[dependabot]

Bumps the uv group with 2 updates in the / directory: tornado and virtualenv.

Updates tornado from 6.5.9 to 6.6

Changelog

Sourced from tornado's changelog.

Release notes

.. toctree:: :maxdepth: 2

releases/v6.6.0 releases/v6.5.10 releases/v6.5.9 releases/v6.5.8 releases/v6.5.7 releases/v6.5.6 releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0 releases/v4.0.2

... (truncated)

Commits

• e2b0f45 Merge pull request #3831 from bdarnell/final-6.6
• 90c4e3f Version bump for 6.6 final release
• ec17353 Merge pull request #3828 from bdarnell/downstream-ci-66
• 15f66b0 ci: Add explicit read permission to CI jobs
• 4446441 ci: Run the downstream testbed on a wheel built in the same run
• c2e24d2 Merge pull request #3823 from bdarnell/claude/project-thread-uzh2s8
• c2d8884 test: Add pre-6.3 security fixes to the corpus
• de32687 test: Add a regression corpus of past security fixes
• 7848790 maint: Add pre-tag checks and release instructions
• f14321e ci: Compare benchmarks with the base branch on every PR
• Additional commits viewable in compare view

Updates virtualenv from 21.14.12 to 21.14.13

Release notes

Sourced from virtualenv's releases.

21.14.13

Security

• Stop bash running commands from --prompt or an environment name containing $(...), backticks or a backslash after shopt -s promptvars, set -o posix, or in a child shell that inherits an exported PS1 (GHSA-cx6f-vjhg-g3cc); reported by @​rozzkml. zsh now draws the prompt from psvar[9], which is never parsed as shell syntax. (#3466) by @​gaborbernat.
• Write the .venv redirect and the wheel RECORD with exclusive create, so a link planted after the existence check cannot redirect the write. On POSIX, replace a read-only .venv redirect that points at a virtualenv. (#3466) by @​gaborbernat.

🐍 PyPI release

📜 Full Changelog

Changelog

Sourced from virtualenv's changelog.

################# Release History #################

.. towncrier-draft-entries:: [UNRELEASED DRAFT]

.. towncrier release notes start

.. _release-21-15-3:

---

21.15.3 (2026-11-03)

---

.. _release-21-15-3-fixed:

Fixed

• Add the environment's lib/pkgconfig to PKG_CONFIG_PATH when activating from xonsh, and restore the previous value or unset it again on deactivate, as the other activators already do (:pr:3505) by :user:darrenhuai and :user:gaborbernat.
• Read virtualenv.ini values without interpolation, as environment variables and command line flags already are. A value holding a %, such as prompt = 50% done, was ignored without any message. %% and %(name)s are now kept as written, so write a single % (:pr:3501) by :user:darrenhuai and :user:gaborbernat.
• Reject a destination that already exists but is not a directory, such as /dev/null, a FIFO or a socket, or that sits inside one, with a usage error instead of a NotADirectoryError once creation has started. A regular file now gets the same is not a directory message instead of is a file (:pr:3504) by :user:darrenhuai and :user:gaborbernat.
• Set TCL_LIBRARY and TK_LIBRARY to the interpreter's Tcl/Tk paths in activate.nu, as the other activators do. Nushell activation used to leave both variables as they were (:pr:3502) by :user:darrenhuai and :user:gaborbernat.
• Show the environment name in the zsh prompt when KSH_ARRAYS is set at activation. Since 21.14.13 the prompt read an empty psvar entry under that option and showed () instead of the name (:pr:3506) by :user:PDGGK and :user:gaborbernat.
• Treat an empty or blank VIRTUALENV_OVERRIDE_APP_DATA and an empty VIRTUALENV_CONFIG_FILE as unset, as virtualenv already does for its option variables. An empty app-data override, or on Windows one made of spaces, made the current directory the cache, so --reset-app-data deleted it, and an empty config file path logged an error on every run (:pr:3503) by :user:darrenhuai and :user:gaborbernat.

.. _release-21-15-2:

---

21.15.2 (2026-10-30)

---

.. _release-21-15-2-fixed:

Fixed

... (truncated)

Commits

• 6accbd5 release 21.14.13
• 3598e20 🐛 fix(bash): escape the prompt for every PS1 state (#3466)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.