[dependabot]

Bumps the uv group with 2 updates in the / directory: virtualenv and pypdf.
Bumps the uv group with 2 updates in the /ops directory: virtualenv and pypdf.
Bumps the uv group with 1 update in the /tools/DataDesigner directory: virtualenv.
Bumps the uv group with 2 updates in the /training/configs/stage_configs directory: certifi and pillow.

Updates virtualenv from 21.14.5 to 21.14.9

Release notes

Sourced from virtualenv's releases.

21.14.9

Bugfixes - 21.14.9

• Parse VIRTUALENV_PERIODIC_UPDATE_INSECURE as a boolean, so 0, false, no and off keep certificate verification enabled. (#3398)

• Reject destinations whose resolved path contains the platform's PATH separator, including separators inherited from the working directory or a directory symlink. (#3399)

• Preserve an existing pyvenv.cfg when a prompt or configuration value cannot be encoded as UTF-8, instead of leaving the file empty after a failed environment creation. The file now ends its lines with LF on every platform.

  Debug logs show each configuration line as a Python string literal, so control characters are visible. (#3400)

• Skip writing a .venv redirect when the environment name contains a line boundary. The environment is still created, and any existing redirect remains unchanged. (#3401)

• Preserve non-ASCII values in activate_this.py when applications read the script with a legacy text encoding before executing it. (#3402)

• Reject malformed seed versions and requirements ending in archive suffixes before starting pip, with an error identifying the invalid value instead of a misleading download or local-file error. (#3403)

• Allow a literal percent sign as a csh prompt and preserve carets in tcsh prompt display instead of interpreting them as control-character notation.

  Separate csh history and prompt escapes from preceding non-ASCII text in legacy locales. (#3404)

• Report an error when an existing pyvenv.cfg is not a regular file, instead of trying to read or write directories, pipes, or devices as configuration files. (#3405)

• Preserve percent-containing paths during batch reactivation and show dollar signs literally in command prompts. Skip batch scripts for paths containing line boundaries, and remove stale batch scripts for unsupported paths even when only other activators are selected. (#3406)

• Compile shared seed-cache bytecode without loading site customizations from the destination environment or importing modules from the current working directory. (#3407)

• Keep the bundled seed version when a cached periodic update is older, and stop recording downloads below the bundled version during update checks. (#3408)

• Stop activating a moved environment, leaving PATH unchanged, when the shell is not bash, the script is evaluated or read from standard input, a path tool fails, the sourced file is not the environment's own activation script, or the new location has no pyvenv.cfg, instead of continuing with an incorrect environment path. (#3409)

• Reject built-in options with missing values before creating the application-data directory or starting interpreter discovery, instead of reporting the argument error after those operations. (#3410)

• Keep unset-variable bookkeeping out of exported xonsh variables, so child shells do not restore an internal sentinel as PYTHONHOME. Skip xonsh activation for destination names that its PATH handling would expand to a different path.

  Restore unset Tcl/Tk library variables when switching between environments in one xonsh session.

  Preserve non-ASCII paths and prompts when xonsh reads activation scripts with a legacy encoding. (#3411)

• Skip default shell activators with a warning when a POSIX path encoding is incompatible with their UTF-8 scripts. Explicitly requested incompatible shell activators still report an error. Environments created with --activators= or --activators=python remain supported in legacy locales. Undecodable parent paths are now caught before any shell activation script is written. (#3412)

... (truncated)

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.14.9

• Parse VIRTUALENV_PERIODIC_UPDATE_INSECURE as a boolean, so 0, false, no and off keep certificate verification enabled. (:issue:3398)

• Reject destinations whose resolved path contains the platform's PATH separator, including separators inherited from the working directory or a directory symlink. (:issue:3399)

• Preserve an existing pyvenv.cfg when a prompt or configuration value cannot be encoded as UTF-8, instead of leaving the file empty after a failed environment creation. The file now ends its lines with LF on every platform.

  Debug logs show each configuration line as a Python string literal, so control characters are visible. (:issue:3400)

• Skip writing a .venv redirect when the environment name contains a line boundary. The environment is still created, and any existing redirect remains unchanged. (:issue:3401)

• Preserve non-ASCII values in activate_this.py when applications read the script with a legacy text encoding before executing it. (:issue:3402)

• Reject malformed seed versions and requirements ending in archive suffixes before starting pip, with an error identifying the invalid value instead of a misleading download or local-file error. (:issue:3403)

• Allow a literal percent sign as a csh prompt and preserve carets in tcsh prompt display instead of interpreting them as control-character notation.

  Separate csh history and prompt escapes from preceding non-ASCII text in legacy locales. (:issue:3404)

• Report an error when an existing pyvenv.cfg is not a regular file, instead of trying to read or write directories, pipes, or devices as configuration files. (:issue:3405)

• Preserve percent-containing paths during batch reactivation and show dollar signs literally in command prompts. Skip batch scripts for paths containing line boundaries, and remove stale batch scripts for unsupported paths even when only other activators are selected. (:issue:3406)

• Compile shared seed-cache bytecode without loading site customizations from the destination environment or importing modules from the current working directory. (:issue:3407)

• Keep the bundled seed version when a cached periodic update is older, and stop recording downloads below the bundled version during update checks. (:issue:3408)

• Stop activating a moved environment, leaving PATH unchanged, when the shell is not bash, the script is evaluated or read from standard input, a path tool fails, the sourced file is not the environment's own activation script, or the new location has no pyvenv.cfg, instead of continuing with an incorrect environment path. (:issue:3409)

• Reject built-in options with missing values before creating the application-data directory or starting interpreter discovery, instead of reporting the argument error after those operations. (:issue:3410)

• Keep unset-variable bookkeeping out of exported xonsh variables, so child shells do not restore an internal sentinel as PYTHONHOME. Skip xonsh activation for destination names that its PATH handling would expand to a different path.

  Restore unset Tcl/Tk library variables when switching between environments in one xonsh session.

  Preserve non-ASCII paths and prompts when xonsh reads activation scripts with a legacy encoding. (:issue:3411)

• Skip default shell activators with a warning when a POSIX path encoding is incompatible with their UTF-8 scripts. Explicitly requested incompatible shell activators still report an error. Environments created with --activators= or --activators=python remain supported in legacy locales. Undecodable parent paths are now caught before any shell activation script is written. (:issue:3412)

• Keep apostrophes and backslashes in fish activation values separate from preceding non-ASCII characters, so fish 3

... (truncated)

Commits

• e53e30b release 21.14.9
• 2519941 🐛 fix(seed): preserve interpreter paths in console scripts (#3417)
• 70a0102 🐛 fix(seed): preserve shared cache when reseeding with pip (#3423)
• 554d9f9 🐛 fix(create): replace linked output directories (#3429)
• 7babec6 🐛 fix(seed): verify wheels before caching (#3430)
• 2dc8bd8 🐛 fix(subprocess): omit implicit helper import paths (#3416)
• d25f286 🐛 fix(create): replace generated file links (#3431)
• e3cea6f 🐛 fix(seed): contain metadata cleanup (#3428)
• 2bfdc02 🐛 fix(path): preserve link targets on delete errors (#3427)
• 6196d35 🐛 fix(seed): retain the parent installation for updates (#3420)
• Additional commits viewable in compare view

Updates pypdf from 6.19.0 to 6.21.1

Release notes

Sourced from pypdf's releases.

Version 6.21.1, 2026-10-17

What's new

Security (SEC)

• Only open /DCTDecode image data with the Pillow JPEG plugin (#4222) by @​metsw24-max

Full Changelog

Version 6.21.0, 2026-10-16

What's new

Security (SEC)

• Improve performance and limit field work (#4219) by @​stefan6419846
• Limit stream parsing work (#4218) by @​stefan6419846

New Features (ENH)

• Allow custom fit modes for named destinations (#4181) by @​JackyHsu-X

Bug Fixes (BUG)

• Treat NUL as whitespace in ArrayObject (#4198) by @​Zephyr761
• Avoid overwriting unread objects in add_form_topname (#4190) by @​tigger0jk
• Read an indirect page box on a writer page (#4179) by @​usmanmateen

Full Changelog

Version 6.20.1, 2026-10-12

What's new

Security (SEC)

• Prevent cyclic tree handling (#4188) by @​stefan6419846

Bug Fixes (BUG)

• Only read the color operator from a text field's default appearance (#4158) by @​yaourtv

Full Changelog

Version 6.20.0, 2026-10-09

What's new

Security (SEC)

• Limit work per stream (filter count, accumulated decoding work) (#4173) by @​stefan6419846

New Features (ENH)

• Add support for BrotliDecode filter (PDF 2.0) (#4168) by @​stefan6419846

Performance Improvements (PI)

• Parse an embedded CFF font program once per stream (#4164) by @​marshalltech81
• Parse numbers, indirect references, names and nulls faster (#4148) by @​MartinThoma
• Do not inherit PdfObject from a Protocol (#4149) by @​MartinThoma
• Speed up cloning direct objects (#4152) by @​MartinThoma

... (truncated)

Changelog

Sourced from pypdf's changelog.

Version 6.21.1, 2026-10-17

Security (SEC)

• Only open /DCTDecode image data with the Pillow JPEG plugin (#4222)

Full Changelog

Version 6.21.0, 2026-10-16

Security (SEC)

• Improve performance and limit field work (#4219)
• Limit stream parsing work (#4218)

New Features (ENH)

• Allow custom fit modes for named destinations (#4181)

Bug Fixes (BUG)

• Treat NUL as whitespace in ArrayObject (#4198)
• Avoid overwriting unread objects in add_form_topname (#4190)
• Read an indirect page box on a writer page (#4179)

Full Changelog

Version 6.20.1, 2026-10-12

Security (SEC)

• Prevent cyclic tree handling (#4188)

Bug Fixes (BUG)

• Only read the color operator from a text field's default appearance (#4158)

Full Changelog

Version 6.20.0, 2026-10-09

Security (SEC)

• Limit work per stream (filter count, accumulated decoding work) (#4173)

New Features (ENH)

• Add support for BrotliDecode filter (PDF 2.0) (#4168)

Performance Improvements (PI)

• Parse an embedded CFF font program once per stream (#4164)
• Parse numbers, indirect references, names and nulls faster (#4148)
• Do not inherit PdfObject from a Protocol (#4149)
• Speed up cloning direct objects (#4152)

Bug Fixes (BUG)

• Report the correct page number for identical pages (#4154)
• Decrypt the XMP metadata stream unless /EncryptMetadata is false (#4151)

... (truncated)

Commits

• 1a6de8d REL: 6.21.1
• 512d8eb SEC: Only open /DCTDecode image data with the Pillow JPEG plugin (#4222)
• 7abdc8e DOC: Clarify security PR process
• 1145329 REL: 6.21.0
• 5ef728f SEC: Improve performance and limit field work (#4219)
• 18bd298 SEC: Limit stream parsing work (#4218)
• 9f86100 DEV: Ignore ruff rule ICN001 (#4206)
• 1d64c39 ENH: Allow custom fit modes for named destinations (#4181)
• 14ea596 DEV: Bump actions/download-artifact from 8.0.1 to 8.0.2 (#4204)
• c7c6d2a DEV: Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#4205)
• Additional commits viewable in compare view

Updates virtualenv from 21.14.5 to 21.14.9

Release notes

Sourced from virtualenv's releases.

21.14.9

Bugfixes - 21.14.9

• Parse VIRTUALENV_PERIODIC_UPDATE_INSECURE as a boolean, so 0, false, no and off keep certificate verification enabled. (#3398)

• Reject destinations whose resolved path contains the platform's PATH separator, including separators inherited from the working directory or a directory symlink. (#3399)

• Preserve an existing pyvenv.cfg when a prompt or configuration value cannot be encoded as UTF-8, instead of leaving the file empty after a failed environment creation. The file now ends its lines with LF on every platform.

  Debug logs show each configuration line as a Python string literal, so control characters are visible. (#3400)

• Skip writing a .venv redirect when the environment name contains a line boundary. The environment is still created, and any existing redirect remains unchanged. (#3401)

• Preserve non-ASCII values in activate_this.py when applications read the script with a legacy text encoding before executing it. (#3402)

• Reject malformed seed versions and requirements ending in archive suffixes before starting pip, with an error identifying the invalid value instead of a misleading download or local-file error. (#3403)

• Allow a literal percent sign as a csh prompt and preserve carets in tcsh prompt display instead of interpreting them as control-character notation.

  Separate csh history and prompt escapes from preceding non-ASCII text in legacy locales. (#3404)

• Report an error when an existing pyvenv.cfg is not a regular file, instead of trying to read or write directories, pipes, or devices as configuration files. (#3405)

• Preserve percent-containing paths during batch reactivation and show dollar signs literally in command prompts. Skip batch scripts for paths containing line boundaries, and remove stale batch scripts for unsupported paths even when only other activators are selected. (#3406)

• Compile shared seed-cache bytecode without loading site customizations from the destination environment or importing modules from the current working directory. (#3407)

• Keep the bundled seed version when a cached periodic update is older, and stop recording downloads below the bundled version during update checks. (#3408)

• Stop activating a moved environment, leaving PATH unchanged, when the shell is not bash, the script is evaluated or read from standard input, a path tool fails, the sourced file is not the environment's own activation script, or the new location has no pyvenv.cfg, instead of continuing with an incorrect environment path. (#3409)

• Reject built-in options with missing values before creating the application-data directory or starting interpreter discovery, instead of reporting the argument error after those operations. (#3410)

• Keep unset-variable bookkeeping out of exported xonsh variables, so child shells do not restore an internal sentinel as PYTHONHOME. Skip xonsh activation for destination names that its PATH handling would expand to a different path.

  Restore unset Tcl/Tk library variables when switching between environments in one xonsh session.

  Preserve non-ASCII paths and prompts when xonsh reads activation scripts with a legacy encoding. (#3411)

• Skip default shell activators with a warning when a POSIX path encoding is incompatible with their UTF-8 scripts. Explicitly requested incompatible shell activators still report an error. Environments created with --activators= or --activators=python remain supported in legacy locales. Undecodable parent paths are now caught before any shell activation script is written. (#3412)

... (truncated)

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.14.9

• Parse VIRTUALENV_PERIODIC_UPDATE_INSECURE as a boolean, so 0, false, no and off keep certificate verification enabled. (:issue:3398)

• Reject destinations whose resolved path contains the platform's PATH separator, including separators inherited from the working directory or a directory symlink. (:issue:3399)

• Preserve an existing pyvenv.cfg when a prompt or configuration value cannot be encoded as UTF-8, instead of leaving the file empty after a failed environment creation. The file now ends its lines with LF on every platform.

  Debug logs show each configuration line as a Python string literal, so control characters are visible. (:issue:3400)

• Skip writing a .venv redirect when the environment name contains a line boundary. The environment is still created, and any existing redirect remains unchanged. (:issue:3401)

• Preserve non-ASCII values in activate_this.py when applications read the script with a legacy text encoding before executing it. (:issue:3402)

• Reject malformed seed versions and requirements ending in archive suffixes before starting pip, with an error identifying the invalid value instead of a misleading download or local-file error. (:issue:3403)

• Allow a literal percent sign as a csh prompt and preserve carets in tcsh prompt display instead of interpreting them as control-character notation.

  Separate csh history and prompt escapes from preceding non-ASCII text in legacy locales. (:issue:3404)

• Report an error when an existing pyvenv.cfg is not a regular file, instead of trying to read or write directories, pipes, or devices as configuration files. (:issue:3405)

• Preserve percent-containing paths during batch reactivation and show dollar signs literally in command prompts. Skip batch scripts for paths containing line boundaries, and remove stale batch scripts for unsupported paths even when only other activators are selected. (:issue:3406)

• Compile shared seed-cache bytecode without loading site customizations from the destination environment or importing modules from the current working directory. (:issue:3407)

• Keep the bundled seed version when a cached periodic update is older, and stop recording downloads below the bundled version during update checks. (:issue:3408)

• Stop activating a moved environment, leaving PATH unchanged, when the shell is not bash, the script is evaluated or read from standard input, a path tool fails, the sourced file is not the environment's own activation script, or the new location has no pyvenv.cfg, instead of continuing with an incorrect environment path. (:issue:3409)

• Reject built-in options with missing values before creating the application-data directory or starting interpreter discovery, instead of reporting the argument error after those operations. (:issue:3410)

• Keep unset-variable bookkeeping out of exported xonsh variables, so child shells do not restore an internal sentinel as PYTHONHOME. Skip xonsh activation for destination names that its PATH handling would expand to a different path.

  Restore unset Tcl/Tk library variables when switching between environments in one xonsh session.

  Preserve non-ASCII paths and prompts when xonsh reads activation scripts with a legacy encoding. (:issue:3411)

• Skip default shell activators with a warning when a POSIX path encoding is incompatible with their UTF-8 scripts. Explicitly requested incompatible shell activators still report an error. Environments created with --activators= or --activators=python remain supported in legacy locales. Undecodable parent paths are now caught before any shell activation script is written. (:issue:3412)

• Keep apostrophes and backslashes in fish activation values separate from preceding non-ASCII characters, so fish 3

... (truncated)

Commits

• e53e30b release 21.14.9
• 2519941 🐛 fix(seed): preserve interpreter paths in console scripts (#3417)
• 70a0102 🐛 fix(seed): preserve shared cache when reseeding with pip (#3423)
• 554d9f9 🐛 fix(create): replace linked output directories (#3429)
• 7babec6 🐛 fix(seed): verify wheels before caching (#3430)
• 2dc8bd8 🐛 fix(subprocess): omit implicit helper import paths (#3416)
• d25f286 🐛 fix(create): replace generated file links (#3431)
• e3cea6f 🐛 fix(seed): contain metadata cleanup (#3428)
• 2bfdc02 🐛 fix(path): preserve link targets on delete errors (#3427)
• 6196d35 🐛 fix(seed): retain the parent installation for updates (#3420)
• Additional commits viewable in compare view

Updates pypdf from 6.19.0 to 6.21.1

Release notes

Sourced from pypdf's releases.

Version 6.21.1, 2026-10-17

What's new

Security (SEC)

• Only open /DCTDecode image data with the Pillow JPEG plugin (#4222) by @​metsw24-max

Full Changelog

Version 6.21.0, 2026-10-16

What's new

Security (SEC)

• Improve performance and limit field work (#4219) by @​stefan6419846
• Limit stream parsing work (#4218) by @​stefan6419846

New Features (ENH)

• Allow custom fit modes for named destinations (#4181) by @​JackyHsu-X

Bug Fixes (BUG)

• Treat NUL as whitespace in ArrayObject (#4198) by @​Zephyr761
• Avoid overwriting unread objects in add_form_topname (#4190) by @​tigger0jk
• Read an indirect page box on a writer page (#4179) by @​usmanmateen

Full Changelog

Version 6.20.1, 2026-10-12

What's new

Security (SEC)

• Prevent cyclic tree handling (#4188) by @​stefan6419846

Bug Fixes (BUG)

• Only read the color operator from a text field's default appearance (#4158) by @​yaourtv

Full Changelog

Version 6.20.0, 2026-10-09

What's new

Security (SEC)

• Limit work per stream (filter count, accumulated decoding work) (#4173) by @​stefan6419846

New Features (ENH)

• Add support for BrotliDecode filter (PDF 2.0) (#4168) by @​stefan6419846

Performance Improvements (PI)

• Parse an embedded CFF font program once per stream (#4164) by @​marshalltech81
• Parse numbers, indirect references, names and nulls faster (#4148) by @​MartinThoma
• Do not inherit PdfObject from a Protocol (#4149) by @​MartinThoma
• Speed up cloning direct objects (#4152) by @​MartinThoma

... (truncated)

Changelog

Sourced from pypdf's changelog.

Version 6.21.1, 2026-10-17

Security (SEC)

• Only open /DCTDecode image data with the Pillow JPEG plugin (#4222)

Full Changelog

Version 6.21.0, 2026-10-16

Security (SEC)

• Improve performance and limit field work (#4219)
• Limit stream parsing work (#4218)

New Features (ENH)

• Allow custom fit modes for named destinations (#4181)

Bug Fixes (BUG)

• Treat NUL as whitespace in ArrayObject (#4198)
• Avoid overwriting unread objects in add_form_topname (#4190)
• Read an indirect page box on a writer page (#4179)

Full Changelog

Version 6.20.1, 2026-10-12

Security (SEC)

• Prevent cyclic tree handling (#4188)

Bug Fixes (BUG)

• Only read the color operator from a text field's default appearance (#4158)

Full Changelog

Version 6.20.0, 2026-10-09

Security (SEC)

• Limit work per stream (filter count, accumulated decoding work) (#4173)

New Features (ENH)

• Add support for BrotliDecode filter (PDF 2.0) (#4168)

Performance Improvements (PI)

• Parse an embedded CFF font program once per stream (#4164)
• Parse numbers, indirect references, names and nulls faster (#4148)
• Do not inherit PdfObject from a Protocol (#4149)
• Speed up cloning direct objects (#4152)

Bug Fixes (BUG)

• Report the correct page number for identical pages (#4154)
• Decrypt the XMP metadata stream unless /EncryptMetadata is false (#4151)

... (truncated)

Commits

• 1a6de8d REL: 6.21.1
• 512d8eb SEC: Only open /DCTDecode image data with the Pillow JPEG plugin (#4222)
• 7abdc8e DOC: Clarify security PR process
• 1145329 REL: 6.21.0
• 5ef728f SEC: Improve performance and limit field work (#4219)
• 18bd298 SEC: Limit stream parsing work (#4218)
• 9f86100 DEV: Ignore ruff rule ICN001 (#4206)
• 1d64c39 ENH: Allow custom fit modes for named destinations (#4181)
• 14ea596 DEV: Bump actions/download-artifact from 8.0.1 to 8.0.2 (#4204)
• c7c6d2a DEV: Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#4205)
• Additional commits viewable in compare view

Updates virtualenv from 21.14.5 to 21.14.9

Release notes

Sourced from virtualenv's releases.

21.14.9

Bugfixes - 21.14.9

• Parse VIRTUALENV_PERIODIC_UPDATE_INSECURE as a boolean, so 0, false, no and off keep certificate verification enabled. (#3398)

• Reject destinations whose resolved path contains the platform's PATH separator, including separators inherited from the working directory or a directory symlink. (#3399)

• Preserve an existing pyvenv.cfg when a prompt or configuration value cannot be encoded as UTF-8, instead of leaving the file empty after a failed environment creation. The file now ends its lines with LF on every platform.

  Debug logs show each configuration line as a Python string literal, so control characters are visible. (#3400)

• Skip writing a .venv redirect when the environment name contains a line boundary. The environment is still created, and any existing redirect remains unchanged. (#3401)

• Preserve non-ASCII values in activate_this.py when applications read the script with a legacy text encoding before executing it. (#3402)

• Reject malformed seed versions and requirements ending in archive suffixes before starting pip, with an error identifying the invalid value instead of a misleading download or local-file error. (#3403)

• Allow a literal percent sign as a csh prompt and preserve carets in tcsh prompt display instead of interpreting them as control-character notation.

  Separate csh history and prompt escapes from preceding non-ASCII text in legacy locales. (#3404)

• Report an error when an existing pyvenv.cfg is not a regular file, instead of trying to read or write directories, pipes, or devices as configuration files. (#3405)

• Preserve percent-containing paths during batch reactivation and show dollar signs literally in command prompts. Skip batch scripts for paths containing line boundaries, and remove stale batch scripts for unsupported paths even when only other activators are selected. (#3406)

• Compile shared seed-cache bytecode without loading site customizations from the destination environment or importing modules from the current working directory. (#3407)

• Keep the bundled seed version when a cached periodic update is older, and stop recording downloads below the bundled version during update checks. (#3408)

• Stop activating a moved environment, leaving PATH unchanged, when the shell is not bash, the script is evaluated or read from standard input, a path tool fails, the sourced file is not the environment's own activation script, or the new location has no pyvenv.cfg, instead of continuing with an incorrect environment path. (#3409)

• Reject built-in options with missing values before creating the application-data directory or starting interpreter discovery, instead of reporting the argument error after those operations. (#3410)

• Keep unset-variable bookkeeping out of exported xonsh variables, so child shells do not restore an internal sentinel as PYTHONHOME. Skip xonsh activation for destination names that its PATH handling would expand to a different path.

  Restore unset Tcl/Tk library variables when switching between environments in one xonsh session.

  Preserve non-ASCII paths and prompts when xonsh reads activation scripts with a legacy encoding. (#3411)

• Skip default shell activators with a warning when a POSIX path encoding is incompatible with their UTF-8 scripts. Explicitly requested incompatible shell activators still report an error. Environments created with --activators= or --activators=python remain supported in legacy locales. Undecodable parent paths are now caught before any shell activation script is written. (#3412)

... (truncated)

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.14.9

• Parse VIRTUALENV_PERIODIC_UPDATE_INSECURE as a boolean, so 0, false, no and off keep certificate verification enabled. (:issue:3398)

• Reject destinations whose resolved path contains the platform's PATH separator, including separators inherited from the working directory or a directory symlink. (:issue:3399)

• Preserve an existing pyvenv.cfg when a prompt or configuration value cannot be encoded as UTF-8, instead of leaving the file empty after a failed environment creation. The file now ends its lines with LF on every platform.

  Debug logs show each configuration line as a Python string literal, so control characters are visible. (:issue:3400)

• Skip writing a .venv redirect when the environment name contains a line boundary. The environment is still created, and any existing redirect remains unchanged. (:issue:3401)

• Preserve non-ASCII values in activate_this.py when applications read the script with a legacy text encoding before executing it. (:issue:3402)

• Reject malformed seed versions and requirements ending in archive suffixes before starting pip, with an error identifying the invalid value instead of a misleading download or local-file error. (:issue:3403)

• Allow a literal percent sign as a csh prompt and preserve carets in tcsh prompt display instead of interpreting them as control-character notation.

  Separate csh history and prompt escapes from preceding non-ASCII text in legacy locales. (:issue:3404)

• Report an error when an existing pyvenv.cfg is not a regular file, instead of trying to read or write directories, pipes, or devices as configuration files. (:issue:3405)

• Preserve percent-containing paths during batch reactivation and show dollar signs literally in command prompts. Skip batch scripts for paths containing line boundaries, and remove stale batch scripts for unsupported paths even when only other activators are selected. (:issue:3406)

• Compile shared seed-cache bytecode without loading site customizations from the destination environment or importing modules from the current working directory. (:issue:3407)

• Keep the bundled seed version when a cached periodic update is older, and stop recording downloads below the bundled version during update checks. (:issue:3408)

• Stop activating a moved environment, leaving PATH unchanged, when the shell is not bash, the script is evaluated or read from standard input, a path tool fails, the sourced file is not the environment's own activation script, or the new location has no pyvenv.cfg, instead of continuing with an incorrect environment path. (:issue:3409)

• Reject built-in options with missing values before creating the application-data directory or starting interpreter discovery, instead of reporting the argument error after those operations. (:issue:3410)

• Keep unset-variable bookkeeping out of exported xonsh variables, so child shells do not restore an internal sentinel as PYTHONHOME. Skip xonsh activation for destination names that its PATH handling would expand to a different path.

  Restore unset Tcl/Tk library variables when switching between environments in one xonsh session.

  Preserve non-ASCII paths and prompts when xonsh reads activation scripts with a legacy encoding. (:issue:3411)

• Skip default shell activators with a warning when a POSIX path encoding is incompatible with their UTF-8 scripts. Explicitly requested incompatible shell activators still report an error. Environments created with --activators= or --activators=python remain supported in legacy locales. Undecodable parent paths are now caught before any shell activation script is written. (:issue:3412)

• Keep apostrophes and backslashes in fish activation values separate from preceding non-ASCII characters, so fish 3

... (truncated)

Commits

• e53e30b release 21.14.9
• 2519941 🐛 fix(seed): preserve interpreter paths in console scripts (#3417)
• 70a0102 🐛 fix(seed): preserve shared cache when reseeding with pip (#3423)
• 554d9f9 🐛 fix(create): replace linked output directories (#3429)
• 7babec6 🐛 fix(seed): verify wheels before caching (#3430)
• 2dc8bd8 🐛 fix(subprocess): omit implicit helper import paths (#3416)
• d25f286 🐛 fix(create): replace generated file links (#3431)
• e3cea6f 🐛 fix(seed): contain metadata cleanup (#3428)
• 2bfdc02 🐛 fix(path): preserve link targets on delete errors (#3427)
• 6196d35 🐛 fix(seed): retain the parent installation for updates (#3420)
• Additional commits viewable in compare view

Updates certifi from 2025.8.3 to 2026.10.19

Commits

• 662df63 Restore unaffected emSign roots (#439) (#440)
• 5cb238c Remove emsign (#437)
• 69494a7 Bump actions/download-artifact from 8.0.1 to 8.0.2 (#436)
• 029c7b0 Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#435)
• 9d0a8f1 Add support for Python 3.15 (#432)
• db472ab Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (#431)
• f4bc676 2026.07.22 (#428)
• 4c91f9c Bump actions/setup-python from 6.3.0 to 7.0.0 (#427)
• 01a66c5 Bump actions/checkout from 7.0.0 to 7.0.1 (#426)
• eb355f4 Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#425)
• Additional commits viewable in compare view

Updates pillow from 12.3.0 to 13.0.0

Release notes

Sourced from pillow's releases.

13.0.0

https://pillow.readthedocs.io/en/stable/releasenotes/13.0.0.html

Removals

• Remove undocumented GifImagePlugin._save_netpbm #9901 [@​akx]
• Remove ExifTags.IFD.Makernote #9850 [@​radarhere]
• Drop support for Python 3.10 #9750 [@​hugovk]
• Remove deprecations for Pillow 13.0.0 #9751 [@​radarhere]

Deprecations

• Deprecate IM image format #9849 [@​radarhere]
• Deprecate ImageQt align8to32() in favour of raw encoder stride #9940 [@​akx]
• Deprecate JpegImageFile.load_djpeg #9924 [@​akx]

Documentation

• Update release notes for Pillow 13.0.0 #10223 [@​hugovk]
• Correct the ImageOps.fit centering corner documentation #10118 [@​FanWu-ai]
• Update Tidelift links #10102 [@​radarhere]
• Correct bullet point syntax in release notes #10069 [@​radarhere]
• Update ImageDraw signatures in docs #10065 [@​ZainnQureshii]
• Update macOS tested Pillow versions #10048 [@​hugovk]
• Add pillow-wmf and pillow-zx-spectrum to third-party plugins list #10037 [@​bitplane]
• Delete CLAUDE.md #10027 [@​hugovk]
• Add pillow-lunasvg to third-party plugins list #10016 [@​Maksim-Burtsev]
• Extend security policy #10018 [@​hugovk]
• Update Color3DLUT description #10004 [@​radarhere]
• Document the internal image distinctness constraints #9752 [@​akx]
• Update macOS tested Pillow versions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.

[daggerstuff]

@dependabot rebase

[dependabot]

Looks like this PR is closed. If the branch still exists, you can re-open the PR and then use @dependabot rebase or @dependabot recreate. If the branch was deleted, Dependabot will create a new PR on the next scheduled run, or you can trigger an update from the Dependency graph page.