[dependabot]

Bumps virtualenv from 21.14.5 to 21.14.13.

Release notes

Sourced from virtualenv's releases.

21.14.13

Security

• Stop bash running commands from --prompt or an environment name containing $(...), backticks or a backslash after shopt -s promptvars, set -o posix, or in a child shell that inherits an exported PS1 (GHSA-cx6f-vjhg-g3cc); reported by @​rozzkml. zsh now draws the prompt from psvar[9], which is never parsed as shell syntax. (#3466) by @​gaborbernat.
• Write the .venv redirect and the wheel RECORD with exclusive create, so a link planted after the existence check cannot redirect the write. On POSIX, replace a read-only .venv redirect that points at a virtualenv. (#3466) by @​gaborbernat.

🐍 PyPI release

📜 Full Changelog

21.14.12

Packaging

• Upgrade the embedded setuptools wheel from 84.0.0 to 84.2.1 and the embedded pip wheel from 26.2.1 to 26.2.2. (#3452)

New Contributors

• @​qodelicious made their first contribution in #3460

🐍 PyPI release

📜 Full Changelog

21.14.11

Bug fixes

• Search all directories supplied by repeated --extra-search-dir options instead of keeping only the last group. (#3440) by @​repzakske.
• On Windows, the app data is now migrated into the nested cache directory instead of the migration failing with a warning on every run. (#3441) by @​gaborbernat and @​XXXXXQ-0206.

🐍 PyPI release

📜 Full Changelog

21.14.10

Bug fixes

• Always copy seed packages when app-data is temporary, including when symlink seeding is enabled through an environment variable or configuration file. Seeded packages remain available after temporary cache cleanup. (#3437) by @​gaborbernat.

🐍 PyPI release

📜 Full Changelog

... (truncated)

Changelog

Sourced from virtualenv's changelog.

################# Release History #################

.. towncrier-draft-entries:: [UNRELEASED DRAFT]

.. towncrier release notes start

.. _release-21-15-2:

---

21.15.2 (2026-10-30)

---

.. _release-21-15-2-fixed:

Fixed

• Build the default application data folder only when no folder was given through --app-data, VIRTUALENV_APP_DATA or the configuration file, so --read-only-app-data with an explicit folder works when the default folder is missing, and writable runs stop creating an unused one. Folders from VIRTUALENV_APP_DATA and the configuration file now get the same checks as --app-data (:pr:3488) by :user:darrenhuai and :user:gaborbernat.
• Build the seed wheel image in a staging folder and move it into place only once it is complete, so an extraction that fails part way, for example on a full disk, after a killed process or on a path over the Windows length limit, no longer leaves a partial image that later runs seed as a pip without METADATA, RECORD or INSTALLER (:pr:3487) by :user:darrenhuai and :user:gaborbernat.
• Make -p/--python and --try-first-with replace the interpreters set by VIRTUALENV_PYTHON, VIRTUALENV_TRY_FIRST_WITH or the configuration file instead of being merged with them, so the configured interpreter no longer wins over the one asked for and a -p that finds nothing fails instead of falling back to it. Try several VIRTUALENV_PYTHON values in the order given rather than starting with the second (:pr:3494) by :user:darrenhuai and :user:gaborbernat.
• On Windows, re-create an environment in place when its copied interpreter files, such as python.exe, or its seeded packages are read-only, instead of failing with PermissionError (:pr:3492) by :user:darrenhuai and :user:gaborbernat.
• Reject an empty or whitespace-only destination. An empty one, and on Windows one made only of spaces, resolved to the current directory, so an unset VENV in virtualenv --clear "$VENV" deleted the working directory. Pass . to create the environment in the current directory (:pr:3491) by :user:darrenhuai and :user:gaborbernat.
• Restore the default prompt in deactivate.bat when PROMPT was undefined at activation, instead of leaving the environment name in front of it (:pr:3489) by :user:darrenhuai.
• Undefine PATH again in deactivate.bat when it was undefined at activation, instead of leaving the environment's Scripts folder on it, and stop a second activate.bat from adding that folder twice (:pr:3493) by :user:darrenhuai and :user:gaborbernat.

.. _release-21-15-1:

---

21.15.1 (2026-10-28)

---

... (truncated)

Commits

• 6accbd5 release 21.14.13
• 3598e20 🐛 fix(bash): escape the prompt for every PS1 state (#3466)
• f6512a5 release 21.14.12
• b535726 [pre-commit.ci] pre-commit autoupdate (#3455)
• 7e32366 Fix broken pip and code review links in the docs (#3460)
• 632e56f Upgrade embedded pip/setuptools/wheel and CI test tools (#3452)
• a8bd1a9 chore(deps): bump certifi from 2026.7.22 to 2026.10.19 in /tasks (#3462)
• c82323b chore(deps): bump uv from 0.13.0 to 0.13.4 in /tasks (#3461)
• 863ae6c chore(deps): bump the runtime-dependencies group with 3 updates (#3456)
• 79537b3 👷 ci: pin App token action v3.3.0 (#3449)
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[b-rowan]

@dependabot rebase