[dependabot]

Bumps virtualenv from 21.14.2 to 21.14.9.

Release notes

Sourced from virtualenv's releases.

21.14.9

Bugfixes - 21.14.9

• Parse VIRTUALENV_PERIODIC_UPDATE_INSECURE as a boolean, so 0, false, no and off keep certificate verification enabled. (#3398)

• Reject destinations whose resolved path contains the platform's PATH separator, including separators inherited from the working directory or a directory symlink. (#3399)

• Preserve an existing pyvenv.cfg when a prompt or configuration value cannot be encoded as UTF-8, instead of leaving the file empty after a failed environment creation. The file now ends its lines with LF on every platform.

  Debug logs show each configuration line as a Python string literal, so control characters are visible. (#3400)

• Skip writing a .venv redirect when the environment name contains a line boundary. The environment is still created, and any existing redirect remains unchanged. (#3401)

• Preserve non-ASCII values in activate_this.py when applications read the script with a legacy text encoding before executing it. (#3402)

• Reject malformed seed versions and requirements ending in archive suffixes before starting pip, with an error identifying the invalid value instead of a misleading download or local-file error. (#3403)

• Allow a literal percent sign as a csh prompt and preserve carets in tcsh prompt display instead of interpreting them as control-character notation.

  Separate csh history and prompt escapes from preceding non-ASCII text in legacy locales. (#3404)

• Report an error when an existing pyvenv.cfg is not a regular file, instead of trying to read or write directories, pipes, or devices as configuration files. (#3405)

• Preserve percent-containing paths during batch reactivation and show dollar signs literally in command prompts. Skip batch scripts for paths containing line boundaries, and remove stale batch scripts for unsupported paths even when only other activators are selected. (#3406)

• Compile shared seed-cache bytecode without loading site customizations from the destination environment or importing modules from the current working directory. (#3407)

• Keep the bundled seed version when a cached periodic update is older, and stop recording downloads below the bundled version during update checks. (#3408)

• Stop activating a moved environment, leaving PATH unchanged, when the shell is not bash, the script is evaluated or read from standard input, a path tool fails, the sourced file is not the environment's own activation script, or the new location has no pyvenv.cfg, instead of continuing with an incorrect environment path. (#3409)

• Reject built-in options with missing values before creating the application-data directory or starting interpreter discovery, instead of reporting the argument error after those operations. (#3410)

• Keep unset-variable bookkeeping out of exported xonsh variables, so child shells do not restore an internal sentinel as PYTHONHOME. Skip xonsh activation for destination names that its PATH handling would expand to a different path.

  Restore unset Tcl/Tk library variables when switching between environments in one xonsh session.

  Preserve non-ASCII paths and prompts when xonsh reads activation scripts with a legacy encoding. (#3411)

• Skip default shell activators with a warning when a POSIX path encoding is incompatible with their UTF-8 scripts. Explicitly requested incompatible shell activators still report an error. Environments created with --activators= or --activators=python remain supported in legacy locales. Undecodable parent paths are now caught before any shell activation script is written. (#3412)

... (truncated)

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.14.9

• Parse VIRTUALENV_PERIODIC_UPDATE_INSECURE as a boolean, so 0, false, no and off keep certificate verification enabled. (:issue:3398)

• Reject destinations whose resolved path contains the platform's PATH separator, including separators inherited from the working directory or a directory symlink. (:issue:3399)

• Preserve an existing pyvenv.cfg when a prompt or configuration value cannot be encoded as UTF-8, instead of leaving the file empty after a failed environment creation. The file now ends its lines with LF on every platform.

  Debug logs show each configuration line as a Python string literal, so control characters are visible. (:issue:3400)

• Skip writing a .venv redirect when the environment name contains a line boundary. The environment is still created, and any existing redirect remains unchanged. (:issue:3401)

• Preserve non-ASCII values in activate_this.py when applications read the script with a legacy text encoding before executing it. (:issue:3402)

• Reject malformed seed versions and requirements ending in archive suffixes before starting pip, with an error identifying the invalid value instead of a misleading download or local-file error. (:issue:3403)

• Allow a literal percent sign as a csh prompt and preserve carets in tcsh prompt display instead of interpreting them as control-character notation.

  Separate csh history and prompt escapes from preceding non-ASCII text in legacy locales. (:issue:3404)

• Report an error when an existing pyvenv.cfg is not a regular file, instead of trying to read or write directories, pipes, or devices as configuration files. (:issue:3405)

• Preserve percent-containing paths during batch reactivation and show dollar signs literally in command prompts. Skip batch scripts for paths containing line boundaries, and remove stale batch scripts for unsupported paths even when only other activators are selected. (:issue:3406)

• Compile shared seed-cache bytecode without loading site customizations from the destination environment or importing modules from the current working directory. (:issue:3407)

• Keep the bundled seed version when a cached periodic update is older, and stop recording downloads below the bundled version during update checks. (:issue:3408)

• Stop activating a moved environment, leaving PATH unchanged, when the shell is not bash, the script is evaluated or read from standard input, a path tool fails, the sourced file is not the environment's own activation script, or the new location has no pyvenv.cfg, instead of continuing with an incorrect environment path. (:issue:3409)

• Reject built-in options with missing values before creating the application-data directory or starting interpreter discovery, instead of reporting the argument error after those operations. (:issue:3410)

• Keep unset-variable bookkeeping out of exported xonsh variables, so child shells do not restore an internal sentinel as PYTHONHOME. Skip xonsh activation for destination names that its PATH handling would expand to a different path.

  Restore unset Tcl/Tk library variables when switching between environments in one xonsh session.

  Preserve non-ASCII paths and prompts when xonsh reads activation scripts with a legacy encoding. (:issue:3411)

• Skip default shell activators with a warning when a POSIX path encoding is incompatible with their UTF-8 scripts. Explicitly requested incompatible shell activators still report an error. Environments created with --activators= or --activators=python remain supported in legacy locales. Undecodable parent paths are now caught before any shell activation script is written. (:issue:3412)

• Keep apostrophes and backslashes in fish activation values separate from preceding non-ASCII characters, so fish 3

... (truncated)

Commits

• e53e30b release 21.14.9
• 2519941 🐛 fix(seed): preserve interpreter paths in console scripts (#3417)
• 70a0102 🐛 fix(seed): preserve shared cache when reseeding with pip (#3423)
• 554d9f9 🐛 fix(create): replace linked output directories (#3429)
• 7babec6 🐛 fix(seed): verify wheels before caching (#3430)
• 2dc8bd8 🐛 fix(subprocess): omit implicit helper import paths (#3416)
• d25f286 🐛 fix(create): replace generated file links (#3431)
• e3cea6f 🐛 fix(seed): contain metadata cleanup (#3428)
• 2bfdc02 🐛 fix(path): preserve link targets on delete errors (#3427)
• 6196d35 🐛 fix(seed): retain the parent installation for updates (#3420)
• Additional commits viewable in compare view

[senzingdevops]

Automated: approving this pull request because it includes a patch update

[github-actions]

🤖 Claude Code Review

⏭️ Skipped — this pull request was opened by a bot, and review_bot_authors is false.

---

Automated code review analyzing defects and coding standards

[senzingdevops]

Automated: approving this pull request because it includes a patch update

[github-actions]

🤖 Claude Code Review

PR Code Review: Bump virtualenv 21.14.2 → 21.14.9

The diff changes one line, in pyproject.toml:46. It raises the pinned dev dependency virtualenv from 21.14.2 to 21.14.9. I reviewed the diff only and did not run tests or check the virtualenv release notes.

Code Quality

• ✅ Style conventions: The pin format and placement match the neighbouring entries, which are exact == pins in the development group.
• ✅ No commented-out code: None added.
• ✅ Meaningful names: Not applicable.
• ✅ DRY: Not applicable.
• ✅ Defects:
  • This is a patch-level bump of a dev-only tool, so it has no runtime effect on base_mapper.py.
  • It is not a runtime dependency, so it is not shipped to downstream mappers such as mapper-ijic and mapper-dowjones.
  • The environment is Python 3.10–3.13. I did not confirm that virtualenv 21.14.9 supports 3.10. Check that the CI matrix passes.
• ✅ .claude/CLAUDE.md: Not changed by this PR. It contains no local-environment-specific content.

Testing

• ✅ Unit and integration tests: Not applicable. No code changed.
• ✅ Edge cases: Not applicable.
• ✅ Coverage: Unchanged.

Documentation

• ✅ README and API docs: No update needed.
• ✅ Inline comments: Not applicable.
• ⚠️ CHANGELOG.md: Not updated. Previous Dependabot bumps (Bump pylint from 4.0.9 to 4.1.1 #168, Bump virtualenv from 21.13.0 to 21.14.1 #169, Bump virtualenv from 21.14.1 to 21.14.2 #172) may not have updated it either. If the project's convention is to log dependency bumps, add an entry. Otherwise this is acceptable.
• ✅ Markdown and CommonMark: No Markdown files changed.

Security

• ✅ No hardcoded credentials: None.
• ✅ Input validation and error handling: Not applicable.
• ✅ No sensitive data in logs: None.
• ✅ License files: No .lic files, and no AQAAAD strings in the diff.

Summary

This is a low-risk, approvable dependency bump. The only open item is whether to add a CHANGELOG entry, depending on the project's convention for Dependabot updates. The unlisted untracked files in the working tree (pr_diff.txt, review.txt, prompt-*.md, build-resources/) are review artifacts and are not part of the PR. Make sure they are not committed.

Automated code review analyzing defects and coding standards