chore(deps): bump virtualenv from 21.14.1 to 21.14.2

[dependabot]

Bumps virtualenv from 21.14.1 to 21.14.2.

Release notes

Sourced from virtualenv's releases.

21.14.2

What's Changed

• Upgrade embedded pip/setuptools/wheel and CI test tools by @​github-actions[bot] in pypa/virtualenv#3365
• 📝 docs(changelog): note the activation security fixes by @​gaborbernat in pypa/virtualenv#3367
• 🐛 fix(create): keep non-path pyvenv.cfg values as written by @​darrenhuai in pypa/virtualenv#3366

Full Changelog: pypa/virtualenv@21.14.1...21.14.2

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.14.2

• Fix pyvenv.cfg getting an absolute path in python-version, include-system-site-packages and the other keys that hold no path when the working directory has an entry named like the value, such as 3.14 for virtualenv 3.14 or true with --system-site-packages - by :user:darrenhuai. (:issue:3366)
• Fix activation scripts running code from a virtual environment path whose parent directory carries a placeholder name such as __VIRTUAL_NAME__ (GHSA-8rjx-v5ww-45pp <https://github.com/pypa/virtualenv/security/advisories/GHSA-8rjx-v5ww-45pp>), and activate.fish running commands from a path or --prompt that holds a backslash before a single quote (GHSA-c947-3pg5-gm8q <https://github.com/pypa/virtualenv/security/advisories/GHSA-c947-3pg5-gm8q>); both reported by :user:Kwstubbs of GitHub Security Lab. (:issue:3367)

---

v21.14.1 (2026-09-29)

---

No significant changes.

---

v21.14.0 (2026-09-29)

---

Features - 21.14.0

• Record the SPDX license id in the wheel and zipapp SBOMs for bundled packages that declare their license by name or classifier, such as distlib and python-discovery, so license scanners can match them. (:issue:3339)
• Add the Tidelift and thanks.dev funding links to the PyPI project URLs, next to GitHub Sponsors - by :user:gaborbernat. (:issue:3340)

Bugfixes - 21.14.0

• Build the release sdist, wheel and zipapp with the build backend and SBOM tools that tasks/release-requirements.txt pins by version and SHA-256, so a rebuild of the tag uses the same versions. (:issue:3337)
• Use PEP 440 version ordering when selecting seed wheels, so pinned pre-releases, post-releases and local versions resolve to the requested wheel. (:issue:3360)

Improved Documentation - 21.14.0

• Apply the licensing policy to what the wheel and zipapp ship, checked against their SBOMs, and name ALLOWED_LICENSES in tasks/license_policy.py as the list of accepted licenses. (:issue:3339)
• Document what a maintainer checks when reviewing a pull request and what the main ruleset requires before a merge
  • by :user:gaborbernat. (:issue:3341)
• Document how the project selects, obtains and tracks its dependencies, and which dependency findings block a merge or a release - by :user:gaborbernat. (:issue:3342)
• Document which static analysis findings block a merge or a release, and how maintainers suppress a finding - by

... (truncated)

Commits

• a6bdda0 release 21.14.2
• 9916be9 🐛 fix(create): keep non-path pyvenv.cfg values as written (#3366)
• 415224a 📝 docs(changelog): note the activation security fixes (#3367)
• 602b266 Merge commit from fork
• 3bddeaf Merge commit from fork
• 044e780 Upgrade embedded pip/setuptools/wheel and CI test tools (#3365)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)