[dependabot]

Bumps virtualenv from 21.14.11 to 21.14.13.

Release notes

Sourced from virtualenv's releases.

21.14.13

Security

• Stop bash running commands from --prompt or an environment name containing $(...), backticks or a backslash after shopt -s promptvars, set -o posix, or in a child shell that inherits an exported PS1 (GHSA-cx6f-vjhg-g3cc); reported by @​rozzkml. zsh now draws the prompt from psvar[9], which is never parsed as shell syntax. (#3466) by @​gaborbernat.
• Write the .venv redirect and the wheel RECORD with exclusive create, so a link planted after the existence check cannot redirect the write. On POSIX, replace a read-only .venv redirect that points at a virtualenv. (#3466) by @​gaborbernat.

🐍 PyPI release

📜 Full Changelog

21.14.12

Packaging

• Upgrade the embedded setuptools wheel from 84.0.0 to 84.2.1 and the embedded pip wheel from 26.2.1 to 26.2.2. (#3452)

New Contributors

• @​qodelicious made their first contribution in #3460

🐍 PyPI release

📜 Full Changelog

Changelog

Sourced from virtualenv's changelog.

################# Release History #################

.. towncrier-draft-entries:: [UNRELEASED DRAFT]

.. towncrier release notes start

.. _release-21-15-1:

---

21.15.1 (2026-10-28)

---

.. _release-21-15-1-fixed:

Fixed

• Keep the name of a seeded console_scripts entry that contains digits but does not end in a version, such as python3-config or 2to3, instead of truncating it at the first digit; python3-config overwrote the environment's python executable (:pr:3451) by :user:JingHao-Leon and :user:gaborbernat.
• Copy the content of a symlinked directory when a tree is copied into an environment, instead of dropping it (:pr:3454) by :user:JingHao-Leon and :user:gaborbernat.
• Count each -v, -q, -p and --try-first-with option once instead of once per internal parsing pass, so Session.verbosity is 3 rather than 9 for a single -v (:pr:3457) by :user:darrenhuai and :user:gaborbernat.
• Copy the seed packages instead of failing when VIRTUALENV_SYMLINK_APP_DATA or symlink_app_data in the config file turns on symlink seeding on a host that cannot create symlinks, such as Windows without the symlink privilege (:pr:3465) by :user:darrenhuai and :user:gaborbernat.
• Run the interpreter that collects the target debug information (-vv output and Creator.debug) without PYTHONPATH and with the environment passed to cli_run, so the reported sys.path no longer lists the caller's PYTHONPATH entries (:pr:3474) by :user:RaphaelFakhri and :user:gaborbernat.

.. _release-21-15-0:

---

21.15.0 (2026-10-27)

---

.. _release-21-15-0-added:

Added

• Bundle dependencies for Python 3.15 in the standalone zipapp and stop bundling Python 3.8, which is outside the package's supported range (:pr:3458) by :user:gaborbernat.

.. _release-21-15-0-packaging:

... (truncated)

Commits

• 6accbd5 release 21.14.13
• 3598e20 🐛 fix(bash): escape the prompt for every PS1 state (#3466)
• f6512a5 release 21.14.12
• b535726 [pre-commit.ci] pre-commit autoupdate (#3455)
• 7e32366 Fix broken pip and code review links in the docs (#3460)
• 632e56f Upgrade embedded pip/setuptools/wheel and CI test tools (#3452)
• a8bd1a9 chore(deps): bump certifi from 2026.7.22 to 2026.10.19 in /tasks (#3462)
• c82323b chore(deps): bump uv from 0.13.0 to 0.13.4 in /tasks (#3461)
• 863ae6c chore(deps): bump the runtime-dependencies group with 3 updates (#3456)
• 79537b3 👷 ci: pin App token action v3.3.0 (#3449)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Vercel Preview Deployment

Name	Status	Preview	Updated (UTC)
after-certainty site	✅ Ready (Inspect)	Visit Preview	2026-10-31 18:53

_{Commit ac7c227cf80dc2a01ddabb5ad03d0b015baf2604 · Deployed by Site CI}

Preview is an inspectable development artifact — required checks (site-ci) still gate merge.