Update dependency virtualenv to v20.26.6 [SECURITY] #642

renovate · 2025-08-13T16:54:12Z

Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs from Renovate will soon appear from 'Mend'. Learn more here.

This PR contains the following updates:

Package	Change	Age	Confidence
virtualenv	`==20.10.0` -> `==20.26.6`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2024-53899

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

Release Notes

pypa/virtualenv (virtualenv)

`v20.26.6`

Compare Source

What's Changed

release 20.26.5 by @gaborbernat in #2766
Fix #2768: Quote template strings in activation scripts by @y5c4l3 in #2771

New Contributors

@y5c4l3 made their first contribution in #2771

Full Changelog: pypa/virtualenv@20.26.5...20.26.6

`v20.26.5`

Compare Source

What's Changed

release 20.26.4 by @gaborbernat in #2761
Use uv over pip by @gaborbernat in #2765

Full Changelog: pypa/virtualenv@20.26.4...20.26.5

`v20.26.4`

Compare Source

What's Changed

release 20.26.3 by @gaborbernat in #2742
Fix whitespace around backticks in changelog by @edmorley in #2751
Test latest Python 3.13 by @hugovk in #2752
Fix typo in Nushell activation script by @edmorley in #2754
GitHub Actions: Replace deprecated macos-12 with macos-13 by @hugovk in #2756
Fix #2728: Activating venv create unwanted console output by @ShootGan in #2748
Upgrade bundled wheels by @gaborbernat in #2760

New Contributors

@ShootGan made their first contribution in #2748

Full Changelog: pypa/virtualenv@20.26.3...20.26.4

`v20.26.3`

Compare Source

What's Changed

release 20.26.2 by @gaborbernat in #2724
Bump embeded wheels by @gaborbernat in #2741

Full Changelog: pypa/virtualenv@20.26.2...20.26.3

`v20.26.2`

Compare Source

What's Changed

Release 20.26.1 by @gaborbernat in #2713
Update activate_this.py documentation to use runpy instead of exec by @FredStober in #2716
Apply ruff/bugbear new rules by @DimitriPapadopoulos in #2718
Fix the CI by @HandSonic in #2721
Fix #1949: zipapp virtual environment creation fails if zipapp path is symlinked by @HandSonic in #2722
Fix bad return code in bash activation if hashing is disabled by @fenkes-ibm in #2717

New Contributors

@FredStober made their first contribution in #2716
@HandSonic made their first contribution in #2721
@fenkes-ibm made their first contribution in #2717

Full Changelog: pypa/virtualenv@20.26.1...20.26.2

`v20.26.1`

Compare Source

What's Changed

release 20.26.0 by @gaborbernat in #2710
Fix PATH-based Python discovery on Windows by @ofek in #2712

Full Changelog: pypa/virtualenv@20.26.0...20.26.1

`v20.26.0`

Compare Source

What's Changed

release 20.25.3 by @gaborbernat in #2704
Fixed a case when template variable is WindowsPath by @NtWriteCode in #2707
Allow builtin interpreter discovery to find specific Python versions given a general spec by @flying-sheep in #2709

New Contributors

@NtWriteCode made their first contribution in #2707
@flying-sheep made their first contribution in #2709

Full Changelog: pypa/virtualenv@20.25.3...20.26.0

`v20.25.3`

Compare Source

What's Changed

release 20.25.2 by @gaborbernat in #2703
Fix for tests: Python 3.13.0a6 renamed pathmod to parser by @befeleme in #2702

New Contributors

@befeleme made their first contribution in #2702

Full Changelog: pypa/virtualenv@20.25.2...20.25.3

`v20.25.2`

Compare Source

What's Changed

release 20.25.1 by @gaborbernat in #2692
Fix windows utf8 encoding issue by @PzaThief in #2687
Update changelog.rst by @Callek in #2701
Fix indentation in activate.fish by @junzh0u in #2700

New Contributors

@PzaThief made their first contribution in #2687
@Callek made their first contribution in #2701
@junzh0u made their first contribution in #2700

Full Changelog: pypa/virtualenv@20.25.1...20.25.2

`v20.25.1`

Compare Source

What's Changed

release 20.25.0 by @gaborbernat in #2675
Upgrade embeded wheels by @gaborbernat in #2681
Resolve symbolic links for environment metadata by @ofek in #2686
Avoid importing contextlib in _virtualenv by @hauntsaninja in #2688

Full Changelog: pypa/virtualenv@20.25.0...20.25.1

`v20.25.0`

Compare Source

What's Changed

release 20.24.6 by @gaborbernat in #2657
Allow platformdirs v4 by @alex in #2664
Bump wheels package by @gaborbernat in #2665
Bump setuptools and wheels by @gaborbernat in #2669
Run CI tests on Python 3.13, fix tests by @hroncok in #2673

Full Changelog: pypa/virtualenv@20.24.6...20.25.0

`v20.24.7`

Compare Source

What's Changed

release 20.24.6 by @gaborbernat in #2657
Allow platformdirs v4 by @alex in #2664
Bump wheels package by @gaborbernat in #2665

Full Changelog: pypa/virtualenv@20.24.6...20.24.7

`v20.24.6`

Compare Source

What's Changed

release 20.24.5 by @gaborbernat in #2643
Change "Virtualenv" to "virtualenv" to match style by @jackiekazil in #2646
[test] Use get_hookimpls method instead of the private attribute by @danigm in #2649
Remove extra closing parenthesis by @patrick-csliu in #2651
Fix the CI by @gaborbernat in #2655
Upgrade pip and setuptools by @gaborbernat in #2656

New Contributors

@jackiekazil made their first contribution in #2646
@danigm made their first contribution in #2649
@patrick-csliu made their first contribution in #2651

Full Changelog: pypa/virtualenv@20.24.5...20.24.6

`v20.24.5`

Compare Source

What's Changed

release 20.24.4 by @gaborbernat in #2633
Fix brew cannot copy by @gaborbernat in #2640
Test with 3.12 rc by @gaborbernat in #2641
Upgrade setuptools by @gaborbernat in #2642
GitHub Actions: Add PyPy 3.10 to testing by @cclauss in #2638

New Contributors

@cclauss made their first contribution in #2639

Full Changelog: pypa/virtualenv@20.24.4...20.24.5

`v20.24.4`

Compare Source

What's Changed

Fix typo found by codespell by @DimitriPapadopoulos in #2624
Updating extend.rst typo by @sagardesai1 in #2626

New Contributors

@DimitriPapadopoulos made their first contribution in #2624
@sagardesai1 made their first contribution in #2626

Full Changelog: pypa/virtualenv@20.24.3...20.24.4

`v20.24.3`

Compare Source

What's Changed

release 20.24.2 by @gaborbernat in #2615
Update compatibility docs by @jugmac00 in #2618
fix ResourceWarning on process exit (#2472) by @sigma67 in #2617
added scripts in tasks directory to sdist on build (#2610) by @sigma67 in #2620
Bump wheel by @gaborbernat in #2622

New Contributors

@sigma67 made their first contribution in #2617

Full Changelog: pypa/virtualenv@20.24.2...20.24.3

`v20.24.2`

Compare Source

What's Changed

release 20.24.1 by @gaborbernat in #2612
Bump pip and wheel by @gaborbernat in #2614

Full Changelog: pypa/virtualenv@20.24.1...20.24.2

`v20.24.1`

Compare Source

What's Changed

release 20.24.0 by @gaborbernat in #2608
Upgrade pip by @arielkirkwood in #2611

New Contributors

@arielkirkwood made their first contribution in #2611

Full Changelog: pypa/virtualenv@20.24.0...20.24.1

`v20.24.0`

Compare Source

What's Changed

release 20.23.1 by @gaborbernat in #2590
Fix the CI by @gaborbernat in #2593
Quickstart guide by @AlvesJorge in #2599
Updated CLI documentation with config file name by @nathanczh in #2602
Exclude dependabot and pre-commit ci from release notes by @gaborbernat in #2603
Export VIRTUAL_ENV_PROMPT in activation scripts (#2194) by @jimporter in #2606
Upgrade setuptools by @gaborbernat in #2607

New Contributors

@AlvesJorge made their first contribution in #2599
@nathanczh made their first contribution in #2602
@jimporter made their first contribution in #2606

Full Changelog: pypa/virtualenv@20.23.1...20.24.0

`v20.23.1`

Compare Source

What's Changed

release 20.23.0 by @gaborbernat in #2563
Bump pypa/gh-action-pypi-publish from 1.8.5 to 1.8.6 by @dependabot in #2566
feat: ✨ update and simplify nushell activation by @melMass in #2572
Fix deprecation warning by @jugmac00 in #2575
Replace unmaintained pytest-freezegun by @jugmac00 in #2576
Update cli_interface.rst by @uberFoo in #2586
Add ruff, test latest OS and bump setuptools by @gaborbernat in #2588

New Contributors

@melMass made their first contribution in #2572
@jugmac00 made their first contribution in #2575
@uberFoo made their first contribution in #2586

Full Changelog: pypa/virtualenv@20.23.0...20.23.1

`v20.23.0`

Compare Source

What's Changed

release 20.22.0 by @gaborbernat in #2549
Clarify that v20.22.0 dropped support for Python 3.6 too by @pquentin in #2552
Add trusted-publish by @gaborbernat in #2559
prevent PermissionError when using venv creator on some systems by @kulikjak in #2543
upgrade pip and setuptools (#2560) by @gaborbernat in #2562
3.12 support and no setuptools/wheel on 3.12+ by @chrysle in #2558

New Contributors

@pquentin made their first contribution in #2552
@chrysle made their first contribution in #2558

Full Changelog: pypa/virtualenv@20.22.0...20.23.0

`v20.22.0`

Compare Source

What's Changed

release 20.21.1 by @gaborbernat in #2547
Drop Python 2 support by @gaborbernat in #2548

Full Changelog: pypa/virtualenv@20.21.1...20.22.0

`v20.21.1`

Compare Source

What's Changed

Bump pypa/gh-action-pypi-publish from 1.6.4 to 1.7.1 by @dependabot in #2521
release 20.21.0 by @gaborbernat in #2519
Add tox.ini to sdist by @mtelka in #2520
Bump pypa/gh-action-pypi-publish from 1.7.1 to 1.8.1 by @dependabot in #2524
Update Nushell 'let' syntax by @jntrnr in #2527
Bump pypa/gh-action-pypi-publish from 1.8.1 to 1.8.3 by @dependabot in #2530
update nushell's str collect command to str join by @fdncred in #2532
Bump pypa/gh-action-pypi-publish from 1.8.3 to 1.8.5 by @dependabot in #2536
docs: fix attribution in v20.11 by @d3dave in #2539
Bump embeded wheels by @gaborbernat in #2546
Bump deps and tools by @gaborbernat in #2545

New Contributors

@mtelka made their first contribution in #2520
@jntrnr made their first contribution in #2527
@fdncred made their first contribution in #2532

Full Changelog: pypa/virtualenv@20.21.0...20.21.1

`v20.21.0`

Compare Source

What's Changed

release 20.20.0 by @gaborbernat in #2510
Using explicit closure syntax by @WindSoilder in #2512
Add print command to print_prompt for nushell by @NotLebedev in #2514
Sepcify the encoding by @FFY00 in #2515
Make ReentrantFileLock thread-safe and, thereby, fix race condition in virtualenv.cli_run by @radoering in #2517
Add pyproject-fmt by @gaborbernat in #2518

New Contributors

@WindSoilder made their first contribution in #2512
@NotLebedev made their first contribution in #2514
@FFY00 made their first contribution in #2515
@radoering made their first contribution in #2517

Full Changelog: pypa/virtualenv@20.20.0...20.21.0

`v20.20.0`

Compare Source

What's Changed

release 20.19.0 by @gaborbernat in #2503
Fix Tox environment name for running linting tools in PR template by @faph in #2505
Simplify environment lookup in Nushell activation by @kubouch in #2506
Support Windows CPython interpreters distributed by non-standard orgs by @faph in #2504
Bump embeded pip and setuptools by @gaborbernat in #2509

New Contributors

@faph made their first contribution in #2505

Full Changelog: pypa/virtualenv@20.19.0...20.20.0

`v20.19.0`

Compare Source

What's Changed

release 20.18.0 by @gaborbernat in #2497
Fix HTML title docs by @oleksis in #2500
Bump platformdirs dependency to <4 by @gaborbernat in #2502

New Contributors

@oleksis made their first contribution in #2500

Full Changelog: pypa/virtualenv@20.18.0...20.19.0

`v20.18.0`

Compare Source

What's Changed

release 20.17.1 by @gaborbernat in #2462
Bump pypa/gh-action-pypi-publish from 1.6.1 to 1.6.3 by @dependabot in #2464
Bump pypa/gh-action-pypi-publish from 1.6.3 to 1.6.4 by @dependabot in #2465
Fix Nushell installation failures by @kubouch in #2475
Move to hatchling, drop 3.6 support by @gaborbernat in #2474
Fix coverage reporting by @gaborbernat in #2477
Fix wrong prompt in Nushell activation script by @kubouch in #2481
Don't run scheduled workflow jobs on forks by @nsoranzo in #2490
Improve activator documentation by @adamchainz in #2488
Bump embedded pip and setuptools by @gaborbernat in #2489
Use furo docs theme by @gaborbernat in #2496

New Contributors

@adamchainz made their first contribution in #2488

Full Changelog: pypa/virtualenv@20.17.1...20.18.0

`v20.17.1`

Compare Source

What's Changed

release 20.17.0 by @gaborbernat in #2452
Bump pypa/gh-action-pypi-publish from 1.5.1 to 1.5.2 by @dependabot in #2454
Bump pypa/gh-action-pypi-publish from 1.5.2 to 1.6.1 by @dependabot in #2459
Py marker means any python not CPython by @gaborbernat in #2460
Respect VIRTUAL_ENV_DISABLE_PROMPT in nushell activation script by @m-lima in #2458

New Contributors

@m-lima made their first contribution in #2458

Full Changelog: pypa/virtualenv@20.17.0...20.17.1

`v20.17.0`

Compare Source

What's Changed

release 20.16.7 by @gaborbernat in #2445
Change Nushell activation script to module by @kubouch in #2422
Fix operator in Nushell activation script by @kubouch in #2450
Do not use deprecated API by @gaborbernat in #2448
Bump setuptools by @gaborbernat in #2451

Full Changelog: pypa/virtualenv@20.16.7...20.17.0

`v20.16.7`

Compare Source

What's Changed

release 20.16.6 by @gaborbernat in #2437
Replace six in tests/unit/test_run.py by @cjmayo in #2439
Try to fix Nushell install by @kubouch in #2444
Try alternate filenames for system_executable by @vfazio in #2442
Bump embedded by @gaborbernat in #2443
Set 'home' to parent directory of system_executable by @vfazio in #2441

New Contributors

@cjmayo made their first contribution in #2439
@vfazio made their first contribution in #2442

Full Changelog: pypa/virtualenv@20.16.6...20.16.7

`v20.16.6`

Compare Source

What's Changed

release 20.16.5 by @gaborbernat in #2413
fix building python3.10 virtualenvs on debian derivatives by @asottile in #2415
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #2423
Allow empty string as version for find_compatible_in_house by @schaap in #2430
Fix test_csh when running with the original csh by @kulikjak in #2418
Remove outdated PyPy stdlib overrides by @mattip in #2426
Upgrade pip and setuptools by @gaborbernat in #2434

New Contributors

@schaap made their first contribution in #2430
@kulikjak made their first contribution in #2418

Full Changelog: pypa/virtualenv@20.16.5...20.16.6

`v20.16.5`

Compare Source

What's Changed

release 20.16.4 by @gaborbernat in #2407
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #2410
Do not turn echo off for subsequent commands in batch activators (#2411) by @pawelszramowski in #2412

New Contributors

@pawelszramowski made their first contribution in #2412

Full Changelog: pypa/virtualenv@20.16.4...20.16.5

`v20.16.4`

Compare Source

What's Changed

release 20.16.3 by @gaborbernat in #2396
Remove universal wheel, python 2 is unsupported by @gopackgo90 in #2402
Bump setuptools by @gaborbernat in #2405

New Contributors

@gopackgo90 made their first contribution in #2402

Full Changelog: pypa/virtualenv@20.16.3...20.16.4

`v20.16.3`

Compare Source

What's Changed

release 20.16.2 by @gaborbernat in #2392
Bump dependencies and build tools by @gaborbernat in #2394
Bump embed pip and setuptools by @gaborbernat in #2395

Full Changelog: pypa/virtualenv@20.16.2...20.16.3

`v20.16.2`

Compare Source

What's Changed

release 20.16.1 by @gaborbernat in #2390
Bump embed pip by @gaborbernat in #2391

Full Changelog: pypa/virtualenv@20.16.1...20.16.2

`v20.16.1`

Compare Source

What's Changed

release 20.16.0 by @gaborbernat in #2384
Test with CPython 3.11 by @gaborbernat in #2388
Fix pull request template formatting by @kubouch in #2389
Port Nushell activation scripts to 0.67 by @kubouch in #2386

Full Changelog: pypa/virtualenv@20.16.0...20.16.1

`v20.16.0`

Compare Source

What's Changed

release 20.15.1 by @gaborbernat in #2370
Delete callout on API stability by @uranusjr in #2374
Fix test_py_info to work on Python 3.11 too by @rkucsora in #2380
Fix entry point key typo in docs by @uranusjr in #2373
Add notes in changelog about site after rewrite by @YouJiacheng in #2379
docs: fix simple typo, developent -> development by @timgates42 in #2377
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #2375
Drop support of running under Python 2.7 by @gaborbernat in #2382
Upgrade embed setuptools and pip by @gaborbernat in #2383

New Contributors

@uranusjr made their first contribution in #2374
@rkucsora made their first contribution in #2380
@YouJiacheng made their first contribution in #2379
@timgates42 made their first contribution in #2377

Full Changelog: pypa/virtualenv@20.15.1...20.16.0

`v20.15.1`

Compare Source

`v20.15.0`

Compare Source

What's Changed

release 20.14.1 by @gaborbernat in #2331
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #2332
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #2341
Add dependabot by @gaborbernat in #2355
Bump actions/setup-python from 2 to 4 by @dependabot in #2360
Bump actions/checkout from 2 to 3 by @dependabot in #2359
Bump pre-commit/action from 2.0.3 to 3.0.0 by @dependabot in #2358
Bump actions/download-artifact from 2 to 3 by @dependabot in #2357
Bump actions/upload-artifact from 2 to 3 by @dependabot in #2356
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #2362
Fix broken Nushell installation in CI by @kubouch in #2364
Fixes for Windows PyPy 3.6 by @reksar in #2363
Windows embedable support by @reksar in #2353
Bump setuptools by @gaborbernat in #2365

New Contributors

@dependabot made their first contribution in #2360
@reksar made their first contribution in #2363

Full Changelog: pypa/virtualenv@20.14.1...20.15.0

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Update dependency virtualenv to v20.26.6 [SECURITY]

a6513b0

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update dependency virtualenv to v20.26.6 [SECURITY] #642

Update dependency virtualenv to v20.26.6 [SECURITY] #642

Uh oh!

renovate bot commented Aug 13, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Update dependency virtualenv to v20.26.6 [SECURITY] #642

Are you sure you want to change the base?

Update dependency virtualenv to v20.26.6 [SECURITY] #642

Uh oh!

Conversation

renovate bot commented Aug 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

Release Notes

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

renovate bot commented Aug 13, 2025 •

edited

Loading