chore(deps): bump virtualenv to 21.14.12 for Dependabot alert

Merged
FA
1d ago
+5-3

All Submissions:

  • Have you followed the guidelines stated in CONTRIBUTING.md file?
  • Have you checked to ensure there aren't any other open Pull Requests for the desired changed?

Type of change

  • Dependency security bump (no code changes)

Description

Dependabot flags virtualenv < 21.14.9 in uv.lock: a destination path supplied to virtualenv can be interpreted as shell syntax by the POSIX console launchers its app-data seeder generates (CVSS 7.8, patched in 21.14.9). It reaches our lock as a transitive dependency of pre-commit.

This bumps the locked virtualenv from 21.14.7 to 21.14.12.

  • Every patched release was published inside the 7-day exclude-newer window, so virtualenv gets a dated per-package override in [tool.uv.exclude-newer-package] (and the mirrored lock [options]), the same pattern used for pillow and certifi in #7628. It can be dropped after 2026-10-28.
  • 21.14.12's dependency constraints are identical to 21.14.7's and every locked dependency already satisfies them, so no other lock entry moved.

Note: a full uv lock re-resolve currently fails on main even without this change (the Python 3.15 / win32 split cannot satisfy reflex-enterprise's reflex[db] requirement). That is unrelated to virtualenv, so this PR patches the lock entry directly rather than re-resolving the workspace.

Verification

  • uv lock --check passes.
  • uv sync --frozen installs virtualenv==21.14.12 with its hash verified; import virtualenv reports 21.14.12.

https://claude.ai/code/session_019UwxBvs15C7v1ReWSJ61CW

Generated by Claude Code