[dependabot]

Bumps virtualenv from 21.7.13 to 21.14.13.

Release notes

Sourced from virtualenv's releases.

21.14.13

Bugfixes - 21.14.13

• Stop bash running commands from --prompt or an environment name containing $(...), backticks or a backslash after shopt -s promptvars, set -o posix, or in a child shell that inherits an exported PS1 (GHSA-cx6f-vjhg-g3cc); reported by rozzkml. zsh now draws the prompt from psvar[9], which is never parsed as shell syntax.

  Write the .venv redirect and the wheel RECORD with exclusive create, so a link planted after the existence check cannot redirect the write. On POSIX, a read-only .venv redirect that points at a virtualenv is replaced. (#3466)

PyPI release

Full Changelog: pypa/virtualenv@21.14.12...21.14.13

21.14.12

Bugfixes - 21.14.12

• Upgrade embedded wheels:

  • setuptools to 84.2.1 from 84.0.0
  • pip to 26.2.2 from 26.2.1 (#3452)

Improved Documentation - 21.14.12

• Require a pull request news fragment and a matching changelog section before publishing. (#3445)

PyPI release

Full Changelog: pypa/virtualenv@21.14.11...21.14.12

21.14.11

Bugfixes - 21.14.11

• Search all directories supplied by repeated --extra-search-dir options instead of keeping only the last group. (#3440)
• On Windows, the app data is now migrated into the nested cache directory instead of the migration failing with a warning on every run. (#3441)

PyPI release

... (truncated)

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.14.13

• Stop bash running commands from --prompt or an environment name containing $(...), backticks or a backslash after shopt -s promptvars, set -o posix, or in a child shell that inherits an exported PS1 (GHSA-cx6f-vjhg-g3cc); reported by :user:rozzkml. zsh now draws the prompt from psvar[9], which is never parsed as shell syntax.

  Write the .venv redirect and the wheel RECORD with exclusive create, so a link planted after the existence check cannot redirect the write. On POSIX, a read-only .venv redirect that points at a virtualenv is replaced. (:issue:3466)

---

v21.14.12 (2026-10-21)

---

Bugfixes - 21.14.12

• Upgrade embedded wheels:

  • setuptools to 84.2.1 from 84.0.0
  • pip to 26.2.2 from 26.2.1 (:issue:3452)

Improved Documentation - 21.14.12

• Require a pull request news fragment and a matching changelog section before publishing. (:issue:3445)

---

v21.14.11 (2026-10-18)

---

Bugfixes - 21.14.11

• Search all directories supplied by repeated --extra-search-dir options instead of keeping only the last group. (:issue:3440)
• On Windows, the app data is now migrated into the nested cache directory instead of the migration failing with a warning on every run. (:issue:3441)

---

v21.14.10 (2026-10-17)

---

Bugfixes - 21.14.10

• Always copy seed packages when app-data is temporary, including when symlink seeding is enabled through an environment variable or configuration file. Seeded packages remain available after temporary cache cleanup. (:issue:3437)

... (truncated)

Commits

• 6accbd5 release 21.14.13
• 3598e20 🐛 fix(bash): escape the prompt for every PS1 state (#3466)
• f6512a5 release 21.14.12
• b535726 [pre-commit.ci] pre-commit autoupdate (#3455)
• 7e32366 Fix broken pip and code review links in the docs (#3460)
• 632e56f Upgrade embedded pip/setuptools/wheel and CI test tools (#3452)
• a8bd1a9 chore(deps): bump certifi from 2026.7.22 to 2026.10.19 in /tasks (#3462)
• c82323b chore(deps): bump uv from 0.13.0 to 0.13.4 in /tasks (#3461)
• 863ae6c chore(deps): bump the runtime-dependencies group with 3 updates (#3456)
• 79537b3 👷 ci: pin App token action v3.3.0 (#3449)
• Additional commits viewable in compare view

[dependabot]

Looks like virtualenv is up-to-date now, so this is no longer needed.