Skip to content

chore(deps): bump the python-minor-and-patch group with 3 updates - #243

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-minor-and-patch-420ad119f4
Open

chore(deps): bump the python-minor-and-patch group with 3 updates#243
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-minor-and-patch-420ad119f4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 6, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-minor-and-patch group with 3 updates: nodeenv, python-discovery and virtualenv.

Updates nodeenv from 1.11.0 to 1.12.0

Release notes

Sourced from nodeenv's releases.

1.12.0

What's Changed

New Features 🎉

Fixed bugs 🐛

Improvements 🛠

Documentation 📄

Other Changes

New Contributors

Full Changelog: ekalinin/nodeenv@1.11.1...1.12.0

1.11.1

What's Changed

Fixed bugs 🐛

1.11.1 is 1.11.0 plus this fix only. nodejs.org now lists 27.0.0-alpha.0.0.0 first, and nodeenv stopped with a traceback when it used the default latest or a semver range (#453).

Full Changelog: ekalinin/nodeenv@1.11.0...1.11.1

Changelog

Sourced from nodeenv's changelog.

Version 1.12.0

  • --print-completion SHELL prints a completion script for bash, zsh or fish. It needs shtab, installed with pip install "nodeenv[completion]" [#351](https://github.com/ekalinin/nodeenv/issues/351) <https://github.com/ekalinin/nodeenv/issues/351>_
  • --prebuilt installs no longer fail when the environment path or the node.js version contains [, * or ? [#441](https://github.com/ekalinin/nodeenv/issues/441) <https://github.com/ekalinin/nodeenv/issues/441>_
  • On Windows, Cygwin and MSYS the node.js zip archive is extracted 32 files at a time instead of one by one, so a security scanner that checks every new file no longer makes the install wait for each file in turn. --no-parallel-extract, or parallel_extract = False in ~/.nodeenvrc, extracts it one file at a time again [#366](https://github.com/ekalinin/nodeenv/issues/366) <https://github.com/ekalinin/nodeenv/issues/366>_
  • --prebuilt installs no longer mistake a cached source tree for a prebuilt archive, or fail when both trees remain in src/ [#443](https://github.com/ekalinin/nodeenv/issues/443) <https://github.com/ekalinin/nodeenv/issues/443>_
  • activate.fish restores the caller's NODE_PATH and npm configuration on deactivation, including empty values and when NODE_VIRTUAL_ENV has been removed. Existing environments keep their old activate.fish; recreate them with the same options to get the fix. With -p, remove the old nodeenv part from the virtualenv's activate.fish first [#399](https://github.com/ekalinin/nodeenv/issues/399) <https://github.com/ekalinin/nodeenv/issues/399>_
  • A % in a [nodeenv] config value, such as a percent-encoded mirror login, no longer crashes nodeenv: a value that can't be interpolated and has no %(name)s reference is read as written. %% still gives %, which setup.cfg needs, as setuptools reads that file too [#440](https://github.com/ekalinin/nodeenv/issues/440) <https://github.com/ekalinin/nodeenv/issues/440>_
  • nodeenv -p no longer puts the python venv's bin directory on PATH a second time: the venv's own activate and activate.fish put it there already. Envs without those scripts, such as conda envs, and the git-bash activate on Windows keep it, and running nodeenv -p again fixes an existing venv [#332](https://github.com/ekalinin/nodeenv/issues/332) <https://github.com/ekalinin/nodeenv/issues/332>_
  • Require Python 3.10 or later, matching the minimum version tested in CI. Update package classifiers and wheel tags, and remove the unused Python 2 compatibility paths. Old Node.js source builds still require Python 2.7 as their build interpreter [#436](https://github.com/ekalinin/nodeenv/issues/436) <https://github.com/ekalinin/nodeenv/issues/436>_
  • --source builds of node.js 13 and later no longer need a python2 command; 8.8 to 12.x still need one but point python at it on their own, so the python to python2 link in PATH is only set up for older versions, and versions before 13 still fail early with a clear error when python2 is missing [#419](https://github.com/ekalinin/nodeenv/issues/419) <https://github.com/ekalinin/nodeenv/issues/419>_
  • The node.js archive download also retries when the connection is reset or times out in the middle of the body, pauses between the attempts and ends with an error message instead of a traceback when all of them fail; a server that stops answering is given up on after 60 seconds instead of

... (truncated)

Commits
  • cb7fc97 chore(release): bump nodeenv version to 1.12.0 (#461)
  • c2e21d0 fix(nodeenv): raise on bad config references again (#458)
  • 0fd263f feat(nodeenv): print shell completion scripts with shtab (#460)
  • e1e016b fix(nodeenv): escape glob characters in prebuilt paths (#447)
  • ac28019 perf(nodeenv): unpack the node.js zip archive in parallel (#459)
  • 0e30103 fix(nodeenv): ignore source trees during prebuilt installs (#450)
  • 02f4ce3 fix(nodeenv): read a config value raw when interpolation fails (#449)
  • 2226040 fix(nodeenv): preserve fish activation environment (#431)
  • e27db1e docs(changes): move the #453 entry under 1.11.1 (#455)
  • 8dee9f3 fix(nodeenv): skip node.js pre-releases for latest and ranges (#454)
  • Additional commits viewable in compare view

Updates python-discovery from 1.6.6 to 1.9.2

Release notes

Sourced from python-discovery's releases.

v1.9.2

Bug fixes

  • Match literal interpreter names against the executable found on PATH, including symlink names (#220) by @​gaborbernat. (#188)
  • Preserve a virtual environment selected through try_first_with instead of returning its base interpreter (#218) by @​gaborbernat. (#191)
  • Skip interpreter candidates that return JSON without usable interpreter metadata and continue searching (#231) by @​gaborbernat. (#197)
  • Reject format widths in interpreter sysconfig paths before they allocate oversized strings (#229) by @​gaborbernat. (#199)
  • Check the interpreter's reported implementation when a spec names a known implementation, regardless of its filename on PATH (#233) by @​gaborbernat. (#201)
  • Write interpreter cache entries as compact JSON to keep their size proportional to the interpreter response (#237) by @​gaborbernat. (#204)
  • Prevent an earlier virtual-environment lookup from reporting an executable under the wrong Python version (#215) by @​gaborbernat.
  • Retry interpreter discovery without the cache when cache access fails (#216) by @​gaborbernat.
  • Exclude prereleases of the final version named by an exclusive upper bound, such as <3.12.0 rejecting 3.12.0rc1 (#217) by @​gaborbernat.
  • Stop repeated interpreter queries when a virtual environment reports the same base prefix with different path spellings (#219) by @​gaborbernat.
  • Limit candidate stdout and stderr during interpreter queries so a noisy candidate cannot exhaust the caller's memory (#223) by @​gaborbernat.
  • Find uv-managed patch releases when a version specifier names only their major and minor version (#227) by @​gaborbernat.
  • Handle interpreter paths containing non-UTF-8 filesystem bytes when using DiskCache (#230) by @​gaborbernat.
  • Preserve interpreter-provided values when answer keys match computed properties during cache serialization (#234) by @​gaborbernat.
  • Return after an interpreter query times out without leaving pipe readers blocked by a child process (#228) by @​gaborbernat.
  • Use the supplied environment for base-interpreter probes when resolving a virtual environment (#225) by @​gaborbernat.

Security

  • When an explicit env mapping omits HOME or USERPROFILE, uv-managed interpreter discovery no longer searches the process home directory (#236) by @​gaborbernat. (#200)
  • Skip relative PATH entries, including the working-directory entry in the Windows default search path, when discovering interpreters (#235) by @​gaborbernat. (#202)
  • Validate pyenv, mise and asdf version names before using them as directory names. A version file can no longer direct python-discovery's resolver to a binary outside the version manager's installation directory (#205) by @​gaborbernat.
  • When imported from an archive, python-discovery now extracts its interpreter probe into a private temporary directory. This prevents the probe from importing modules supplied in the shared temp directory (#206) by @​gaborbernat.
  • Bare interpreter names now search PATH without probing a matching file in the working directory. Use ./name when the working directory contains the intended interpreter (#207) by @​gaborbernat.
  • Tcl/Tk library detection no longer executes Tk startup profile files from the home or working directory (#208) by @​gaborbernat.
  • Discovery skips .python-version files over 4096 characters during shim resolution, limiting memory use and allowing a parent or global version to apply (#209) by @​gaborbernat.
  • Discovery uses the profile default for empty or relative APPDATA and skips relative profile paths when finding uv-managed Pythons (#210) by @​gaborbernat.
  • Tcl/Tk library detection no longer opens an X display, so an unresponsive display cannot block interpreter discovery. It can also find the Tk library on headless systems (#211) by @​gaborbernat.
  • Skip PEP 514 registry entries with relative or non-string executable paths and continue interpreter discovery (#212) by @​gaborbernat.
  • Skip untrusted disk cache directories and entries on POSIX, and replace cache files without following links (#213) by @​gaborbernat.
  • Place POSIX cache locks in a restricted directory and preserve group sharing under a group-permissive umask (#214) by @​gaborbernat.
  • Interpreter discovery no longer reuses pyenv shim results across projects. A version choice in one checkout cannot leave an unsupported-version verdict that blocks discovery in another project (#232) by @​gaborbernat.

🐍 PyPI release

📜 Full Changelog

v1.9.1

Bug fixes

  • List free-threaded and debug builds on PATH, such as python3.13t, python3.13d and python3.13-dbg, when iter_interpreters() runs with no spec, as it already did for uv's +freethreaded and +debug installs (#181) by @​darrenhuai and @​gaborbernat.

... (truncated)

Changelog

Sourced from python-discovery's changelog.

################# Release History #################

.. towncrier-draft-entries::

.. towncrier release notes start

.. _release-1-9-5:

v1.9.5 (2026-11-06)

.. _release-1-9-5-fixed:

Fixed

  • :func:~python_discovery.iter_interpreters with no key no longer probes PATH directories or subdirectories named like Python executables as interpreters (:pr:247) by :user:qodelicious and :user:gaborbernat.
  • PythonSpec.satisfies now checks a version specifier at the precision it was written with, so 3.11 no longer satisfies >=3.13. The Windows registry pre-filter skips mismatched releases and interrogates candidates whose prerelease status is unknown (:pr:246) by :user:qodelicious and :user:gaborbernat.

.. _release-1-9-4:

v1.9.4 (2026-11-04)

.. _release-1-9-3:

v1.9.3 (2026-11-03)

.. _release-1-9-3-fixed:

Fixed

  • Reject generic Python executables when a requested implementation is unavailable (:pr:239) by :user:gaborbernat. (:issue:238)

.. _release-1-9-2:

v1.9.2 (2026-11-03)

... (truncated)

Commits
  • 7188a23 release 1.9.2
  • e3f2e93 🐛 fix(query): reject malformed candidates (#231)
  • 8befe13 🐛 fix(py-info): reject sysconfig format widths (#229)
  • 8548640 🐛 fix(cache): hash filesystem path bytes (#230)
  • c943204 🐛 fix(cache): keep shim results out of shared cache (#232)
  • 000d2b5 🐛 fix(py_info): preserve supplied JSON keys (#234)
  • 2ab6e7a 🐛 fix(discovery): skip relative PATH entries (#235)
  • 49356fe 🐛 fix(uv): limit home lookup to supplied env (#236)
  • b91e41d 🐛 fix(cache): write compact interpreter JSON (#237)
  • 5177e91 🐛 fix(path): verify known implementations (#233)
  • Additional commits viewable in compare view

Updates virtualenv from 21.15.0 to 21.15.3

Release notes

Sourced from virtualenv's releases.

21.15.3

Bug fixes

  • Add the environment's lib/pkgconfig to PKG_CONFIG_PATH when activating from xonsh, and restore the previous value or unset it again on deactivate, as the other activators already do (#3505) by @​darrenhuai and @​gaborbernat.
  • Read virtualenv.ini values without interpolation, as environment variables and command line flags already are. A value holding a %, such as prompt = 50% done, was ignored without any message. %% and %(name)s are now kept as written, so write a single % (#3501) by @​darrenhuai and @​gaborbernat.
  • Reject a destination that already exists but is not a directory, such as /dev/null, a FIFO or a socket, or that sits inside one, with a usage error instead of a NotADirectoryError once creation has started. A regular file now gets the same is not a directory message instead of is a file (#3504) by @​darrenhuai and @​gaborbernat.
  • Set TCL_LIBRARY and TK_LIBRARY to the interpreter's Tcl/Tk paths in activate.nu, as the other activators do. Nushell activation used to leave both variables as they were (#3502) by @​darrenhuai and @​gaborbernat.
  • Show the environment name in the zsh prompt when KSH_ARRAYS is set at activation. Since 21.14.13 the prompt read an empty psvar entry under that option and showed () instead of the name (#3506) by @​PDGGK and @​gaborbernat.
  • Treat an empty or blank VIRTUALENV_OVERRIDE_APP_DATA and an empty VIRTUALENV_CONFIG_FILE as unset, as virtualenv already does for its option variables. An empty app-data override, or on Windows one made of spaces, made the current directory the cache, so --reset-app-data deleted it, and an empty config file path logged an error on every run (#3503) by @​darrenhuai and @​gaborbernat.

New Contributors

🐍 PyPI release

📜 Full Changelog

21.15.2

Bug fixes

  • Build the default application data folder only when no folder was given through --app-data, VIRTUALENV_APP_DATA or the configuration file, so --read-only-app-data with an explicit folder works when the default folder is missing, and writable runs stop creating an unused one. Folders from VIRTUALENV_APP_DATA and the configuration file now get the same checks as --app-data (#3488) by @​darrenhuai and @​gaborbernat.
  • Build the seed wheel image in a staging folder and move it into place only once it is complete, so an extraction that fails part way, for example on a full disk, after a killed process or on a path over the Windows length limit, no longer leaves a partial image that later runs seed as a pip without METADATA, RECORD or INSTALLER (#3487) by @​darrenhuai and @​gaborbernat.
  • Make -p/--python and --try-first-with replace the interpreters set by VIRTUALENV_PYTHON, VIRTUALENV_TRY_FIRST_WITH or the configuration file instead of being merged with them, so the configured interpreter no longer wins over the one asked for and a -p that finds nothing fails instead of falling back to it. Try several VIRTUALENV_PYTHON values in the order given rather than starting with the second (#3494) by @​darrenhuai and @​gaborbernat.
  • On Windows, re-create an environment in place when its copied interpreter files, such as python.exe, or its seeded packages are read-only, instead of failing with PermissionError (#3492) by @​darrenhuai and @​gaborbernat.
  • Reject an empty or whitespace-only destination. An empty one, and on Windows one made only of spaces, resolved to the current directory, so an unset VENV in virtualenv --clear "$VENV" deleted the working directory. Pass . to create the environment in the current directory (#3491) by @​darrenhuai and @​gaborbernat.
  • Restore the default prompt in deactivate.bat when PROMPT was undefined at activation, instead of leaving the environment name in front of it (#3489) by @​darrenhuai.
  • Undefine PATH again in deactivate.bat when it was undefined at activation, instead of leaving the environment's Scripts folder on it, and stop a second activate.bat from adding that folder twice (#3493) by @​darrenhuai and @​gaborbernat.

PyPI release

Full Changelog

21.15.1

Bug fixes

  • Keep the name of a seeded console_scripts entry that contains digits but does not end in a version, such as python3-config or 2to3, instead of truncating it at the first digit; python3-config overwrote the environment's python executable (#3451) by @​JingHao-Leon and @​gaborbernat.
  • Copy the content of a symlinked directory when a tree is copied into an environment, instead of dropping it (#3454) by @​JingHao-Leon and @​gaborbernat.
  • Count each -v, -q, -p and --try-first-with option once instead of once per internal parsing pass, so Session.verbosity is 3 rather than 9 for a single -v (#3457) by @​darrenhuai and @​gaborbernat.
  • Copy the seed packages instead of failing when VIRTUALENV_SYMLINK_APP_DATA or symlink_app_data in the config file turns on symlink seeding on a host that cannot create symlinks, such as Windows without the symlink privilege (#3465) by @​darrenhuai and @​gaborbernat.
  • Run the interpreter that collects the target debug information (-vv output and Creator.debug) without PYTHONPATH and with the environment passed to cli_run, so the reported sys.path no longer lists the caller's PYTHONPATH entries (#3474) by @​RaphaelFakhri and @​gaborbernat.

New Contributors

... (truncated)

Changelog

Sourced from virtualenv's changelog.

################# Release History #################

.. towncrier-draft-entries:: [UNRELEASED DRAFT]

.. towncrier release notes start

.. _release-21-15-6:

21.15.6 (2026-11-06)

.. _release-21-15-6-fixed:

Fixed

  • Clear inherited PYTHONHOME during PowerShell, Nushell, and programmatic activation so child interpreters use the environment's standard library. Preserve empty values when Bash and fish deactivate (:pr:3517) by :user:gaborbernat.
  • Remove empty PATH entries during programmatic activation, including entries in an otherwise nonempty value. On POSIX, an empty entry searches the current directory (:pr:3513) by :user:qodelicious and :user:gaborbernat.
  • Unset PYTHONHOME during C shell activation and restore its original value on deactivation. An inherited value could previously prevent the environment's Python interpreter from starting (:pr:3514) by :user:abhishekcpp007 and :user:gaborbernat.

.. _release-21-15-5:

21.15.5 (2026-11-04)

.. _release-21-15-4:

21.15.4 (2026-11-04)

.. _release-21-15-4-fixed:

Fixed

  • Upgrade embedded wheels: pip to 26.3 from 26.2.2 (:pr:3508) by :user:gaborbernat.

.. _release-21-15-3:

... (truncated)

Commits
  • 12741f6 release 21.15.3
  • c28879e 🐛 fix(xonsh): prepend lib/pkgconfig to PKG_CONFIG_PATH (#3505)
  • 6d790dc 🐛 fix(bash): show the zsh prompt name under KSH_ARRAYS (#3506)
  • 586c6a2 🐛 fix(create): reject a destination that is not a directory (#3504)
  • 83fd14b 🐛 fix(config): read virtualenv.ini values literally (#3501)
  • c929282 🐛 fix(nushell): set TCL_LIBRARY and TK_LIBRARY on activation (#3502)
  • cd5310b 🐛 fix(app-data): ignore an empty VIRTUALENV_OVERRIDE_APP_DATA (#3503)
  • 2ac0fe4 ♻️ refactor(core): remove unused declarations (#3500)
  • 3c7e1e8 👷 ci(scorecard): reuse shared analysis (#3499)
  • 9a000fc 👷 ci(upgrade): use release App for PRs (#3498)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the python-minor-and-patch group with 3 updates
e69e099 
Bumps the python-minor-and-patch group with 3 updates: [nodeenv](https://github.com/ekalinin/nodeenv), [python-discovery](https://github.com/tox-dev/python-discovery) and [virtualenv](https://github.com/pypa/virtualenv).


Updates `nodeenv` from 1.11.0 to 1.12.0
- [Release notes](https://github.com/ekalinin/nodeenv/releases)
- [Changelog](https://github.com/ekalinin/nodeenv/blob/master/CHANGES)
- [Commits](ekalinin/nodeenv@1.11.0...1.12.0)

Updates `python-discovery` from 1.6.6 to 1.9.2
- [Release notes](https://github.com/tox-dev/python-discovery/releases)
- [Changelog](https://github.com/tox-dev/python-discovery/blob/main/docs/changelog.rst)
- [Commits](tox-dev/python-discovery@1.6.6...1.9.2)

Updates `virtualenv` from 21.15.0 to 21.15.3
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@21.15.0...21.15.3)

---
updated-dependencies:
- dependency-name: nodeenv
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: python-discovery
  dependency-version: 1.9.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: virtualenv
  dependency-version: 21.15.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from esacteksab as a code owner November 6, 2026 23:03
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file 🔗 python Pull requests that update python code labels Nov 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@esacteksab esacteksab Awaiting requested review from esacteksab esacteksab is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file 🔗 python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants