 2026

Copy link
Copy Markdown
Contributor

Labro picking up. Assigning to claude-code:claude-sonnet-5.

@labro-bot

labro-bot Bot commented Oct 7, 2026

Copy link
Copy Markdown
Contributor

Semver risk: minor — 21.3.3 → 21.7.13 (major component 21 unchanged, 21.Y.Z minor 3→7). virtualenv is a transitive dev-tooling dependency here (not imported by src/labro/), so even a riskier bump would have limited blast radius on the running harness.

Changes in this release (21.3.3 → 21.7.13, highlights):

  • activate/activate.fish: fixed command injection via a crafted virtualenv path or the interpreter's Tcl/Tk library paths (#3252, shipped in 21.7.13).
  • activate.bat: fixed arbitrary command execution via a crafted --prompt / VIRTUALENV_PROMPT / config value (#3250, 21.7.12).
  • Seed wheel installs now verify the downloaded wheel's sha256 against PyPI before seeding (#3251, 21.7.12).
  • pyvenv.cfg: values are now written on a single line, closing a newline/line-boundary injection where a crafted prompt could inject arbitrary config keys, including overriding home (#3247, 21.7.11).
  • deactivate no longer leaks PKG_CONFIG_PATH/TCL_LIBRARY/TK_LIBRARY state across repeated activations (#3245, 21.7.11).
  • Remainder is CI/tooling/doc housekeeping across ~40 releases. No CVE IDs are actually attached to this range — a CVE-2026-24049 changelog fragment was explicitly dropped as dead/retracted (21.7.12), i.e. it didn't apply. The fixes above are real hardening even without a formal CVE.

Lock file: clean. Only two entries changed: virtualenv (21.3.3→21.7.13) and its direct dependency python-discovery (1.3.1→1.6.1, listed under virtualenv's dependencies in uv.lock). All other 62 packages are byte-for-byte identical between main and this branch — the large raw diff stat is just uv.lock's formatting churn, not extra transitive movement.

Prior pins: none found. virtualenv doesn't appear in pyproject.toml (it's pulled in transitively, not a direct project dependency), and git log -p -- pyproject.toml has no prior manual pin or comment referencing it.

Conflict check: clean. CI's ci job ran uv sync --extra dev against this branch's lock file — resolved and installed all 64 packages with no resolver errors.

CI: ci job passing (ruff check, ruff format --check, mypy, bandit, and all 446 pytest tests green). dependency-audit is failing, but for a reason unrelated to this bump: pip-audit flags urllib3==2.7.0 for three known advisories (PYSEC-2026-4177, PYSEC-2026-4176, PYSEC-2026-4175; fix is 2.8.0). urllib3 is pinned at 2.7.0 on both main and this branch — this PR doesn't touch it, and the failure would reproduce identically on main today. Pre-existing issue, not a blocker introduced here; worth a follow-up bump of urllib3 to >=2.8.0.

Recommendation: ✅ Safe to merge — the dependency-audit failure is a pre-existing, unrelated urllib3 finding, not something this PR introduces or should be blocked on.

@labro-bot

labro-bot Bot commented Oct 7, 2026

Copy link
Copy Markdown
Contributor

Labro's agent (claude-code) ran out of turns before completing this pr.

Reason: error_max_turns

@dependabot @github

dependabot Bot commented on behalf of github Oct 25, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #77.

@dependabot dependabot Bot closed this Oct 25, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/virtualenv-21.7.13 branch October 25, 2026 01:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

ai-contributed ai-failed dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants