chore(deps): bump virtualenv from 21.14.12 to 21.14.13 - #427

Sourced from virtualenv's releases.

21.14.13

Security

• Stop bash running commands from --prompt or an environment name containing $(...), backticks or a backslash after shopt -s promptvars, set -o posix, or in a child shell that inherits an exported PS1 (GHSA-cx6f-vjhg-g3cc); reported by @​rozzkml. zsh now draws the prompt from psvar[9], which is never parsed as shell syntax. (#3466) by @​gaborbernat.
• Write the .venv redirect and the wheel RECORD with exclusive create, so a link planted after the existence check cannot redirect the write. On POSIX, replace a read-only .venv redirect that points at a virtualenv. (#3466) by @​gaborbernat.

PyPI release

Full Changelog

Sourced from virtualenv's changelog.

################# Release History #################

.. towncrier-draft-entries:: [UNRELEASED DRAFT]

.. towncrier release notes start

.. _release-21-15-0:

---

21.15.0 (2026-10-27)

---

.. _release-21-15-0-added:

Added

• Bundle dependencies for Python 3.15 in the standalone zipapp and stop bundling Python 3.8, which is outside the package's supported range (:pr:3458) by :user:gaborbernat.

.. _release-21-15-0-packaging:

Packaging

• Publish GitHub Releases with categorized notes from the tagged changelog, retaining the zipapp, SBOM, and PyPI links (:pr:3458) by :user:gaborbernat.

.. _release-21-14-13:

---

v21.14.13 (2026-10-22)

---

.. _release-21-14-13-security:

Security

• Stop bash running commands from --prompt or an environment name containing $(...), backticks or a backslash after shopt -s promptvars, set -o posix, or in a child shell that inherits an exported PS1 (GHSA-cx6f-vjhg-g3cc); reported by :user:rozzkml. zsh now draws the prompt from psvar[9], which is never parsed as shell syntax. (:pr:3466) - by :user:gaborbernat.
• Write the .venv redirect and the wheel RECORD with exclusive create, so a link planted after the existence check cannot redirect the write. On POSIX, replace a read-only .venv redirect that points at a virtualenv. (:pr:3466) - by :user:gaborbernat.

.. _release-21-14-12:

... (truncated)

• 6accbd5 release 21.14.13
• 3598e20 🐛 fix(bash): escape the prompt for every PS1 state (#3466)
• See full diff in compare view