[dependabot]

Bumps virtualenv from 21.15.1 to 21.15.2.

Release notes

Sourced from virtualenv's releases.

21.15.2

Bug fixes

• Build the default application data folder only when no folder was given through --app-data, VIRTUALENV_APP_DATA or the configuration file, so --read-only-app-data with an explicit folder works when the default folder is missing, and writable runs stop creating an unused one. Folders from VIRTUALENV_APP_DATA and the configuration file now get the same checks as --app-data (#3488) by @​darrenhuai and @​gaborbernat.
• Build the seed wheel image in a staging folder and move it into place only once it is complete, so an extraction that fails part way, for example on a full disk, after a killed process or on a path over the Windows length limit, no longer leaves a partial image that later runs seed as a pip without METADATA, RECORD or INSTALLER (#3487) by @​darrenhuai and @​gaborbernat.
• Make -p/--python and --try-first-with replace the interpreters set by VIRTUALENV_PYTHON, VIRTUALENV_TRY_FIRST_WITH or the configuration file instead of being merged with them, so the configured interpreter no longer wins over the one asked for and a -p that finds nothing fails instead of falling back to it. Try several VIRTUALENV_PYTHON values in the order given rather than starting with the second (#3494) by @​darrenhuai and @​gaborbernat.
• On Windows, re-create an environment in place when its copied interpreter files, such as python.exe, or its seeded packages are read-only, instead of failing with PermissionError (#3492) by @​darrenhuai and @​gaborbernat.
• Reject an empty or whitespace-only destination. An empty one, and on Windows one made only of spaces, resolved to the current directory, so an unset VENV in virtualenv --clear "$VENV" deleted the working directory. Pass . to create the environment in the current directory (#3491) by @​darrenhuai and @​gaborbernat.
• Restore the default prompt in deactivate.bat when PROMPT was undefined at activation, instead of leaving the environment name in front of it (#3489) by @​darrenhuai.
• Undefine PATH again in deactivate.bat when it was undefined at activation, instead of leaving the environment's Scripts folder on it, and stop a second activate.bat from adding that folder twice (#3493) by @​darrenhuai and @​gaborbernat.

PyPI release

Full Changelog

Changelog

Sourced from virtualenv's changelog.

################# Release History #################

.. towncrier-draft-entries:: [UNRELEASED DRAFT]

.. towncrier release notes start

.. _release-21-15-3:

---

21.15.3 (2026-11-03)

---

.. _release-21-15-3-fixed:

Fixed

• Add the environment's lib/pkgconfig to PKG_CONFIG_PATH when activating from xonsh, and restore the previous value or unset it again on deactivate, as the other activators already do (:pr:3505) by :user:darrenhuai and :user:gaborbernat.
• Read virtualenv.ini values without interpolation, as environment variables and command line flags already are. A value holding a %, such as prompt = 50% done, was ignored without any message. %% and %(name)s are now kept as written, so write a single % (:pr:3501) by :user:darrenhuai and :user:gaborbernat.
• Reject a destination that already exists but is not a directory, such as /dev/null, a FIFO or a socket, or that sits inside one, with a usage error instead of a NotADirectoryError once creation has started. A regular file now gets the same is not a directory message instead of is a file (:pr:3504) by :user:darrenhuai and :user:gaborbernat.
• Set TCL_LIBRARY and TK_LIBRARY to the interpreter's Tcl/Tk paths in activate.nu, as the other activators do. Nushell activation used to leave both variables as they were (:pr:3502) by :user:darrenhuai and :user:gaborbernat.
• Show the environment name in the zsh prompt when KSH_ARRAYS is set at activation. Since 21.14.13 the prompt read an empty psvar entry under that option and showed () instead of the name (:pr:3506) by :user:PDGGK and :user:gaborbernat.
• Treat an empty or blank VIRTUALENV_OVERRIDE_APP_DATA and an empty VIRTUALENV_CONFIG_FILE as unset, as virtualenv already does for its option variables. An empty app-data override, or on Windows one made of spaces, made the current directory the cache, so --reset-app-data deleted it, and an empty config file path logged an error on every run (:pr:3503) by :user:darrenhuai and :user:gaborbernat.

.. _release-21-15-2:

---

21.15.2 (2026-10-30)

---

.. _release-21-15-2-fixed:

Fixed

... (truncated)

Commits

• 53c21ee release 21.15.2
• a7999ab 🐛 fix(create): reject an empty destination (#3491)
• bf99d28 🐛 fix(discovery): let -p replace the python set in config or env (#3494)
• 9015069 🐛 fix(batch): remember an undefined PATH so deactivate can restore it (#3493)
• 58c5c10 🐛 fix(create): replace read-only interpreter files on Windows (#3492)
• 861cff7 🐛 fix(batch): save an undefined PROMPT so deactivate can restore it (#3489)
• c279422 ♻️ refactor(seed): pass the build folder explicitly (#3490)
• 7e8102f 🐛 fix(app-data): build the default folder only when none is given (#3488)
• 59edf49 🐛 fix(seed): keep partial wheel images out of the cache (#3487)
• fc01ea4 👷 ci: lint activate.sh prompt with semgrep (#3483)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)