[dependabot]

Bumps virtualenv from 21.13.0 to 21.14.1.

Release notes

Sourced from virtualenv's releases.

21.14.1

No significant changes.

PyPI release

Full Changelog: pypa/virtualenv@21.14.0...21.14.1

21.14.0

Features - 21.14.0

• Record the SPDX license id in the wheel and zipapp SBOMs for bundled packages that declare their license by name or classifier, such as distlib and python-discovery, so license scanners can match them. (#3339)
• Add the Tidelift and thanks.dev funding links to the PyPI project URLs, next to GitHub Sponsors - by gaborbernat. (#3340)

Bugfixes - 21.14.0

• Build the release sdist, wheel and zipapp with the build backend and SBOM tools that tasks/release-requirements.txt pins by version and SHA-256, so a rebuild of the tag uses the same versions. (#3337)
• Use PEP 440 version ordering when selecting seed wheels, so pinned pre-releases, post-releases and local versions resolve to the requested wheel. (#3361)

Improved Documentation - 21.14.0

• Apply the licensing policy to what the wheel and zipapp ship, checked against their SBOMs, and name ALLOWED_LICENSES in tasks/license_policy.py as the list of accepted licenses. (#3339)
• Document what a maintainer checks when reviewing a pull request and what the main ruleset requires before a merge
  • by gaborbernat. (#3341)
• Document how the project selects, obtains and tracks its dependencies, and which dependency findings block a merge or a release - by gaborbernat. (#3342)
• Document which static analysis findings block a merge or a release, and how maintainers suppress a finding - by gaborbernat. (#3343)
• Document which secrets the project stores, who can read them and when maintainers rotate them - by gaborbernat. (#3344)
• Update the roadmap: 832 support shipped, and 838 waits on the PEP - by gaborbernat. (#3345)

PyPI release

Full Changelog: pypa/virtualenv@21.13.0...21.14.0

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.14.12

• Upgrade embedded wheels:

  • setuptools to 84.2.1 from 84.0.0
  • pip to 26.2.2 from 26.2.1 (:issue:3452)

Improved Documentation - 21.14.12

• Require a pull request news fragment and a matching changelog section before publishing. (:issue:3445)

---

v21.14.11 (2026-10-18)

---

Bugfixes - 21.14.11

• Search all directories supplied by repeated --extra-search-dir options instead of keeping only the last group. (:issue:3440)
• On Windows, the app data is now migrated into the nested cache directory instead of the migration failing with a warning on every run. (:issue:3441)

---

v21.14.10 (2026-10-17)

---

Bugfixes - 21.14.10

• Always copy seed packages when app-data is temporary, including when symlink seeding is enabled through an environment variable or configuration file. Seeded packages remain available after temporary cache cleanup. (:issue:3437)

---

v21.14.9 (2026-10-17)

---

Bugfixes - 21.14.9

• Parse VIRTUALENV_PERIODIC_UPDATE_INSECURE as a boolean, so 0, false, no and off keep certificate verification enabled. (:issue:3398)

• Reject destinations whose resolved path contains the platform's PATH separator, including separators inherited from the working directory or a directory symlink. (:issue:3399)

• Preserve an existing pyvenv.cfg when a prompt or configuration value cannot be encoded as UTF-8, instead of leaving the file empty after a failed environment creation. The file now ends its lines with LF on every platform.

  Debug logs show each configuration line as a Python string literal, so control characters are visible. (:issue:3400)

... (truncated)

Commits

• 3bb747e release 21.14.1
• 596c1d9 fix(ci): allow attestation bundle downloads (#3364)
• ace2b2b release 21.14.0
• f21121d fix(release): use interpreter-bound tools (#3363)
• 6de4939 test(ci): finish stack dumps before thread teardown (#3362)
• 1cdeab7 Upgrade embedded pip/setuptools/wheel and CI test tools (#3360)
• aec6a9d fix(seed): compare wheel versions with PEP 440 (#3361)
• 658282a chore(deps): bump the github-actions group across 1 directory with 4 updates ...
• 29c9758 ci: retain macOS worker crash evidence (#3359)
• bcdbfe0 chore(deps): bump the runtime-dependencies group with 5 updates (#3358)
• Additional commits viewable in compare view

[github-actions]

🤖 Claude Code Review

PR Code Review: Bump virtualenv 21.13.0 → 21.14.1

The only change is pyproject.toml:46. It bumps the pinned virtualenv dev dependency from 21.13.0 to 21.14.1. I did not run tests or pylint, and I did not read the virtualenv release notes. The findings below come from the diff alone.

Code Quality

• ✅ Style conventions: The pin format matches the neighbouring entries (== exact pins, alphabetical order).
• ✅ No commented-out code: None was added.
• ✅ Variable names and DRY: These don't apply to this change.
• ✅ Defects: None found. This is a minor-version bump of a development-only tool in the development group, so it does not affect runtime behavior of base_library. Python 3.10–3.13 support is unaffected as far as I can tell. I did not confirm that 21.14.1 still supports 3.10, so check the CI matrix.
• ✅ .claude/CLAUDE.md: It is not modified. Its contents are general and contain nothing specific to a local environment.

Testing

• ✅ Unit and integration tests: None are needed, because no code changed.
• ✅ Edge cases and coverage: There is no new logic to cover. CI should confirm the dependency installs cleanly with python -m pip install --group all ..

Documentation

• ✅ README and API docs: No update is needed.
• ✅ Inline comments: These don't apply.
• ⚠️ CHANGELOG.md: It is not updated. This is acceptable for an automated Dependabot dev-dependency bump. If the project's convention is to log every dependency change, add an entry.
• ✅ Markdown: No Markdown files were changed.

Security

• ✅ No hardcoded credentials or sensitive data in logs: None were added.
• ✅ Input validation and error handling: These don't apply.
• ✅ License files: No .lic files were added, and no AQAAAD strings appear in the diff.
• ✅ Supply chain: The version is pinned exactly, which keeps builds reproducible. The bump comes from a Dependabot PR.

Summary

This is a low-risk, approvable change. The only optional follow-up is the CHANGELOG entry, if the project requires one for dependency updates.

Automated code review analyzing defects and coding standards

[github-actions]

🤖 Claude Code Review

PR Review: Bump virtualenv 21.13.0 → 21.14.1

The only change is one line in pyproject.toml. It bumps virtualenv in the development dependency group.

Code Quality

• ✅ Style conventions: The pin format matches the neighboring entries.
• ✅ No commented-out code
• ✅ Variable names: Not applicable.
• ✅ DRY: The version appears only once.
• ✅ Defects: None found. This is a minor-version bump of a dev-only tool, so it doesn't affect the runtime library. I did not check upstream release notes, since there is no network access. The CI matrix (Python 3.10–3.13) should confirm compatibility.
• ✅ .claude/CLAUDE.md: Not modified. The existing file contains nothing specific to a local environment.

Testing

• ✅ Unit and integration tests: None are needed, because no code changed.
• ✅ Edge cases: Not applicable.
• ✅ Coverage: Unchanged.

Documentation

• ✅ README and API docs: No update needed.
• ⚠️ CHANGELOG.md: Not updated. This is acceptable for a dev-only dependency bump, and the previous Dependabot bumps (Bump virtualenv from 21.12.1 to 21.13.0 #166, Bump isort from 9.0.1 to 9.0.2 #167, Bump cryptography from 50.0.1 to 50.0.2 #170) follow the same pattern. Add an entry only if the project's convention requires one.
• ✅ Markdown: No Markdown files changed.

Security

• ✅ No hardcoded credentials
• ✅ Input validation: Not applicable.
• ✅ Error handling: Not applicable.
• ✅ No sensitive data in logs
• ✅ No license files: No .lic files and no strings starting with AQAAAD in the diff.

Summary

This is a low-risk, approvable dependency bump. The version is pinned exactly, as the project convention requires. The one thing to confirm before merging is that CI passes.

Automated code review analyzing defects and coding standards