deps(deps): update virtualenv requirement from <22.0.0,>=21.12.1 to >=21.14.5,<22.0.0

[dependabot]

Updates the requirements on virtualenv to permit the latest version.

Release notes

Sourced from virtualenv's releases.

21.14.5

What's Changed

• 🎨 style(test): mark prompt fixture locals Final by @​gaborbernat in pypa/virtualenv#3374
• 🎨 style: give every Final annotation its type by @​gaborbernat in pypa/virtualenv#3375
• 🐛 fix(ci): dump stacks from a thread that holds the GIL by @​gaborbernat in pypa/virtualenv#3377
• Reset the embed update log when it cannot be read by @​pasmud in pypa/virtualenv#3376

Full Changelog: pypa/virtualenv@21.14.4...21.14.5

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.14.5

• Fall back to the bundled seed wheel and remove the embed update log when the log in the app data folder holds JSON of the wrong shape, instead of failing to create the environment - by :user:pasmud. (:issue:3376)

---

v21.14.4 (2026-10-02)

---

Bugfixes - 21.14.4

• Fix activate running commands from a virtual environment name or --prompt that holds $(...), backticks or ${...} when zsh has PROMPT_SUBST set, and show a % in the name as typed under zsh (GHSA-5vjq-rrrf-7h2q <https://github.com/pypa/virtualenv/security/advisories/GHSA-5vjq-rrrf-7h2q>_); reported by :user:kemrec. (:issue:3373)

---

v21.14.3 (2026-10-01)

---

Bugfixes - 21.14.3

• Honor ~= and every clause of a seed wheel's Requires-Python when picking a wheel for the target Python, and skip a wheel whose Requires-Python is not a valid specifier instead of failing - by :user:pasmud. (:issue:3369)

---

v21.14.2 (2026-10-01)

---

Bugfixes - 21.14.2

• Fix pyvenv.cfg getting an absolute path in python-version, include-system-site-packages and the other keys that hold no path when the working directory has an entry named like the value, such as 3.14 for virtualenv 3.14 or true with --system-site-packages - by :user:darrenhuai. (:issue:3366)
• Fix activation scripts running code from a virtual environment path whose parent directory carries a placeholder name such as __VIRTUAL_NAME__ (GHSA-8rjx-v5ww-45pp <https://github.com/pypa/virtualenv/security/advisories/GHSA-8rjx-v5ww-45pp>), and activate.fish running commands from a path or --prompt that holds a backslash before a single quote (GHSA-c947-3pg5-gm8q <https://github.com/pypa/virtualenv/security/advisories/GHSA-c947-3pg5-gm8q>); both reported by :user:Kwstubbs of GitHub Security Lab. (:issue:3367)

---

v21.14.1 (2026-09-29)

---

... (truncated)

Commits

• 571bc20 release 21.14.5
• 5b9b7de Reset the embed update log when it cannot be read (#3376)
• 9fd48c8 🐛 fix(ci): dump stacks from a thread that holds the GIL (#3377)
• 5183a10 🎨 style: give every Final annotation its type (#3375)
• 288f13c 🎨 style(test): mark prompt fixture locals Final (#3374)
• 6657c58 release 21.14.4
• 0cfcfd7 📝 docs(changelog): note the zsh prompt fix (#3373)
• f0620a2 Upgrade embedded pip/setuptools/wheel and CI test tools (#3372)
• 5b91536 Merge commit from fork
• fe14686 release 21.14.3
• Additional commits viewable in compare view

[strix-security]

Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here.

So far, Strix has reviewed 30 pull requests across this workspace.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[docdyhr]

@dependabot rebase