chore(deps-dev): bump virtualenv from 20.35.4 to 20.36.1#542
chore(deps-dev): bump virtualenv from 20.35.4 to 20.36.1#542dependabot[bot] wants to merge 2 commits intomainfrom
Conversation
dependabot
bot
force-pushed
the
dependabot/pip/virtualenv-20.36.1
branch
from
3a8010a to
3f08b0f
Compare
dependabot
bot
force-pushed
the
dependabot/pip/virtualenv-20.36.1
branch
from
3f08b0f to
a0d6965
Compare
Bumps [virtualenv](https://github.com/pypa/virtualenv) from 20.35.4 to 20.36.1. - [Release notes](https://github.com/pypa/virtualenv/releases) - [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst) - [Commits](pypa/virtualenv@20.35.4...20.36.1) --- updated-dependencies: - dependency-name: virtualenv dependency-version: 20.36.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
force-pushed
the
dependabot/pip/virtualenv-20.36.1
branch
from
a0d6965 to
5536843
Compare
|
/gemini review |
ebrattli
added
waiting-for-risk-review
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the virtualenv dependency to version 20.36.1, which includes important security fixes. However, the poetry.lock file appears to have been generated with a downgraded version of Poetry (2.2.1 instead of the previous 2.3.2). This has caused incorrect dependency resolution, where several optional dependencies are now marked as required. This will lead to unnecessary packages being installed, bloating the environment. I've added a critical comment with details on how to resolve this. The lock file needs to be regenerated using a newer version of Poetry before this PR can be merged.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #542 +/- ##
=======================================
Coverage 91.09% 91.09%
=======================================
Files 111 111
Lines 4201 4201
Branches 552 552
=======================================
Hits 3827 3827
Misses 231 231
Partials 143 143 🚀 New features to boost your workflow:
|
1 participant
Bumps virtualenv from 20.35.4 to 20.36.1.
Release notes
Sourced from virtualenv's releases.
Changelog
Sourced from virtualenv's changelog.
Commits
d0ad11drelease 20.36.1dec4cecMerge pull request #3013 from gaborbernat/fix-sec5fe5d38release 20.36.0 (#3011)9719376release 20.36.00276db6Add support for PEP 440 version specifiers in the--pythonflag. (#3008)4f900c2Fix Interpreter discovery bug wrt. Microsoft Store shortcut using Latin-1 (#3...13afcc6fix: resolve EncodingWarning in tox upgrade environment (#3007)31b5d31[pre-commit.ci] pre-commit autoupdate (#2997)7c28422fix: update filelock dependency version to 3.20.1 to fix CVE CVE-2025-68146 (...365628ctest_too_many_open_files: assert onerrno.EMFILEinstead ofstrerror(#3001)You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.