chore(deps): update dependency virtualenv to v20.36.1 [security]

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
virtualenv	==20.34.0 → ==20.36.1

GitHub Vulnerability Alerts

CVE-2026-22702

Impact

TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creation to redirect virtualenv's app_data and lock file operations to attacker-controlled locations.

Affected versions: All versions up to and including 20.36.1

Affected users: Any user running virtualenv on multi-user systems where untrusted local users have filesystem access to shared temporary directories or where VIRTUALENV_OVERRIDE_APP_DATA points to a user-writable location.

Attack scenarios:

• Cache poisoning: Attacker corrupts wheels or Python metadata in the cache
• Information disclosure: Attacker reads sensitive cached data or metadata
• Lock bypass: Attacker controls lock file semantics to cause concurrent access violations
• Denial of service: Lock starvation preventing virtualenv operations

Patches

The vulnerability has been patched by replacing check-then-act patterns with atomic os.makedirs(..., exist_ok=True) operations.

Fixed in: PR #​3013

Versions with the fix: 20.36.2 and later

Users should upgrade to version 20.36.2 or later.

Workarounds

If you cannot upgrade immediately:

1. Ensure VIRTUALENV_OVERRIDE_APP_DATA points to a directory owned by the current user with restricted permissions (mode 0700)
2. Avoid running virtualenv in shared temporary directories where other users have write access
3. Use separate user accounts for different projects to isolate app_data directories

References

• GitHub PR: https://github.com/pypa/virtualenv/pull/3013
• Vulnerability reported by: @​tsigouris007
• CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (TOCTOU)
• CWE-59: Improper Link Resolution Before File Access

---

Release Notes

pypa/virtualenv (virtualenv)

v20.36.1

Compare Source

What's Changed

• release 20.36.0 by @​gaborbernat in #​3011
• fix: resolve TOCTOU vulnerabilities in app_data and lock directory creation by @​gaborbernat in #​3013

Full Changelog: pypa/virtualenv@20.36.0...20.36.1

v20.36.0

Compare Source

What's Changed

• release 20.35.3 by @​gaborbernat in #​2981
• fix: Prevent NameError when accessing _DISTUTILS_PATCH during file ov… by @​gracetyy in #​2982
• Upgrade pip and fix 3.15 picking old wheel by @​gaborbernat in #​2989
• release 20.35.4 by @​gaborbernat in #​2990
• fix: wrong path on migrated venv by @​sk1234567891 in #​2996
• test_too_many_open_files: assert on errno.EMFILE instead of strerror by @​pltrz in #​3001
• fix: update filelock dependency version to 3.20.1 to fix CVE CVE-2025-68146 by @​pythonhubdev in #​3002
• fix: resolve EncodingWarning in tox upgrade environment by @​gaborbernat in #​3007
• Fix Interpreter discovery bug wrt. Microsoft Store shortcut using Latin-1 by @​rahuldevikar in #​3006
• Add support for PEP 440 version specifiers in the --python flag. by @​rahuldevikar in #​3008

New Contributors

• @​gracetyy made their first contribution in #​2982
• @​sk1234567891 made their first contribution in #​2996
• @​pltrz made their first contribution in #​3001
• @​pythonhubdev made their first contribution in #​3002
• @​rahuldevikar made their first contribution in #​3006

Full Changelog: pypa/virtualenv@20.35.3...20.36.0

v20.35.4

Compare Source

What's Changed

• release 20.35.3 by @​gaborbernat in #​2981
• fix: Prevent NameError when accessing _DISTUTILS_PATCH during file ov… by @​gracetyy in #​2982
• Upgrade pip and fix 3.15 picking old wheel by @​gaborbernat in #​2989

New Contributors

• @​gracetyy made their first contribution in #​2982

Full Changelog: pypa/virtualenv@20.35.3...20.35.4

v20.35.3

Compare Source

What's Changed

• release 20.35.1 by @​gaborbernat in #​2976
• Revert out effort to extract discovery by @​gaborbernat in #​2978
• release 20.35.2 by @​gaborbernat in #​2980
• test_too_many_open_files fails by @​gaborbernat in #​2979

Full Changelog: pypa/virtualenv@20.35.1...20.35.3

v20.35.2

Compare Source

What's Changed

• release 20.35.1 by @​gaborbernat in #​2976
• Revert out effort to extract discovery by @​gaborbernat in #​2978

Full Changelog: pypa/virtualenv@20.35.1...20.35.2

v20.35.1

Compare Source

What's Changed

• release 20.34.0 by @​gaborbernat in #​2954
• refactor: Decouple discovery module by @​esafak in #​2956
• feat: ensure creation of python3.exe and python3 on Windows by @​esafak in #​2957
• fix: Use getattr for tcl/tk library paths by @​esafak in #​2945
• fix: Import fs_is_case_sensitive absolutely in py_info.py by @​esafak in #​2960
• Declare 3.14 support by @​gaborbernat in #​2970
• release 20.35.0 by @​gaborbernat in #​2971
• fix: Patch get_interpreter to handle missing cache and app_data by @​esafak in #​2974
• Fix backwards incompatible changes on PythonInfo by @​gaborbernat in #​2975

Full Changelog: pypa/virtualenv@20.34.0...20.35.1

v20.35.0

Compare Source

What's Changed

• release 20.34.0 by @​gaborbernat in #​2954
• refactor: Decouple discovery module by @​esafak in #​2956
• feat: ensure creation of python3.exe and python3 on Windows by @​esafak in #​2957
• fix: Use getattr for tcl/tk library paths by @​esafak in #​2945
• fix: Import fs_is_case_sensitive absolutely in py_info.py by @​esafak in #​2960
• chore(deps): bump pypa/gh-action-pypi-publish from 1.12.3 to 1.13.0 in /.github/workflows by @​dependabot[bot] in #​2964
• Declare 3.14 support by @​gaborbernat in #​2970

Full Changelog: pypa/virtualenv@20.34.0...20.35.0

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[gemini-code-assist]

Summary of Changes

Hello @renovate-bot, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request updates the virtualenv dependency to version 20.36.1. While this is presented as a security update, the accompanying vulnerability alert for CVE-2026-22702 explicitly states that versions up to and including 20.36.1 are still affected by a critical TOCTOU vulnerability. The complete resolution for this issue is found in virtualenv version 20.36.2 and subsequent releases. This update incorporates other changes from intermediate versions but does not fully mitigate the identified security risk.

Highlights

• Dependency Update: The virtualenv dependency has been updated from version 20.34.0 to 20.36.1.
• Security Context: This update is categorized as a security update by Renovate, addressing a TOCTOU (Time-of-Check-Time-of-Use) vulnerability (CVE-2026-22702).
• Vulnerability Status: The provided security advisory indicates that virtualenv versions up to and including 20.36.1 are still affected by CVE-2026-22702. The full fix for this vulnerability is available in virtualenv version 20.36.2 and later.
• Potential Impact: The TOCTOU vulnerability allows local attackers to perform symlink-based attacks, potentially leading to cache poisoning, information disclosure, lock bypass, or denial of service.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request updates the virtualenv dependency to version 20.36.1 to address the security vulnerability GHSA-597g-3phw-6986. The update to version 20.36.1 is correct and resolves the vulnerability, as confirmed by the official GitHub Security Advisory and the virtualenv release notes. The code change is correct. It is worth noting that the vulnerability summary in the PR description appears to contain incorrect information, stating the fix is in 20.36.2, which could cause confusion. No changes are required for this PR.