Update virtualenv requirement from ~=20.36.1 to >=20.36.1,<20.38.0

[dependabot]

Updates the requirements on virtualenv to permit the latest version.

Changelog

Sourced from virtualenv's changelog.

################# Release History #################

.. towncrier-draft-entries:: [UNRELEASED DRAFT]

.. towncrier release notes start

---

v20.36.1 (2026-01-09)

---

Bugfixes - 20.36.1

• Fix TOCTOU vulnerabilities in app_data and lock directory creation that could be exploited via symlink attacks - reported by :user:tsigouris007, fixed by :user:gaborbernat. (:issue:3013)

---

v20.36.0 (2026-01-07)

---

Features - 20.36.0

• Add support for PEP 440 version specifiers in the --python flag. Users can now specify Python versions using operators like >=, <=, ~=, etc. For example: virtualenv --python=">=3.12" myenv . (:issue:2994`)

---

v20.35.4 (2025-10-28)

---

Bugfixes - 20.35.4

• Fix race condition in _virtualenv.py when file is overwritten during import, preventing NameError when _DISTUTILS_PATCH is accessed - by :user:gracetyy. (:issue:2969)

• Upgrade embedded wheels:

  • pip to 25.3 from 25.2 (:issue:2989)

---

v20.35.3 (2025-10-10)

---

Bugfixes - 20.35.3

• Accept RuntimeError in test_too_many_open_files, by :user:esafak (:issue:2935)

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[greptile-apps]

Greptile Summary

Updated the virtualenv dependency constraint from ~=20.36.1 to >=20.36.1,<20.38.0 in the dev dependency group. This change relaxes the version pinning to allow for minor version updates while maintaining compatibility.

• The new constraint permits versions 20.36.1 through 20.37.x, excluding 20.38.0 and above
• According to the changelog, versions 20.36.1 and 20.37.0 include bug fixes for TOCTOU vulnerabilities and race conditions
• No breaking changes are expected as this is a development-only dependency used for testing environments

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• The change only updates a development dependency version constraint, expanding the allowed range to include bug fixes and security improvements. Since virtualenv is only used in the dev dependency group and not in production dependencies, there's no impact on end users. The changelog shows the newer versions include important security fixes for TOCTOU vulnerabilities.
• No files require special attention

Important Files Changed

Filename	Overview
pyproject.toml	Updated virtualenv version constraint from ~=20.36.1 to >=20.36.1,<20.38.0 to allow patch and minor version updates

_{Last reviewed commit: 0a219bd}