From 270fe5309b4153a5f5f41f5437e7063665fb0b26 Mon Sep 17 00:00:00 2001
From: Farhan <www.mfarvirus@gmail.com>
Date: Thu, 22 Oct 2026 20:32:50 +0000
Subject: [PATCH] chore(deps): bump virtualenv to 21.14.12 for Dependabot alert

virtualenv < 21.14.9 lets a destination path be interpreted as shell
syntax by the POSIX console launchers its app-data seeder generates
(GHSA for CVSS 7.8, fixed in 21.14.9). It reaches the lock as a
transitive dependency of pre-commit.

21.14.12 was published inside the 7-day exclude-newer window, so it
gets a dated per-package override like pillow and certifi; drop it
once the window passes (after 2026-10-28). Its dependency constraints
are unchanged from 21.14.7 and every locked dependency satisfies them.

Claude-Session: https://claude.ai/code/session_019UwxBvs15C7v1ReWSJ61CW
---
 pyproject.toml | 1 +
 uv.lock        | 7 ++++---
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index f0863ca4f72..27a4dbfdcb8 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -561,6 +561,7 @@ reflex-enterprise = false
 reflex-hosting-cli = false
 pillow = "2026-10-21T00:00:00Z"
 certifi = "2026-10-21T00:00:00Z"
+virtualenv = "2026-10-22T00:00:00Z"
 
 [tool.uv.sources]
 hatch-reflex-pyi.workspace = true
diff --git a/uv.lock b/uv.lock
index a5a0e407d9e..029703cbccd 100644
--- a/uv.lock
+++ b/uv.lock
@@ -38,6 +38,7 @@ reflex-base = false
 reflex-components-markdown = false
 reflex-build-sdk = false
 certifi = "2026-10-21T00:00:00Z"
+virtualenv = "2026-10-22T00:00:00Z"
 reflex-components-internal = false
 reflex-components-lucide = false
 reflex-components-radix = false
@@ -4973,7 +4974,7 @@ wheels = [
 
 [[package]]
 name = "virtualenv"
-version = "21.14.7"
+version = "21.14.12"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "distlib" },
@@ -4982,9 +4983,9 @@ dependencies = [
     { name = "platformdirs" },
     { name = "python-discovery" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/dc/3f/935cf1757643381fb7f7cc98197b4bc119223d9c2cf37dc3b03ad2a4455f/virtualenv-21.14.7.tar.gz", hash = "sha256:5f427d56f39eb7e7447d641dd4b7ab1e9c92793f498f35f26da2e4972c5546ae", size = 5471741, upload-time = "2026-10-12T01:27:31.842Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/c9/2c/1a69b3346931e9a7db9cc00cc0fa847c843a85fa7cf52a598f57261c68df/virtualenv-21.14.12.tar.gz", hash = "sha256:bbcfb78e36c22ad70c6917c4aecb5e63477d3c138e9f88c946f320e31859c76a", size = 5562800, upload-time = "2026-10-21T01:58:51.724Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/52/5b/799c3e5b8e04d5fa1c9b61a4c1f5079603e747205c7311b92abd30283df5/virtualenv-21.14.7-py3-none-any.whl", hash = "sha256:3769219a308c5d2f093e7729621ad12a6346b5767a7ec4338414e2a0fb0c526b", size = 5487587, upload-time = "2026-10-12T01:27:29.37Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/92/f3b8af2d36ddec4dc61dc25655dc010e419ff456cb4ca0e720c8112f1047/virtualenv-21.14.12-py3-none-any.whl", hash = "sha256:7820aeaef23f1f59a96458edfc7f9d3deac937155718de15f1c9a64471e15551", size = 5556824, upload-time = "2026-10-21T01:58:48.505Z" },
 ]
 
 [[package]]