[FarhanAliRaza]

All Submissions:

• Have you followed the guidelines stated in CONTRIBUTING.md file?
• Have you checked to ensure there aren't any other open Pull Requests for the desired changed?

Type of change

• Dependency security bump (no code changes)

Description

Dependabot flags virtualenv < 21.14.9 in uv.lock: a destination path supplied to virtualenv can be interpreted as shell syntax by the POSIX console launchers its app-data seeder generates (CVSS 7.8, patched in 21.14.9). It reaches our lock as a transitive dependency of pre-commit.

This bumps the locked virtualenv from 21.14.7 to 21.14.12.

• Every patched release was published inside the 7-day exclude-newer window, so virtualenv gets a dated per-package override in [tool.uv.exclude-newer-package] (and the mirrored lock [options]), the same pattern used for pillow and certifi in chore(deps): bump pillow, certifi, virtualenv and aiohttp for Dependabot alerts #7628. It can be dropped after 2026-10-28.
• 21.14.12's dependency constraints are identical to 21.14.7's and every locked dependency already satisfies them, so no other lock entry moved.

Note: a full uv lock re-resolve currently fails on main even without this change (the Python 3.15 / win32 split cannot satisfy reflex-enterprise's reflex[db] requirement). That is unrelated to virtualenv, so this PR patches the lock entry directly rather than re-resolving the workspace.

Verification

• uv lock --check passes.
• uv sync --frozen installs virtualenv==21.14.12 with its hash verified; import virtualenv reports 21.14.12.

https://claude.ai/code/session_019UwxBvs15C7v1ReWSJ61CW

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T21:16:41.648391Z	270fe53	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cubic-dev-ai]

No issues found across 2 files

_{View guided diff | Turn on auto-fix | Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

Updates the locked virtualenv version from 21.14.7 to 21.14.12 for the reported security fix.

• Development environments now use the patched virtualenv release.

_{Reviews (1) · Last reviewed commit: "chore(deps): bump virtualenv to 21.14.12..." · Reviewed by Greptile}

[codspeed]

Merging this PR will not alter performance

1 warning

⚠️ 20 benchmarks are dominated by system calls

System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.

Learn more about system calls

See affected benchmarks

✅ 148 untouched benchmarks

---

_{Comparing farhan/inspiring-mccarthy-ljgm0a (270fe53) with main (aeaac72)}