[dependabot]

Bumps the uv group with 1 update in the / directory: virtualenv.

Updates virtualenv from 21.14.7 to 21.14.9

Release notes

Sourced from virtualenv's releases.

21.14.9

Bugfixes - 21.14.9

• Parse VIRTUALENV_PERIODIC_UPDATE_INSECURE as a boolean, so 0, false, no and off keep certificate verification enabled. (#3398)

• Reject destinations whose resolved path contains the platform's PATH separator, including separators inherited from the working directory or a directory symlink. (#3399)

• Preserve an existing pyvenv.cfg when a prompt or configuration value cannot be encoded as UTF-8, instead of leaving the file empty after a failed environment creation. The file now ends its lines with LF on every platform.

  Debug logs show each configuration line as a Python string literal, so control characters are visible. (#3400)

• Skip writing a .venv redirect when the environment name contains a line boundary. The environment is still created, and any existing redirect remains unchanged. (#3401)

• Preserve non-ASCII values in activate_this.py when applications read the script with a legacy text encoding before executing it. (#3402)

• Reject malformed seed versions and requirements ending in archive suffixes before starting pip, with an error identifying the invalid value instead of a misleading download or local-file error. (#3403)

• Allow a literal percent sign as a csh prompt and preserve carets in tcsh prompt display instead of interpreting them as control-character notation.

  Separate csh history and prompt escapes from preceding non-ASCII text in legacy locales. (#3404)

• Report an error when an existing pyvenv.cfg is not a regular file, instead of trying to read or write directories, pipes, or devices as configuration files. (#3405)

• Preserve percent-containing paths during batch reactivation and show dollar signs literally in command prompts. Skip batch scripts for paths containing line boundaries, and remove stale batch scripts for unsupported paths even when only other activators are selected. (#3406)

• Compile shared seed-cache bytecode without loading site customizations from the destination environment or importing modules from the current working directory. (#3407)

• Keep the bundled seed version when a cached periodic update is older, and stop recording downloads below the bundled version during update checks. (#3408)

• Stop activating a moved environment, leaving PATH unchanged, when the shell is not bash, the script is evaluated or read from standard input, a path tool fails, the sourced file is not the environment's own activation script, or the new location has no pyvenv.cfg, instead of continuing with an incorrect environment path. (#3409)

• Reject built-in options with missing values before creating the application-data directory or starting interpreter discovery, instead of reporting the argument error after those operations. (#3410)

• Keep unset-variable bookkeeping out of exported xonsh variables, so child shells do not restore an internal sentinel as PYTHONHOME. Skip xonsh activation for destination names that its PATH handling would expand to a different path.

  Restore unset Tcl/Tk library variables when switching between environments in one xonsh session.

  Preserve non-ASCII paths and prompts when xonsh reads activation scripts with a legacy encoding. (#3411)

• Skip default shell activators with a warning when a POSIX path encoding is incompatible with their UTF-8 scripts. Explicitly requested incompatible shell activators still report an error. Environments created with --activators= or --activators=python remain supported in legacy locales. Undecodable parent paths are now caught before any shell activation script is written. (#3412)

... (truncated)

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.14.9

• Parse VIRTUALENV_PERIODIC_UPDATE_INSECURE as a boolean, so 0, false, no and off keep certificate verification enabled. (:issue:3398)

• Reject destinations whose resolved path contains the platform's PATH separator, including separators inherited from the working directory or a directory symlink. (:issue:3399)

• Preserve an existing pyvenv.cfg when a prompt or configuration value cannot be encoded as UTF-8, instead of leaving the file empty after a failed environment creation. The file now ends its lines with LF on every platform.

  Debug logs show each configuration line as a Python string literal, so control characters are visible. (:issue:3400)

• Skip writing a .venv redirect when the environment name contains a line boundary. The environment is still created, and any existing redirect remains unchanged. (:issue:3401)

• Preserve non-ASCII values in activate_this.py when applications read the script with a legacy text encoding before executing it. (:issue:3402)

• Reject malformed seed versions and requirements ending in archive suffixes before starting pip, with an error identifying the invalid value instead of a misleading download or local-file error. (:issue:3403)

• Allow a literal percent sign as a csh prompt and preserve carets in tcsh prompt display instead of interpreting them as control-character notation.

  Separate csh history and prompt escapes from preceding non-ASCII text in legacy locales. (:issue:3404)

• Report an error when an existing pyvenv.cfg is not a regular file, instead of trying to read or write directories, pipes, or devices as configuration files. (:issue:3405)

• Preserve percent-containing paths during batch reactivation and show dollar signs literally in command prompts. Skip batch scripts for paths containing line boundaries, and remove stale batch scripts for unsupported paths even when only other activators are selected. (:issue:3406)

• Compile shared seed-cache bytecode without loading site customizations from the destination environment or importing modules from the current working directory. (:issue:3407)

• Keep the bundled seed version when a cached periodic update is older, and stop recording downloads below the bundled version during update checks. (:issue:3408)

• Stop activating a moved environment, leaving PATH unchanged, when the shell is not bash, the script is evaluated or read from standard input, a path tool fails, the sourced file is not the environment's own activation script, or the new location has no pyvenv.cfg, instead of continuing with an incorrect environment path. (:issue:3409)

• Reject built-in options with missing values before creating the application-data directory or starting interpreter discovery, instead of reporting the argument error after those operations. (:issue:3410)

• Keep unset-variable bookkeeping out of exported xonsh variables, so child shells do not restore an internal sentinel as PYTHONHOME. Skip xonsh activation for destination names that its PATH handling would expand to a different path.

  Restore unset Tcl/Tk library variables when switching between environments in one xonsh session.

  Preserve non-ASCII paths and prompts when xonsh reads activation scripts with a legacy encoding. (:issue:3411)

• Skip default shell activators with a warning when a POSIX path encoding is incompatible with their UTF-8 scripts. Explicitly requested incompatible shell activators still report an error. Environments created with --activators= or --activators=python remain supported in legacy locales. Undecodable parent paths are now caught before any shell activation script is written. (:issue:3412)

• Keep apostrophes and backslashes in fish activation values separate from preceding non-ASCII characters, so fish 3

... (truncated)

Commits

• e53e30b release 21.14.9
• 2519941 🐛 fix(seed): preserve interpreter paths in console scripts (#3417)
• 70a0102 🐛 fix(seed): preserve shared cache when reseeding with pip (#3423)
• 554d9f9 🐛 fix(create): replace linked output directories (#3429)
• 7babec6 🐛 fix(seed): verify wheels before caching (#3430)
• 2dc8bd8 🐛 fix(subprocess): omit implicit helper import paths (#3416)
• d25f286 🐛 fix(create): replace generated file links (#3431)
• e3cea6f 🐛 fix(seed): contain metadata cleanup (#3428)
• 2bfdc02 🐛 fix(path): preserve link targets on delete errors (#3427)
• 6196d35 🐛 fix(seed): retain the parent installation for updates (#3420)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

Thanks for opening your first pull request on Guard Core MCP!

Quick checklist before review (most of these are enforced by CI, but worth a glance):

• The PR body says Closes #N for an open issue (the issue-link check enforces it); chores take the no-issue label
• make lint - ruff format, ruff check, mypy, and vulture
• make test - full test suite passes with 100% coverage
• make security - bandit, safety, and pip-audit all clean
• make quality - radon and xenon complexity thresholds respected
• No # noqa / # type: ignore shortcuts; pre-existing violations in touched files are fixed
• Added an entry under ## Unreleased in CHANGELOG.md
• If you touched a public API, updated the relevant page under docs/
• If you changed scripts/sync_docs.py, re-run make sync-docs and confirm make check-docs-drift passes
• If the change involves detection logic, the corresponding fix landed in guard-core first

See CONTRIBUTING.md for the full workflow and the Code of Conduct for the community standards we follow.

Questions while you work: Discord #help, https://discord.gg/ZW7ZJbjMkK

Welcome aboard - a maintainer will review shortly.