build(deps): bump virtualenv from 21.7.13 to 21.14.9 by dependabot[bot] · Pull Request #474 · hellices/korvid

dependabot · 2026-10-23T10:15:24Z

Bumps virtualenv from 21.7.13 to 21.14.9.

Release notes

21.14.9

Bugfixes - 21.14.9

Parse VIRTUALENV_PERIODIC_UPDATE_INSECURE as a boolean, so 0, false, no and off keep certificate verification enabled. (#3398)

Reject destinations whose resolved path contains the platform's PATH separator, including separators inherited from the working directory or a directory symlink. (#3399)

Preserve an existing pyvenv.cfg when a prompt or configuration value cannot be encoded as UTF-8, instead of leaving the file empty after a failed environment creation. The file now ends its lines with LF on every platform.

Debug logs show each configuration line as a Python string literal, so control characters are visible. (#3400)

Skip writing a .venv redirect when the environment name contains a line boundary. The environment is still created, and any existing redirect remains unchanged. (#3401)

Preserve non-ASCII values in activate_this.py when applications read the script with a legacy text encoding before executing it. (#3402)

Reject malformed seed versions and requirements ending in archive suffixes before starting pip, with an error identifying the invalid value instead of a misleading download or local-file error. (#3403)

Allow a literal percent sign as a csh prompt and preserve carets in tcsh prompt display instead of interpreting them as control-character notation.

Separate csh history and prompt escapes from preceding non-ASCII text in legacy locales. (#3404)

Report an error when an existing pyvenv.cfg is not a regular file, instead of trying to read or write directories, pipes, or devices as configuration files. (#3405)

Preserve percent-containing paths during batch reactivation and show dollar signs literally in command prompts. Skip batch scripts for paths containing line boundaries, and remove stale batch scripts for unsupported paths even when only other activators are selected. (#3406)

Compile shared seed-cache bytecode without loading site customizations from the destination environment or importing modules from the current working directory. (#3407)

Keep the bundled seed version when a cached periodic update is older, and stop recording downloads below the bundled version during update checks. (#3408)

Stop activating a moved environment, leaving PATH unchanged, when the shell is not bash, the script is evaluated or read from standard input, a path tool fails, the sourced file is not the environment's own activation script, or the new location has no pyvenv.cfg, instead of continuing with an incorrect environment path. (#3409)

Reject built-in options with missing values before creating the application-data directory or starting interpreter discovery, instead of reporting the argument error after those operations. (#3410)

Keep unset-variable bookkeeping out of exported xonsh variables, so child shells do not restore an internal sentinel as PYTHONHOME. Skip xonsh activation for destination names that its PATH handling would expand to a different path.

Restore unset Tcl/Tk library variables when switching between environments in one xonsh session.

Preserve non-ASCII paths and prompts when xonsh reads activation scripts with a legacy encoding. (#3411)

Skip default shell activators with a warning when a POSIX path encoding is incompatible with their UTF-8 scripts. Explicitly requested incompatible shell activators still report an error. Environments created with --activators= or --activators=python remain supported in legacy locales. Undecodable parent paths are now caught before any shell activation script is written. (#3412)

... (truncated)

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.14.9

Parse VIRTUALENV_PERIODIC_UPDATE_INSECURE as a boolean, so 0, false, no and off keep certificate verification enabled. (:issue:3398)

Reject destinations whose resolved path contains the platform's PATH separator, including separators inherited from the working directory or a directory symlink. (:issue:3399)

Preserve an existing pyvenv.cfg when a prompt or configuration value cannot be encoded as UTF-8, instead of leaving the file empty after a failed environment creation. The file now ends its lines with LF on every platform.

Debug logs show each configuration line as a Python string literal, so control characters are visible. (:issue:3400)

Skip writing a .venv redirect when the environment name contains a line boundary. The environment is still created, and any existing redirect remains unchanged. (:issue:3401)

Preserve non-ASCII values in activate_this.py when applications read the script with a legacy text encoding before executing it. (:issue:3402)

Reject malformed seed versions and requirements ending in archive suffixes before starting pip, with an error identifying the invalid value instead of a misleading download or local-file error. (:issue:3403)

Allow a literal percent sign as a csh prompt and preserve carets in tcsh prompt display instead of interpreting them as control-character notation.

Separate csh history and prompt escapes from preceding non-ASCII text in legacy locales. (:issue:3404)

Report an error when an existing pyvenv.cfg is not a regular file, instead of trying to read or write directories, pipes, or devices as configuration files. (:issue:3405)

Preserve percent-containing paths during batch reactivation and show dollar signs literally in command prompts. Skip batch scripts for paths containing line boundaries, and remove stale batch scripts for unsupported paths even when only other activators are selected. (:issue:3406)

Compile shared seed-cache bytecode without loading site customizations from the destination environment or importing modules from the current working directory. (:issue:3407)

Keep the bundled seed version when a cached periodic update is older, and stop recording downloads below the bundled version during update checks. (:issue:3408)

Stop activating a moved environment, leaving PATH unchanged, when the shell is not bash, the script is evaluated or read from standard input, a path tool fails, the sourced file is not the environment's own activation script, or the new location has no pyvenv.cfg, instead of continuing with an incorrect environment path. (:issue:3409)

Reject built-in options with missing values before creating the application-data directory or starting interpreter discovery, instead of reporting the argument error after those operations. (:issue:3410)

Keep unset-variable bookkeeping out of exported xonsh variables, so child shells do not restore an internal sentinel as PYTHONHOME. Skip xonsh activation for destination names that its PATH handling would expand to a different path.

Restore unset Tcl/Tk library variables when switching between environments in one xonsh session.

Preserve non-ASCII paths and prompts when xonsh reads activation scripts with a legacy encoding. (:issue:3411)

Skip default shell activators with a warning when a POSIX path encoding is incompatible with their UTF-8 scripts. Explicitly requested incompatible shell activators still report an error. Environments created with --activators= or --activators=python remain supported in legacy locales. Undecodable parent paths are now caught before any shell activation script is written. (:issue:3412)

Keep apostrophes and backslashes in fish activation values separate from preceding non-ASCII characters, so fish 3

... (truncated)

Commits

e53e30b release 21.14.9
2519941 🐛 fix(seed): preserve interpreter paths in console scripts (#3417)
70a0102 🐛 fix(seed): preserve shared cache when reseeding with pip (#3423)
554d9f9 🐛 fix(create): replace linked output directories (#3429)
7babec6 🐛 fix(seed): verify wheels before caching (#3430)
2dc8bd8 🐛 fix(subprocess): omit implicit helper import paths (#3416)
d25f286 🐛 fix(create): replace generated file links (#3431)
e3cea6f 🐛 fix(seed): contain metadata cleanup (#3428)
2bfdc02 🐛 fix(path): preserve link targets on delete errors (#3427)
6196d35 🐛 fix(seed): retain the parent installation for updates (#3420)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [virtualenv](https://github.com/pypa/virtualenv) from 21.7.13 to 21.14.9. - [Release notes](https://github.com/pypa/virtualenv/releases) - [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst) - [Commits](pypa/virtualenv@21.7.13...21.14.9) --- updated-dependencies: - dependency-name: virtualenv dependency-version: 21.14.9 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

my-reviewer-agent

결정적 검사만 수행한 변경입니다.

리뷰 범위: 변경사항 일부만 검토했습니다.

virtualenv 21.14.9, the version Dependabot proposed in #474, introduced GHSA-cx6f-vjhg-g3cc / CVE-2026-115586 (high): the Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it. The advisory was published on 2026-10-23, after #474 passed its checks, and this branch's dependency-review check failed on it. It is fixed in 21.14.13, which still allows filelock<5 and needs packaging>=26.3, both already locked here. These are the bytes the Relock workflow produced and verified on this branch: run 40158406513, package=virtualenv, base cd253a2. Its relock job resolved on a runner with direct PyPI access, confirmed every url, registry and index names PyPI, and ran uv sync --locked, ruff, the format check, mypy, tach and the test suite (13,753 passed). Its propose job hit #481 again, so the relocked-lock artifact was committed by hand after matching its SHA-256 to the digest the relock job recorded (1de17a61...95da) and re-checking it with main's scripts/check_lock_hosts.py. Only the virtualenv block changes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…ecurity bumps (#482) * test: drop the relay child-watcher race from stdio stderr checks test_stdout_noise_is_diverted_and_wire_is_restored[True] failed on 3.12 because the stdio server's stderr carried "child process pid 3098 exit status already read: will report returncode 255" (#472). relay=True forces the Windows-only relays onto POSIX. When the stdin relay exits on its own as the test closes stdin, and _relay_stdin's cleanup runs before the event loop has processed that exit, process.kill() goes through Popen.send_signal, which polls first (bpo-38630). That waitpid reaps the relay, and asyncio's child watcher then finds it gone, reports 255 and logs the warning. On Windows, where the relays run in production, nothing reaps. The three forced-relay tests that compare the server's stderr exactly now read it through _server_stderr, which drops whole lines matching either watcher's warning (pidfd: "exit status already read", threaded: "Unknown child process pid") and keeps everything else. Two tests pin both directions: both warnings are dropped with the surrounding lines intact, and a line that only contains one is kept. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * test: emit the relay watcher race in every forced-relay run The race is rare on its own, so the first fix only covered the three exact stderr checks it was seen against. Under four xdist workers on korvid-runners it hit a fourth on 3.12, twice: test_stdio_delivers_large_utf8_output_without_truncation[True] expected an empty stderr log and got "child process pid ... exit status already read: will report returncode 255". The forced-relay entrypoint now logs that exact asyncio warning at startup, so every relay=True test that reads the server's stderr has to filter it on every run instead of passing on a lucky one. With the line emitted, exactly that test failed; it now reads its stderr log through _server_stderr, which accepts text as well as bytes, and test_stdio.py passes in full. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: drop agent events that arrive while the app shuts down Textual's App._shutdown clears _running, removes every screen and widget, and only then sends the App its Unmount, which is where KorvidApp marks the agent session down. A turn the user interrupted just before quitting can settle in between. _finish_interrupted_turn then still sees _shutting_down as False and hands its TurnInterrupted to the panel port, which looks the panel up on a pruned screen. The resulting NoMatches fails the turn task and escapes app shutdown through wait_for_turn (#476). On #471's CI it surfaced as "No nodes match '#agent-status' on AgentPanel()". AppAgentPanel.apply_event, the one place agent events reach the panel, now drops an event once the app is no longer running. The new test reproduces the ordering deterministically: the interrupted turn's cleanup waits for the panel's Unmount, so it settles after Textual pruned the panel and before the App's Unmount. Without the guard it fails with NoMatches every run. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * test: wait for an approval dialog to compose before reading it The operation-journey driver read `.confirm-title` as soon as app.screen was a ConfirmScreen. Textual makes a pushed screen current before it composes the screen's widgets, so on a loaded runner the poll landed in between and the read raised "No nodes match '.confirm-title' on ConfirmScreen()". That failed two journeys on main's 3.11 (#478); the second NoMatches in that log came from the journey tearing down after the first. handle() now first waits, through _await_dialog_composed, until the current dialog has its title or is no longer current; a dialog that closes first falls through to the existing closed-before-a-decision path. The new test delays ConfirmScreen's compose by 0.3 seconds and still expects one matched dialog_observed and no hard failures; without the wait it fails every run with CI's exact pair of errors. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * build(deps-dev): bump gitpython from 3.1.62 to 3.2.1 Bumps [gitpython](https://github.com/gitpython-developers/GitPython) from 3.1.62 to 3.2.1. - [Release notes](https://github.com/gitpython-developers/GitPython/releases) - [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/doc/source/changes.rst) - [Commits](gitpython-developers/GitPython@3.1.62...3.2.1) --- updated-dependencies: - dependency-name: gitpython dependency-version: 3.2.1 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> (cherry picked from commit 3861683) * build(deps): bump virtualenv from 21.7.13 to 21.14.9 Bumps [virtualenv](https://github.com/pypa/virtualenv) from 21.7.13 to 21.14.9. - [Release notes](https://github.com/pypa/virtualenv/releases) - [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst) - [Commits](pypa/virtualenv@21.7.13...21.14.9) --- updated-dependencies: - dependency-name: virtualenv dependency-version: 21.14.9 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> (cherry picked from commit 5e10f14) * build: relock filelock Since 2026-10-23 pip-audit fails every branch on filelock 3.32.0: GHSA-v4x8-3wr5-3wq8 (high), GHSA-9vhv-jxww-xfm5 and GHSA-567q-5qvw-pf92, all fixed in 4.2.1 (#480). The locked virtualenv 21.7.13 required filelock<4; the virtualenv 21.14.9 bump in this branch allows <5, so filelock can now move to 4.2.4. These are the bytes the Relock workflow produced and verified on this branch: run 40155755520, package=filelock, base 293d7a8. Its relock job resolved the lock on a runner with direct PyPI access, confirmed every url, registry and index names PyPI, and ran uv sync --locked, ruff, the format check, mypy, tach and the test suite (13,753 passed). Its propose job then could not open a branch, because the base's uv.lock differs from main's (#481), so the relocked-lock artifact was committed by hand after matching its SHA-256 to the digest the relock job recorded before any resolved code ran (493ce1c4...4f96) and re-checking it with main's scripts/check_lock_hosts.py. uv 0.10.9, which the workflow pins, writes lock revision 3 and keeps the httpcore2 and secretstorage markers, so this also returns those lines to main's form: the branch's net lock change is the four version bumps. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * build: relock virtualenv virtualenv 21.14.9, the version Dependabot proposed in #474, introduced GHSA-cx6f-vjhg-g3cc / CVE-2026-115586 (high): the Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it. The advisory was published on 2026-10-23, after #474 passed its checks, and this branch's dependency-review check failed on it. It is fixed in 21.14.13, which still allows filelock<5 and needs packaging>=26.3, both already locked here. These are the bytes the Relock workflow produced and verified on this branch: run 40158406513, package=virtualenv, base cd253a2. Its relock job resolved on a runner with direct PyPI access, confirmed every url, registry and index names PyPI, and ran uv sync --locked, ruff, the format check, mypy, tach and the test suite (13,753 passed). Its propose job hit #481 again, so the relocked-lock artifact was committed by hand after matching its SHA-256 to the digest the relock job recorded (1de17a61...95da) and re-checking it with main's scripts/check_lock_hosts.py. Only the virtualenv block changes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot · 2026-10-25T04:40:13Z

Looks like virtualenv is up-to-date now, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 23, 2026

my-reviewer-agent Bot reviewed Oct 23, 2026

View reviewed changes

This was referenced Oct 25, 2026

Update filelock past GHSA-v4x8-3wr5-3wq8 (needs virtualenv 21.14 first) #480

Closed

Bundle: three race fixes and the gitpython, virtualenv and filelock security bumps #482

Merged

dependabot Bot closed this Oct 25, 2026

dependabot Bot deleted the dependabot/uv/virtualenv-21.14.9 branch October 25, 2026 04:40

Navigation Menu

Repository navigation

build(deps): bump virtualenv from 21.7.13 to 21.14.9 - #474

build(deps): bump virtualenv from 21.7.13 to 21.14.9#474
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/virtualenv-21.14.9

dependabot Bot commented on behalf of github Oct 23, 2026 •

edited

Loading

Uh oh!

my-reviewer-agent Bot left a comment

Uh oh!

dependabot Bot commented on behalf of github Oct 25, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

21.14.9

Bugfixes - 21.14.9

Bugfixes - 21.14.9

Uh oh!

my-reviewer-agent Bot left a comment

Choose a reason for hiding this comment

Uh oh!

dependabot Bot commented on behalf of github Oct 25, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 23, 2026 •

edited

Loading