Skip to content

chore(deps): bump the pip group across 4 directories with 2 updates - #5729

Merged
arkid15r merged 1 commit into
mainfrom
dependabot/pip/backend/pip-0a1b34ae50
Oct 22, 2026
Merged

chore(deps): bump the pip group across 4 directories with 2 updates#5729
arkid15r merged 1 commit into
mainfrom
dependabot/pip/backend/pip-0a1b34ae50

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the pip group with 2 updates in the /backend directory: certifi and virtualenv.
Bumps the pip group with 2 updates in the /backend/requirements directory: certifi and virtualenv.
Bumps the pip group with 1 update in the /docs directory: certifi.
Bumps the pip group with 1 update in the /tools/requirements directory: virtualenv.

Updates certifi from 2026.5.20 to 2026.10.19

Commits

Updates virtualenv from 21.14.4 to 21.14.9

Release notes

Sourced from virtualenv's releases.

21.14.9

Bugfixes - 21.14.9

  • Parse VIRTUALENV_PERIODIC_UPDATE_INSECURE as a boolean, so 0, false, no and off keep certificate verification enabled. (#3398)

  • Reject destinations whose resolved path contains the platform's PATH separator, including separators inherited from the working directory or a directory symlink. (#3399)

  • Preserve an existing pyvenv.cfg when a prompt or configuration value cannot be encoded as UTF-8, instead of leaving the file empty after a failed environment creation. The file now ends its lines with LF on every platform.

    Debug logs show each configuration line as a Python string literal, so control characters are visible. (#3400)

  • Skip writing a .venv redirect when the environment name contains a line boundary. The environment is still created, and any existing redirect remains unchanged. (#3401)

  • Preserve non-ASCII values in activate_this.py when applications read the script with a legacy text encoding before executing it. (#3402)

  • Reject malformed seed versions and requirements ending in archive suffixes before starting pip, with an error identifying the invalid value instead of a misleading download or local-file error. (#3403)

  • Allow a literal percent sign as a csh prompt and preserve carets in tcsh prompt display instead of interpreting them as control-character notation.

    Separate csh history and prompt escapes from preceding non-ASCII text in legacy locales. (#3404)

  • Report an error when an existing pyvenv.cfg is not a regular file, instead of trying to read or write directories, pipes, or devices as configuration files. (#3405)

  • Preserve percent-containing paths during batch reactivation and show dollar signs literally in command prompts. Skip batch scripts for paths containing line boundaries, and remove stale batch scripts for unsupported paths even when only other activators are selected. (#3406)

  • Compile shared seed-cache bytecode without loading site customizations from the destination environment or importing modules from the current working directory. (#3407)

  • Keep the bundled seed version when a cached periodic update is older, and stop recording downloads below the bundled version during update checks. (#3408)

  • Stop activating a moved environment, leaving PATH unchanged, when the shell is not bash, the script is evaluated or read from standard input, a path tool fails, the sourced file is not the environment's own activation script, or the new location has no pyvenv.cfg, instead of continuing with an incorrect environment path. (#3409)

  • Reject built-in options with missing values before creating the application-data directory or starting interpreter discovery, instead of reporting the argument error after those operations. (#3410)

  • Keep unset-variable bookkeeping out of exported xonsh variables, so child shells do not restore an internal sentinel as PYTHONHOME. Skip xonsh activation for destination names that its PATH handling would expand to a different path.

    Restore unset Tcl/Tk library variables when switching between environments in one xonsh session.

    Preserve non-ASCII paths and prompts when xonsh reads activation scripts with a legacy encoding. (#3411)

  • Skip default shell activators with a warning when a POSIX path encoding is incompatible with their UTF-8 scripts. Explicitly requested incompatible shell activators still report an error. Environments created with --activators= or --activators=python remain supported in legacy locales. Undecodable parent paths are now caught before any shell activation script is written. (#3412)

... (truncated)

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.14.9

  • Parse VIRTUALENV_PERIODIC_UPDATE_INSECURE as a boolean, so 0, false, no and off keep certificate verification enabled. (:issue:3398)

  • Reject destinations whose resolved path contains the platform's PATH separator, including separators inherited from the working directory or a directory symlink. (:issue:3399)

  • Preserve an existing pyvenv.cfg when a prompt or configuration value cannot be encoded as UTF-8, instead of leaving the file empty after a failed environment creation. The file now ends its lines with LF on every platform.

    Debug logs show each configuration line as a Python string literal, so control characters are visible. (:issue:3400)

  • Skip writing a .venv redirect when the environment name contains a line boundary. The environment is still created, and any existing redirect remains unchanged. (:issue:3401)

  • Preserve non-ASCII values in activate_this.py when applications read the script with a legacy text encoding before executing it. (:issue:3402)

  • Reject malformed seed versions and requirements ending in archive suffixes before starting pip, with an error identifying the invalid value instead of a misleading download or local-file error. (:issue:3403)

  • Allow a literal percent sign as a csh prompt and preserve carets in tcsh prompt display instead of interpreting them as control-character notation.

    Separate csh history and prompt escapes from preceding non-ASCII text in legacy locales. (:issue:3404)

  • Report an error when an existing pyvenv.cfg is not a regular file, instead of trying to read or write directories, pipes, or devices as configuration files. (:issue:3405)

  • Preserve percent-containing paths during batch reactivation and show dollar signs literally in command prompts. Skip batch scripts for paths containing line boundaries, and remove stale batch scripts for unsupported paths even when only other activators are selected. (:issue:3406)

  • Compile shared seed-cache bytecode without loading site customizations from the destination environment or importing modules from the current working directory. (:issue:3407)

  • Keep the bundled seed version when a cached periodic update is older, and stop recording downloads below the bundled version during update checks. (:issue:3408)

  • Stop activating a moved environment, leaving PATH unchanged, when the shell is not bash, the script is evaluated or read from standard input, a path tool fails, the sourced file is not the environment's own activation script, or the new location has no pyvenv.cfg, instead of continuing with an incorrect environment path. (:issue:3409)

  • Reject built-in options with missing values before creating the application-data directory or starting interpreter discovery, instead of reporting the argument error after those operations. (:issue:3410)

  • Keep unset-variable bookkeeping out of exported xonsh variables, so child shells do not restore an internal sentinel as PYTHONHOME. Skip xonsh activation for destination names that its PATH handling would expand to a different path.

    Restore unset Tcl/Tk library variables when switching between environments in one xonsh session.

    Preserve non-ASCII paths and prompts when xonsh reads activation scripts with a legacy encoding. (:issue:3411)

  • Skip default shell activators with a warning when a POSIX path encoding is incompatible with their UTF-8 scripts. Explicitly requested incompatible shell activators still report an error. Environments created with --activators= or --activators=python remain supported in legacy locales. Undecodable parent paths are now caught before any shell activation script is written. (:issue:3412)

  • Keep apostrophes and backslashes in fish activation values separate from preceding non-ASCII characters, so fish 3

... (truncated)

Commits
  • e53e30b release 21.14.9
  • 2519941 🐛 fix(seed): preserve interpreter paths in console scripts (#3417)
  • 70a0102 🐛 fix(seed): preserve shared cache when reseeding with pip (#3423)
  • 554d9f9 🐛 fix(create): replace linked output directories (#3429)
  • 7babec6 🐛 fix(seed): verify wheels before caching (#3430)
  • 2dc8bd8 🐛 fix(subprocess): omit implicit helper import paths (#3416)
  • d25f286 🐛 fix(create): replace generated file links (#3431)
  • e3cea6f 🐛 fix(seed): contain metadata cleanup (#3428)
  • 2bfdc02 🐛 fix(path): preserve link targets on delete errors (#3427)
  • 6196d35 🐛 fix(seed): retain the parent installation for updates (#3420)
  • Additional commits viewable in compare view

Updates certifi from 2026.5.20 to 2026.10.19

Commits

Updates virtualenv from 21.14.4 to 21.14.9

Release notes

Sourced from virtualenv's releases.

21.14.9

Bugfixes - 21.14.9

  • Parse VIRTUALENV_PERIODIC_UPDATE_INSECURE as a boolean, so 0, false, no and off keep certificate verification enabled. (#3398)

  • Reject destinations whose resolved path contains the platform's PATH separator, including separators inherited from the working directory or a directory symlink. (#3399)

  • Preserve an existing pyvenv.cfg when a prompt or configuration value cannot be encoded as UTF-8, instead of leaving the file empty after a failed environment creation. The file now ends its lines with LF on every platform.

    Debug logs show each configuration line as a Python string literal, so control characters are visible. (#3400)

  • Skip writing a .venv redirect when the environment name contains a line boundary. The environment is still created, and any existing redirect remains unchanged. (#3401)

  • Preserve non-ASCII values in activate_this.py when applications read the script with a legacy text encoding before executing it. (#3402)

  • Reject malformed seed versions and requirements ending in archive suffixes before starting pip, with an error identifying the invalid value instead of a misleading download or local-file error. (#3403)

  • Allow a literal percent sign as a csh prompt and preserve carets in tcsh prompt display instead of interpreting them as control-character notation.

    Separate csh history and prompt escapes from preceding non-ASCII text in legacy locales. (#3404)

  • Report an error when an existing pyvenv.cfg is not a regular file, instead of trying to read or write directories, pipes, or devices as configuration files. (#3405)

  • Preserve percent-containing paths during batch reactivation and show dollar signs literally in command prompts. Skip batch scripts for paths containing line boundaries, and remove stale batch scripts for unsupported paths even when only other activators are selected. (#3406)

  • Compile shared seed-cache bytecode without loading site customizations from the destination environment or importing modules from the current working directory. (#3407)

  • Keep the bundled seed version when a cached periodic update is older, and stop recording downloads below the bundled version during update checks. (#3408)

  • Stop activating a moved environment, leaving PATH unchanged, when the shell is not bash, the script is evaluated or read from standard input, a path tool fails, the sourced file is not the environment's own activation script, or the new location has no pyvenv.cfg, instead of continuing with an incorrect environment path. (#3409)

  • Reject built-in options with missing values before creating the application-data directory or starting interpreter discovery, instead of reporting the argument error after those operations. (#3410)

  • Keep unset-variable bookkeeping out of exported xonsh variables, so child shells do not restore an internal sentinel as PYTHONHOME. Skip xonsh activation for destination names that its PATH handling would expand to a different path.

    Restore unset Tcl/Tk library variables when switching between environments in one xonsh session.

    Preserve non-ASCII paths and prompts when xonsh reads activation scripts with a legacy encoding. (#3411)

  • Skip default shell activators with a warning when a POSIX path encoding is incompatible with their UTF-8 scripts. Explicitly requested incompatible shell activators still report an error. Environments created with --activators= or --activators=python remain supported in legacy locales. Undecodable parent paths are now caught before any shell activation script is written. (#3412)

... (truncated)

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.14.9

  • Parse VIRTUALENV_PERIODIC_UPDATE_INSECURE as a boolean, so 0, false, no and off keep certificate verification enabled. (:issue:3398)

  • Reject destinations whose resolved path contains the platform's PATH separator, including separators inherited from the working directory or a directory symlink. (:issue:3399)

  • Preserve an existing pyvenv.cfg when a prompt or configuration value cannot be encoded as UTF-8, instead of leaving the file empty after a failed environment creation. The file now ends its lines with LF on every platform.

    Debug logs show each configuration line as a Python string literal, so control characters are visible. (:issue:3400)

  • Skip writing a .venv redirect when the environment name contains a line boundary. The environment is still created, and any existing redirect remains unchanged. (:issue:3401)

  • Preserve non-ASCII values in activate_this.py when applications read the script with a legacy text encoding before executing it. (:issue:3402)

  • Reject malformed seed versions and requirements ending in archive suffixes before starting pip, with an error identifying the invalid value instead of a misleading download or local-file error. (:issue:3403)

  • Allow a literal percent sign as a csh prompt and preserve carets in tcsh prompt display instead of interpreting them as control-character notation.

    Separate csh history and prompt escapes from preceding non-ASCII text in legacy locales. (:issue:3404)

  • Report an error when an existing pyvenv.cfg is not a regular file, instead of trying to read or write directories, pipes, or devices as configuration files. (:issue:3405)

  • Preserve percent-containing paths during batch reactivation and show dollar signs literally in command prompts. Skip batch scripts for paths containing line boundaries, and remove stale batch scripts for unsupported paths even when only other activators are selected. (:issue:3406)

  • Compile shared seed-cache bytecode without loading site customizations from the destination environment or importing modules from the current working directory. (:issue:3407)

  • Keep the bundled seed version when a cached periodic update is older, and stop recording downloads below the bundled version during update checks. (:issue:3408)

  • Stop activating a moved environment, leaving PATH unchanged, when the shell is not bash, the script is evaluated or read from standard input, a path tool fails, the sourced file is not the environment's own activation script, or the new location has no pyvenv.cfg, instead of continuing with an incorrect environment path. (:issue:3409)

  • Reject built-in options with missing values before creating the application-data directory or starting interpreter discovery, instead of reporting the argument error after those operations. (:issue:3410)

  • Keep unset-variable bookkeeping out of exported xonsh variables, so child shells do not restore an internal sentinel as PYTHONHOME. Skip xonsh activation for destination names that its PATH handling would expand to a different path.

    Restore unset Tcl/Tk library variables when switching between environments in one xonsh session.

    Preserve non-ASCII paths and prompts when xonsh reads activation scripts with a legacy encoding. (:issue:3411)

  • Skip default shell activators with a warning when a POSIX path encoding is incompatible with their UTF-8 scripts. Explicitly requested incompatible shell activators still report an error. Environments created with --activators= or --activators=python remain supported in legacy locales. Undecodable parent paths are now caught before any shell activation script is written. (:issue:3412)

  • Keep apostrophes and backslashes in fish activation values separate from preceding non-ASCII characters, so fish 3

... (truncated)

Commits
  • e53e30b release 21.14.9
  • 2519941 🐛 fix(seed): preserve interpreter paths in console scripts (#3417)
  • 70a0102 🐛 fix(seed): preserve shared cache when reseeding with pip (#3423)
  • 554d9f9 🐛 fix(create): replace linked output directories (#3429)
  • 7babec6 🐛 fix(seed): verify wheels before caching (#3430)
  • 2dc8bd8 🐛 fix(subprocess): omit implicit helper import paths (#3416)
  • d25f286 🐛 fix(create): replace generated file links (#3431)
  • e3cea6f 🐛 fix(seed): contain metadata cleanup (#3428)
  • 2bfdc02 🐛 fix(path): preserve link targets on delete errors (#3427)
  • 6196d35 🐛 fix(seed): retain the parent installation for updates (#3420)
  • Additional commits viewable in compare view

Updates certifi from 2026.2.25 to 2026.10.19

Commits

Updates virtualenv from 21.14.4 to 21.14.9

Release notes

Sourced from virtualenv's releases.

21.14.9

Bugfixes - 21.14.9

  • Parse VIRTUALENV_PERIODIC_UPDATE_INSECURE as a boolean, so 0, false, no and off keep certificate verification enabled. (#3398)

  • Reject destinations whose resolved path contains the platform's PATH separator, including separators inherited from the working directory or a directory symlink. (#3399)

  • Preserve an existing pyvenv.cfg when a prompt or configuration value cannot be encoded as UTF-8, instead of leaving the file empty after a failed environment creation. The file now ends its lines with LF on every platform.

    Debug logs show each configuration line as a Python string literal, so control characters are visible. (#3400)

  • Skip writing a .venv redirect when the environment name contains a line boundary. The environment is still created, and any existing redirect remains unchanged. (#3401)

  • Preserve non-ASCII values in activate_this.py when applications read the script with a legacy text encoding before executing it. (#3402)

  • Reject malformed seed versions and requirements ending in archive suffixes before starting pip, with an error identifying the invalid value instead of a misleading download or local-file error. (#3403)

  • Allow a literal percent sign as a csh prompt and preserve carets in tcsh prompt display instead of interpreting them as control-character notation.

    Separate csh history and prompt escapes from preceding non-ASCII text in legacy locales. (#3404)

  • Report an error when an existing pyvenv.cfg is not a regular file, instead of trying to read or write directories, pipes, or devices as configuration files. (#3405)

  • Preserve percent-containing paths during batch reactivation and show dollar signs literally in command prompts. Skip batch scripts for paths containing line boundaries, and remove stale batch scripts for unsupported paths even when only other activators are selected. (#3406)

  • Compile shared seed-cache bytecode without loading site customizations from the destination environment or importing modules from the current working directory. (#3407)

  • Keep the bundled seed version when a cached periodic update is older, and stop recording downloads below the bundled version during update checks. (#3408)

  • Stop activating a moved environment, leaving PATH unchanged, when the shell is not bash, the script is evaluated or read from standard input, a path tool fails, the sourced file is not the environment's own activation script, or the new location has no pyvenv.cfg, instead of continuing with an incorrect environment path. (#3409)

  • Reject built-in options with missing values before creating the application-data directory or starting interpreter discovery, instead of reporting the argument error after those operations. (#3410)

  • Keep unset-variable bookkeeping out of exported xonsh variables, so child shells do not restore an internal sentinel as PYTHONHOME. Skip xonsh activation for destination names that its PATH handling would expand to a different path.

    Restore unset Tcl/Tk library variables when switching between environments in one xonsh session.

    Preserve non-ASCII paths and prompts when xonsh reads activation scripts with a legacy encoding. (#3411)

  • Skip default shell activators with a warning when a POSIX path encoding is incompatible with their UTF-8 scripts. Explicitly requested incompatible shell activators still report an error. Environments created with --activators= or --activators=python remain supported in legacy locales. Undecodable parent paths are now caught before any shell activation script is written. (#3412)

... (truncated)

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.14.9

  • Parse VIRTUALENV_PERIODIC_UPDATE_INSECURE as a boolean, so 0, false, no and off keep certificate verification enabled. (:issue:3398)

  • Reject destinations whose resolved path contains the platform's PATH separator, including separators inherited from the working directory or a directory symlink. (:issue:3399)

  • Preserve an existing pyvenv.cfg when a prompt or configuration value cannot be encoded as UTF-8, instead of leaving the file empty after a failed environment creation. The file now ends its lines with LF on every platform.

    Debug logs show each configuration line as a Python string literal, so control characters are visible. (:issue:3400)

  • Skip writing a .venv redirect when the environment name contains a line boundary. The environment is still created, and any existing redirect remains unchanged. (:issue:3401)

  • Preserve non-ASCII values in activate_this.py when applications read the script with a legacy text encoding before executing it. (:issue:3402)

  • Reject malformed seed versions and requirements ending in archive suffixes before starting pip, with an error identifying the invalid value instead of a misleading download or local-file error. (:issue:3403)

  • Allow a literal percent sign as a csh prompt and preserve carets in tcsh prompt display instead of interpreting them as control-character notation.

    Separate csh history and prompt escapes from preceding non-ASCII text in legacy locales. (:issue:3404)

  • Report an error when an existing pyvenv.cfg is not a regular file, instead of trying to read or write directories, pipes, or devices as configuration files. (:issue:3405)

  • Preserve percent-containing paths during batch reactivation and show dollar signs literally in command prompts. Skip batch scripts for paths containing line boundaries, and remove stale batch scripts for unsupported paths even when only other activators are selected. (:issue:3406)

  • Compile shared seed-cache bytecode without loading site customizations from the destination environment or importing modules from the current working directory. (:issue:3407)

  • Keep the bundled seed version when a cached periodic update is older, and stop recording downloads below the bundled version during update checks. (:issue:3408)

  • Stop activating a moved environment, leaving PATH unchanged, when the shell is not bash, the script is evaluated or read from standard input, a path tool fails, the sourced file is not the environment's own activation script, or the new location has no pyvenv.cfg, instead of continuing with an incorrect environment path. (:issue:3409)

  • Reject built-in options with missing values before creating the application-data directory or starting interpreter discovery, instead of reporting the argument error after those operations. (:issue:3410)

  • Keep unset-variable bookkeeping out of exported xonsh variables, so child shells do not restore an internal sentinel as PYTHONHOME. Skip xonsh activation for destination names that its PATH handling would expand to a different path.

    Restore unset Tcl/Tk library variables when switching between environments in one xonsh session.

    Preserve non-ASCII paths and prompts when xonsh reads activation scripts with a legacy encoding. (:issue:3411)

  • Skip default shell activators with a warning when a POSIX path encoding is incompatible with their UTF-8 scripts. Explicitly requested incompatible shell activators still report an error. Environments created with --activators= or --activators=python remain supported in legacy locales. Undecodable parent paths are now caught before any shell activation script is written. (:issue:3412)

  • Keep apostrophes and backslashes in fish activation values separate from preceding non-ASCII characters, so fish 3

... (truncated)

Commits
  • e53e30b release 21.14.9
  • 2519941 🐛 fix(seed): preserve interpreter paths in console scripts (#3417)
  • 70a0102 🐛 fix(seed): preserve shared cache when reseeding with pip (#3423)
  • 554d9f9 🐛 fix(create): replace linked output directories (#3429)
  • 7babec6 🐛 fix(seed): verify wheels before caching (#3430)
  • 2dc8bd8 🐛 fix(subprocess): omit implicit helper import paths (#3416)
  • d25f286 🐛 fix(create): replace generated file links (#3431)
  • e3cea6f 🐛 fix(seed): contain metadata cleanup (#3428)
  • 2bfdc02 🐛 fix(path): preserve link targets on delete errors (#3427)
  • 6196d35 🐛 fix(seed): retain the parent installation for updates (#3420)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump the pip group across 4 directories with 2 updates
1419007 
Bumps the pip group with 2 updates in the /backend directory: [certifi](https://github.com/certifi/python-certifi) and [virtualenv](https://github.com/pypa/virtualenv).
Bumps the pip group with 2 updates in the /backend/requirements directory: [certifi](https://github.com/certifi/python-certifi) and [virtualenv](https://github.com/pypa/virtualenv).
Bumps the pip group with 1 update in the /docs directory: [certifi](https://github.com/certifi/python-certifi).
Bumps the pip group with 1 update in the /tools/requirements directory: [virtualenv](https://github.com/pypa/virtualenv).


Updates `certifi` from 2026.5.20 to 2026.10.19
- [Commits](certifi/python-certifi@2026.05.20...2026.10.19)

Updates `virtualenv` from 21.14.4 to 21.14.9
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@21.14.4...21.14.9)

Updates `certifi` from 2026.5.20 to 2026.10.19
- [Commits](certifi/python-certifi@2026.05.20...2026.10.19)

Updates `virtualenv` from 21.14.4 to 21.14.9
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@21.14.4...21.14.9)

Updates `certifi` from 2026.2.25 to 2026.10.19
- [Commits](certifi/python-certifi@2026.05.20...2026.10.19)

Updates `virtualenv` from 21.14.4 to 21.14.9
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@21.14.4...21.14.9)

---
updated-dependencies:
- dependency-name: certifi
  dependency-version: 2026.10.19
  dependency-type: indirect
  dependency-group: pip
- dependency-name: virtualenv
  dependency-version: 21.14.9
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: certifi
  dependency-version: 2026.10.19
  dependency-type: indirect
  dependency-group: pip
- dependency-name: virtualenv
  dependency-version: 21.14.9
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: certifi
  dependency-version: 2026.10.19
  dependency-type: indirect
  dependency-group: pip
- dependency-name: virtualenv
  dependency-version: 21.14.9
  dependency-type: direct:production
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested review from arkid15r and kasya as code owners October 21, 2026 23:27
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Oct 21, 2026
@coderabbitai

coderabbitai Bot commented Oct 21, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Repository: OWASP/Nest/.coderabbit.yaml
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 192e679e-8e8b-4a19-be03-b41a07140cdf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@sonarqubecloud

sonarqubecloud Bot commented Oct 21, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@codecov

codecov Bot commented Oct 21, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.60%. Comparing base (e242695) to head (1419007).

Additional details and impacted files

Impacted file tree graph

@@           Coverage Diff           @@
##             main    #5729   +/-   ##
=======================================
  Coverage   98.60%   98.60%           
=======================================
  Files         551      551           
  Lines       18430    18430           
  Branches     2685     2685           
=======================================
  Hits        18172    18172           
  Misses        126      126           
  Partials      132      132
Flag Coverage Δ
backend 98.99% <ø> (ø)
frontend 97.36% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update e242695...1419007. Read the comment docs.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@arkid15r
arkid15r enabled auto-merge October 22, 2026 02:09
@arkid15r
arkid15r added this pull request to the merge queue Oct 22, 2026
Merged via the queue into main with commit 1b765e6 Oct 22, 2026
35 of 37 checks passed
@arkid15r
arkid15r deleted the dependabot/pip/backend/pip-0a1b34ae50 branch October 22, 2026 03:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@arkid15r arkid15r arkid15r approved these changes
@kasya kasya kasya approved these changes

Assignees

No one assigned

Labels

backend dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@arkid15r @kasya