Accepted python-virtualenv 21.15.6+ds-1 (source) into unstable

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 09 Nov 2026 11:19:53 +0000
Source: python-virtualenv
Architecture: source
Version: 21.15.6+ds-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Changed-By: Colin Watson <cjwatson@debian.org>
Closes: 1149650 1151685
Changes:
 python-virtualenv (21.15.6+ds-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release (closes: #1149650, #1151685):
     - CVE-2026-102925: Fix activate and activate.fish running commands
       embedded in the virtual environment path or in the interpreter's
       Tcl/Tk library paths.
     - CVE-2026-102930: Verify a downloaded seed wheel's sha256 against PyPI
       before seeding it into a virtual environment, skipped when a custom
       pip index is configured.
     - CVE-2026-102938: Write pyvenv.cfg values on a single line, so a prompt
       carrying a line boundary can no longer inject configuration.
     - CVE-2026-113713: Always copy seed packages when app-data is temporary,
       including when symlink seeding is enabled through an environment
       variable or configuration file.
     - CVE-2026-113714, CVE-2026-113717: Verify downloads in a private
       staging directory before adding them to the reusable wheel cache.
     - CVE-2026-113715: Reject destinations containing line boundaries when
       using the stdlib venv creator, before it writes pyvenv.cfg.
     - CVE-2026-113716: Replace pre-existing directory symlinks and Windows
       junctions in the environment's executable and library paths before
       creating files.
     - CVE-2026-113718: Write xonsh prompt and path literals as ASCII escapes
       in every generated activation script.
     - CVE-2026-113719: Limit seed-package cleanup to entries inside the
       environment.
     - CVE-2026-113720: Apply the current umask when copying interpreter and
       seed-package files instead of inheriting cached permission bits.
     - CVE-2026-113721: Replace existing symbolic and hard links when writing
       environment configuration, activation scripts, import hooks, and seed
       launchers.
     - CVE-2026-113722: Preserve spaces, quotes, and backslashes in
       interpreter paths when pip console scripts need a POSIX shell
       launcher.
     - CVE-2026-113723: Leave PS1 unchanged when sourcing the POSIX
       activation script in a shell other than bash or zsh, whose prompt
       escaping rules virtualenv handles.
     - CVE-2026-113724: Preserve file permissions when deletion fails on
       POSIX.
     - CVE-2026-113725: Escape the environment name in the bash activator for
       both of bash's PS1 passes.
     - CVE-2026-113726: Fix activate running commands from a virtual
       environment name or --prompt that holds $(...), backticks or ${...}
       when zsh has PROMPT_SUBST set.
     - CVE-2026-113732: Fix activate.fish running commands from a path or
       --prompt that holds a backslash before a single quote.
     - CVE-2026-113776: Fix activation scripts running code from a virtual
       environment path whose parent directory carries a placeholder name
       such as __VIRTUAL_NAME__.
Checksums-Sha1:
 83944c70586ad3f1c4495b9a1b81c09b17d0305e 2982 python-virtualenv_21.15.6+ds-1.dsc
 d2b24ae0ccb67e58fad94dfa65a0e89c03563a8f 198304 python-virtualenv_21.15.6+ds.orig.tar.xz
 8de33bfde145d4ea84c92dd3fa99bc56c6f21d5d 17076 python-virtualenv_21.15.6+ds-1.debian.tar.xz
 fdadea169fb09adfd2e5a3c30f73691c8d92e642 617480 python-virtualenv_21.15.6+ds-1.git.tar.xz
 9a7057189653513ef2718fc0a8a77ebed12edd51 17797 python-virtualenv_21.15.6+ds-1_source.buildinfo
Checksums-Sha256:
 f25387f9b3f8cf5f4eba232318754c8b89b4dae8e28edfe591e729700551bb71 2982 python-virtualenv_21.15.6+ds-1.dsc
 06a5dfc8cd3a2339fa0eaef6f42e7a44abc913e2ae91cc6c1f73a558216d74e2 198304 python-virtualenv_21.15.6+ds.orig.tar.xz
 d2f91c98afe6682d189cedad67bc98660dcdc0e261e111eb6f1ee3f8ea82b2f4 17076 python-virtualenv_21.15.6+ds-1.debian.tar.xz
 947d0b9cb948e3b052171bbdd61829b740155a9b80de05496a924df7409b36a9 617480 python-virtualenv_21.15.6+ds-1.git.tar.xz
 29c1200756739a52fbe5f74f26182d82386a5f678ed1b7b01ab0e4de6d64c9fd 17797 python-virtualenv_21.15.6+ds-1_source.buildinfo
Files:
 cf04c854ff94b09e0c471b56c3662a56 2982 python optional python-virtualenv_21.15.6+ds-1.dsc
 c3c60bc05d04ae78482f7e0b9d3f1491 198304 python optional python-virtualenv_21.15.6+ds.orig.tar.xz
 8806137f0e5d38032a780b4e77c4d45c 17076 python optional python-virtualenv_21.15.6+ds-1.debian.tar.xz
 eb6341cb84576586ce56f817032ad0c6 617480 python None python-virtualenv_21.15.6+ds-1.git.tar.xz
 0987a78e769d9efc6ea87a1df4c00051 17797 python optional python-virtualenv_21.15.6+ds-1_source.buildinfo
Git-Tag-Info: tag=e26dc77deb811fe531b886e8d835e3874dd5f194 fp=ac0a4ff12611b6fccf01c111393587d97d86500b
Git-Tag-Tagger: Colin Watson <cjwatson@debian.org>

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrxrNkACgkQYG0ITkaD
wHl/hQ//be5K9oJ3r6kRKcBZGOVSZo4SM/m5WPDS6vZIyN+sXtD1iQqG3oTwiglv
HXRzkbl4Exps5eqr+qKDUFWm/HBu9qGP/x0qEMafvSHbS/drIJ+N/aFmCTn7CQjj
zjKEzDFbC1wunH0m8PrmLX10uU9TN9nS/LLpOT5lafFWv7hKmFeNrq4idfKddGxE
TivNnBn45a5xg7RgNUFb9Cyxu3MpqY/e4LAdzeUbIT7WsxfcEZSih8w+btC5Ftsh
ffFMYHFZclrRbkFbJEltFArJZTn0ctlHBCWQ7YUS/KSPD7hrUTEfIZawmHNyUGFe
KooXohzcO5gsxH07WeMK5Nol8UrdTkwDpGdFIsNxbyAH0+nvc9rxjExhjWIOp1t3
iX54Tw6ynb8OAgQOBQzDaFBY0yCidWPu0Hd6VoxKR9ZFGLtJgrBdpu1YF/EzYVrg
rF1CYOCqZZneOJbYBL/IyfnmvHayky2nVEvk4szN6d+1gRgBf3JZeXE86tYHpG0W
kyAuMaAnid8u7bHWYAl3JzNEFYlNykfRQNErM62ArhiALmcRIm8ZZEtbdHeNO9/f
lApqxCgtpvLBdgmHAxAy4P2GxlLcwiMssFRFAnRNjT2R5/GjkDg4bQoU+xonQekF
Ig815E3GSOePFGTzmbCh0YLOY0HKtAVwW/DF1eo8Ib8zhl8JhBc=
=wvxn
-----END PGP SIGNATURE-----