[dependabot]

Bumps virtualenv from 21.7.13 to 21.14.13.

Release notes

Sourced from virtualenv's releases.

21.14.13

Security

• Stop bash running commands from --prompt or an environment name containing $(...), backticks or a backslash after shopt -s promptvars, set -o posix, or in a child shell that inherits an exported PS1 (GHSA-cx6f-vjhg-g3cc); reported by @​rozzkml. zsh now draws the prompt from psvar[9], which is never parsed as shell syntax. (#3466) by @​gaborbernat.
• Write the .venv redirect and the wheel RECORD with exclusive create, so a link planted after the existence check cannot redirect the write. On POSIX, replace a read-only .venv redirect that points at a virtualenv. (#3466) by @​gaborbernat.

🐍 PyPI release

📜 Full Changelog

21.14.12

Packaging

• Upgrade the embedded setuptools wheel from 84.0.0 to 84.2.1 and the embedded pip wheel from 26.2.1 to 26.2.2. (#3452)

New Contributors

• @​qodelicious made their first contribution in #3460

🐍 PyPI release

📜 Full Changelog

21.14.11

Bug fixes

• Search all directories supplied by repeated --extra-search-dir options instead of keeping only the last group. (#3440) by @​repzakske.
• On Windows, the app data is now migrated into the nested cache directory instead of the migration failing with a warning on every run. (#3441) by @​gaborbernat and @​XXXXXQ-0206.

🐍 PyPI release

📜 Full Changelog

21.14.10

Bug fixes

• Always copy seed packages when app-data is temporary, including when symlink seeding is enabled through an environment variable or configuration file. Seeded packages remain available after temporary cache cleanup. (#3437) by @​gaborbernat.

🐍 PyPI release

📜 Full Changelog

... (truncated)

Changelog

Sourced from virtualenv's changelog.

################# Release History #################

.. towncrier-draft-entries:: [UNRELEASED DRAFT]

.. towncrier release notes start

.. _release-21-15-2:

---

21.15.2 (2026-10-30)

---

.. _release-21-15-2-fixed:

Fixed

• Build the default application data folder only when no folder was given through --app-data, VIRTUALENV_APP_DATA or the configuration file, so --read-only-app-data with an explicit folder works when the default folder is missing, and writable runs stop creating an unused one. Folders from VIRTUALENV_APP_DATA and the configuration file now get the same checks as --app-data (:pr:3488) by :user:darrenhuai and :user:gaborbernat.
• Build the seed wheel image in a staging folder and move it into place only once it is complete, so an extraction that fails part way, for example on a full disk, after a killed process or on a path over the Windows length limit, no longer leaves a partial image that later runs seed as a pip without METADATA, RECORD or INSTALLER (:pr:3487) by :user:darrenhuai and :user:gaborbernat.
• Make -p/--python and --try-first-with replace the interpreters set by VIRTUALENV_PYTHON, VIRTUALENV_TRY_FIRST_WITH or the configuration file instead of being merged with them, so the configured interpreter no longer wins over the one asked for and a -p that finds nothing fails instead of falling back to it. Try several VIRTUALENV_PYTHON values in the order given rather than starting with the second (:pr:3494) by :user:darrenhuai and :user:gaborbernat.
• On Windows, re-create an environment in place when its copied interpreter files, such as python.exe, or its seeded packages are read-only, instead of failing with PermissionError (:pr:3492) by :user:darrenhuai and :user:gaborbernat.
• Reject an empty or whitespace-only destination. An empty one, and on Windows one made only of spaces, resolved to the current directory, so an unset VENV in virtualenv --clear "$VENV" deleted the working directory. Pass . to create the environment in the current directory (:pr:3491) by :user:darrenhuai and :user:gaborbernat.
• Restore the default prompt in deactivate.bat when PROMPT was undefined at activation, instead of leaving the environment name in front of it (:pr:3489) by :user:darrenhuai.
• Undefine PATH again in deactivate.bat when it was undefined at activation, instead of leaving the environment's Scripts folder on it, and stop a second activate.bat from adding that folder twice (:pr:3493) by :user:darrenhuai and :user:gaborbernat.

.. _release-21-15-1:

---

21.15.1 (2026-10-28)

---

... (truncated)

Commits

• 6accbd5 release 21.14.13
• 3598e20 🐛 fix(bash): escape the prompt for every PS1 state (#3466)
• f6512a5 release 21.14.12
• b535726 [pre-commit.ci] pre-commit autoupdate (#3455)
• 7e32366 Fix broken pip and code review links in the docs (#3460)
• 632e56f Upgrade embedded pip/setuptools/wheel and CI test tools (#3452)
• a8bd1a9 chore(deps): bump certifi from 2026.7.22 to 2026.10.19 in /tasks (#3462)
• c82323b chore(deps): bump uv from 0.13.0 to 0.13.4 in /tasks (#3461)
• 863ae6c chore(deps): bump the runtime-dependencies group with 3 updates (#3456)
• 79537b3 👷 ci: pin App token action v3.3.0 (#3449)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

posthog-python Compliance Report

Date: 2026-10-30T20:37:06.272999+00:00
Duration: 260115ms

✅ All Tests Passed!

121/121 tests passed

---

Capture_V1 Tests

✅ 95/95 tests passed

View Details

Test	Status	Duration
Endpoint And Method.Targets V1 Endpoint	✅	517ms
Endpoint And Method.Does Not Use Legacy Endpoints	✅	512ms
Required Headers.Has Authorization Bearer Header	✅	511ms
Required Headers.Has Content Type Json	✅	511ms
Required Headers.Has Posthog Sdk Info Format	✅	512ms
Required Headers.Has Posthog Attempt Header	✅	512ms
Required Headers.Has Posthog Request Id	✅	512ms
Required Headers.Has Posthog Request Timestamp	✅	511ms
Required Headers.Has User Agent	✅	511ms
Body Format.Body Has Created At And Batch	✅	511ms
Body Format.No Api Key In Body	✅	511ms
Body Format.No Sent At In Body	✅	512ms
Event Format.Event Has Required Root Fields	✅	510ms
Event Format.Event Uuid Is Valid	✅	511ms
Event Format.Event Timestamp Is Rfc3339	✅	511ms
Event Format.Non Utc Event Timestamp Is Converted To Utc	✅	523ms
Event Format.Distinct Id Is String	✅	511ms
Event Format.Distinct Id At Root Not Properties	✅	512ms
Event Format.Custom Properties Preserved	✅	511ms
Event Format.Set Properties Preserved	✅	511ms
Event Format.Set Once Properties Preserved	✅	511ms
Event Format.Groups Properties Preserved	✅	511ms
Event Format.Sdk Generates Uuid If Not Provided	✅	512ms
Event Format.Event Has Required Root Fields Batch	✅	514ms
Event Format.Event Uuid Is Valid Batch	✅	515ms
Event Format.Event Timestamp Is Rfc3339 Batch	✅	515ms
Event Format.Distinct Id Is String Batch	✅	516ms
Event Format.Distinct Id At Root Not Properties Batch	✅	515ms
Event Format.Custom Properties Preserved Batch	✅	516ms
Event Format.Set Properties Preserved Batch	✅	516ms
Event Format.Set Once Properties Preserved Batch	✅	515ms
Event Format.Groups Properties Preserved Batch	✅	516ms
Event Format.Sdk Generates Uuid If Not Provided Batch	✅	516ms
Batch Behavior.Multiple Events In Single Batch	✅	520ms
Batch Behavior.Batch Envelope Smoke	✅	521ms
Batch Behavior.Flush With No Events Sends Nothing	✅	508ms
Batch Behavior.Flush At Triggers Batch	✅	1012ms
Batch Behavior.Created At Reflects Batch Creation Time	✅	513ms
Deduplication.Generates Unique Uuids	✅	519ms
Deduplication.Different Events Same Content Different Uuids	✅	515ms
Deduplication.Preserves Uuid On Retry	✅	6522ms
Deduplication.Preserves Timestamp On Retry	✅	6517ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry	✅	6522ms
Deduplication.No Duplicate Events In Batch	✅	520ms
Header Behavior On Retry.Attempt Header Starts At One	✅	513ms
Header Behavior On Retry.Attempt Header Increments On Retry	✅	13528ms
Header Behavior On Retry.Request Id Preserved On Retry	✅	6520ms
Header Behavior On Retry.Different Requests Have Different Request Ids	✅	3023ms
Header Behavior On Retry.Request Timestamp Changes On Retry	✅	6521ms
Response Format Validation.Success Response Has Uuid Keyed Results	✅	512ms
Response Format Validation.Success Response Has Ok For Each Event	✅	515ms
Response Format Validation.Success No Retry After When All Ok	✅	514ms
Response Format Validation.Success Retry After Present When Retry Events	✅	1517ms
Response Format Validation.Success No Retry After When Drop Only	✅	513ms
Response Format Validation.Response Echoes Request Id	✅	512ms
Retry Behavior.Retries On 408	✅	6518ms
Retry Behavior.Retries On 500	✅	6517ms
Retry Behavior.Retries On 503	✅	8525ms
Retry Behavior.Retries On 504	✅	6521ms
Retry Behavior.Retryable Errors Have Retry After	✅	3518ms
Retry Behavior.Respects Retry After On Retryable Error	✅	11525ms
Retry Behavior.Does Not Retry On 400	✅	2513ms
Retry Behavior.Does Not Retry On 401	✅	2515ms
Retry Behavior.Does Not Retry On 402	✅	2515ms
Retry Behavior.Does Not Retry On 413	✅	2513ms
Retry Behavior.Does Not Retry On 415	✅	2514ms
Retry Behavior.Non Retryable Errors Have No Retry After	✅	2514ms
Retry Behavior.Implements Backoff	✅	22527ms
Retry Behavior.Max Retries Respected	✅	22539ms
Partial Batch Handling.Handles 200 Full Success	✅	2513ms
Partial Batch Handling.Handles 200 With All Ok	✅	3520ms
Partial Batch Handling.Does Not Retry Dropped Events	✅	3516ms
Partial Batch Handling.Does Not Retry Limited Events	✅	3517ms
Partial Batch Handling.Prunes Ok Events On Partial Retry	✅	6519ms
Partial Batch Handling.Prunes Dropped Events On Partial Retry	✅	6524ms
Partial Batch Handling.Retries Only Retry Events From Partial	✅	6523ms
Partial Batch Handling.Partial Retry Preserves Uuids	✅	6523ms
Partial Batch Handling.Partial Retry Attempt Header Increments	✅	6518ms
Partial Batch Handling.Partial Retry Request Id Preserved	✅	6523ms
Partial Batch Handling.Respects Retry After On Partial	✅	8519ms
Partial Batch Handling.Unknown Result Treated As Terminal	✅	3516ms
Partial Batch Handling.Mixed Ok Drop Limited No Retry	✅	3521ms
Compression.Sends Gzip Content Encoding	✅	511ms
Compression.No Content Encoding When Disabled	✅	511ms
Compression.Compressed Body Is Decompressible	✅	511ms
Error Handling.Does Not Retry On Unknown 4Xx	✅	2515ms
Event Options.Cookieless Mode Override	✅	512ms
Event Options.Disable Skew Correction Override	✅	511ms
Event Options.Process Person Profile Override	✅	512ms
Event Options.Product Tour Id Override	✅	511ms
Event Options.Unset Options Omitted	✅	512ms
Event Options.Options Override In Batch	✅	514ms
Geoip And Historical Migration.Geoip Disable Injected Into Properties	✅	512ms
Geoip And Historical Migration.Historical Migration Set In Body	✅	511ms
Geoip And Historical Migration.Historical Migration Absent By Default	✅	511ms

Capture_Ai Tests

✅ 5/5 tests passed

View Details

Test	Status	Duration
Routing.Capture Ai Posts To Ai Endpoint	✅	511ms
Routing.Capture Does Not Reroute Ai Named Events	✅	512ms
Identity.Capture Ai Event Has Uuid	✅	511ms
Identity.Capture Ai Keeps Supplied Uuid	✅	512ms
Timestamp Format.Non Utc Event Timestamp Is Converted To Utc	✅	511ms

Feature_Flags Tests

✅ 17/17 tests passed

View Details

Test	Status	Duration
Request Payload.Request With Person Properties Device Id	✅	12ms
Request Payload.Flags Request Uses V2 Query Param	✅	11ms
Request Payload.Flags Request Hits Flags Path Not Decide	✅	12ms
Request Payload.Flags Request Omits Authorization Header	✅	12ms
Request Payload.Token In Flags Body Matches Init	✅	12ms
Request Payload.Groups Round Trip	✅	14ms
Request Payload.Groups Default To Empty Object	✅	12ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False	✅	13ms
Request Payload.Disable Geoip Omitted Defaults To False	✅	12ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key	✅	11ms
Request Lifecycle.No Flags Request On Init Alone	✅	4ms
Request Lifecycle.No Flags Request On Normal Capture	✅	512ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests	✅	18ms
Request Lifecycle.Mock Response Value Is Returned To Caller	✅	16ms
Retry Behavior.Retries Flags On 502	✅	318ms
Retry Behavior.Retries Flags On 504	✅	316ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event	✅	514ms

Feature_Flags_Local_Evaluation Tests

✅ 4/4 tests passed

View Details

Test	Status	Duration
Versioned Boolean Matching.Matching Version Missing	✅	79ms
Versioned Boolean Matching.Matching Version 1	✅	78ms
Versioned Boolean Matching.Matching Version 2	✅	78ms
Versioned Boolean Matching.Version Only Reload 1 2 1 2 Missing	✅	46ms