Update workflow python deps

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
hatch (changelog)	1.17.1 → 1.18.1
virtualenv	21.7.1 → 21.8.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

pypa/hatch (hatch)

v1.18.1: Hatch v1.18.1

Compare Source

Added:

• Apply context formatting to the lock-filename environment option so fields such as {env_name} and {matrix:...} are resolved when computing the lock file path.

Fixed:

• Consolidate extras and feature resolution into a single code path, fixing regressions where environment and project extras could be dropped or resolved inconsistently, and always validate undefined features.

• Normalize hyphens in the plugin name when building environment option environment variable names in get_env_var(), so options for hyphenated plugins resolve to the correct variable.

v1.18.0: Hatch v1.18.0

Compare Source

Changed:

• Upgrade default CPython distributions to 2026080

Added:

• Add the sources environment option, which redirects dependencies to a local path, Git repository, URL, alternate index, or workspace member at install time without altering published metadata. The top-level [tool.hatch.sources] table is an alias for the default environment, environments inherit sources entry by entry, the HATCH_NO_SOURCES environment variable disables them, and hatch dep show sources reports what each source redirects

• Add the --all/-a flag to the build command to build the workspace root and every workspace member defined by the selected environment, consolidating artifacts in the workspace root's dist directory by default. A root that does not define a project table is skipped so that a top-level pyproject.toml may only contain workspace configuration

• Add the tool.hatch.requires-hatch field, a version specifier set that commands reading the project's metadata enforce against the running version of Hatch

• Add first-class support for free-threaded distribution names such as 3.13t and 3.14t to the python commands and environment python option, rather than requiring the HATCH_PYTHON_VARIANT_GIL environment variable

• The version command can now bump versions that are statically defined by the project.version field, updating pyproject.toml in place. Pass --force to allow an explicit downgrade

• Support managing Python 3.15 distributions, currently 3.15.0rc1

Fixed:

• Erase stale coverage data before running hatch test --cover.

• Fix environment creation crashing when a metadata hook exists that doesn’t happen to be installed in the hatch CLI’s environment.

• Fix commands run by hatch run no longer being interruptible with Ctrl-C, which happened because the ignored SIGINT of the parent process was inherited by the child process.

• Fix the generated Pyrefly config being invalid on Windows, since backslashes in the absolute paths were interpreted as TOML escape sequences.

• Fix the hardcoded reliance on pip when installing dependencies internally by using uv instead.

• Fix environment creation silently installing a GIL-enabled Python distribution when Hatch itself runs on a free-threaded build. The distribution matching the running interpreter, such as 3.14t, is now selected.

• Fix free-threaded selectors such as 3.14t being rejected by an environment's python option, even though hatch python install 3.14t already accepted them.

• Never automatically select a prerelease Python distribution, such as 3.15.0rc1, when falling back to the latest compatible version. A prerelease is still installed when requested explicitly.

pypa/virtualenv (virtualenv)

v21.8.1

Compare Source

What's Changed

• 🐛 fix(build): make the SBOM serial number deterministic and validate its structure in CI by @​gaborbernat in #​3268

Full Changelog: pypa/virtualenv@21.8.0...21.8.1

v21.7.16

Compare Source

What's Changed

• 📝 docs(security): add an incident response plan by @​gaborbernat in #​3262
• 📝 docs(security): document both reporting lanes and scope by @​gaborbernat in #​3261
• 🐛 fix(activation): escape csh prompt expansion characters by @​gaborbernat in #​3263

Full Changelog: pypa/virtualenv@21.7.15...21.7.16

v21.7.15

Compare Source

What's Changed

• 🐛 fix(activation): restore empty saved values on deactivate by @​gaborbernat in #​3259
• 🐛 fix(activation): make csh deactivate work without test by @​gaborbernat in #​3260

Full Changelog: pypa/virtualenv@21.7.14...21.7.15

v21.7.14

Compare Source

What's Changed

• 🐛 fix(activation): escape ! for csh history expansion by @​gaborbernat in #​3256

Full Changelog: pypa/virtualenv@21.7.13...21.7.14

v21.7.13

Compare Source

What's Changed

• 👷 ci: correct a stale checkout pin comment by @​gaborbernat in #​3254
• 🔧 chore: drop misc as a changelog fragment type by @​gaborbernat in #​3255
• 👷 ci: scope the nushell apt key to its own repo by @​gaborbernat in #​3253
• 🐛 fix(activation): stop path command injection in bash and fish by @​gaborbernat in #​3252

Full Changelog: pypa/virtualenv@21.7.12...21.7.13

v21.7.12

Compare Source

What's Changed

• 🔧 chore(changelog): drop dead CVE-2026-24049 fragment by @​gaborbernat in #​3249
• 🐛 fix(activation): escape batch quote() against injection by @​gaborbernat in #​3250
• 🐛 fix(seed): verify downloaded wheel digests by @​gaborbernat in #​3251

Full Changelog: pypa/virtualenv@21.7.11...21.7.12

v21.7.11

Compare Source

What's Changed

• Add OpenSSF Scorecard workflow by @​gaborbernat in #​3238
• Document AI-assisted contributions and licensing policy by @​gaborbernat in #​3239
• 👷 ci(release): attest and sign release provenance by @​gaborbernat in #​3242
• 👷 ci: harden Scorecard-scored checks in CI by @​gaborbernat in #​3241
• 🐛 fix(ci): parallelize graalpy tests, recover crashed workers by @​gaborbernat in #​3240
• 🐛 fix(ci): mark real-shell activation tests as slow by @​gaborbernat in #​3243
• 👷 ci: run macOS jobs on macos-26 by @​gaborbernat in #​3244
• 🐛 fix(activation): undo a live activation before activate.bat saves values by @​darrenhuai in #​3245
• 🐛 fix(create): keep pyvenv.cfg values on a single line by @​gaborbernat in #​3247
• 🔧 chore(test): add opt-in Atheris fuzz harness by @​gaborbernat in #​3246
• 📝 docs(readme): add OpenSSF Best Practices badge by @​gaborbernat in #​3248

Full Changelog: pypa/virtualenv@21.7.10...21.7.11

v21.7.10

Compare Source

What's Changed

• 🔧 chore: check spelling with typos in pre-commit by @​even-even in #​3235
• 🐛 fix(activation): keep and restore the user's TCL_LIBRARY and TK_LIBRARY by @​darrenhuai in #​3234
• 🐛 fix(create): skip blank and comment lines in pyvenv.cfg by @​r3wretrhy in #​3232
• 🐛 fix(activation): restore PKG_CONFIG_PATH that was not set before by @​darrenhuai in #​3233

New Contributors

• @​r3wretrhy made their first contribution in #​3232

Full Changelog: pypa/virtualenv@21.7.9...21.7.10

v21.7.9

Compare Source

What's Changed

• fix(test): EncodingWarning: 'encoding' argument not specified by @​even-even in #​3228
• 🐛 fix(config): ignore a config file that fails to parse instead of crashing by @​darrenhuai in #​3230
• 🐛 fix(util): replace a stale symlink instead of writing through it by @​darrenhuai in #​3229

Full Changelog: pypa/virtualenv@21.7.8...21.7.9

v21.7.8

Compare Source

What's Changed

• 🐛 fix(create): report a missing source that both modes need by @​darrenhuai in #​3227

Full Changelog: pypa/virtualenv@21.7.7...21.7.8

v21.7.7

Compare Source

What's Changed

• 📄 docs: document the interpreter names in an environment by @​gaborbernat in #​3225
• 🎨 refactor(create): read the system exe without narrowing by @​gaborbernat in #​3224

Full Changelog: pypa/virtualenv@21.7.6...21.7.7

v21.7.6

Compare Source

What's Changed

• 🐛 fix(create): name Windows venv exes after the interpreter by @​darrenhuai in #​3223

Full Changelog: pypa/virtualenv@21.7.5...21.7.6

v21.7.5

Compare Source

What's Changed

• 🐛 fix(types): adapt to python-discovery 1.5.2 annotations by @​gaborbernat in #​3211
• 📄 docs: publish llms.txt from the docs build by @​gaborbernat in #​3210
• Push renamed changelog to PR branch in upgrade workflow by @​gaborbernat in #​3213
• 🔧 chore: batch dependency updates weekly on Tuesday by @​gaborbernat in #​3219
• docs: actualize python support version by @​even-even in #​3220
• 🐛 fix(create): check every execute bit in ExePathRef.can_run by @​darrenhuai in #​3217
• 🐛 fix(util): make safe_delete's error handler actually run by @​darrenhuai in #​3222

New Contributors

• @​even-even made their first contribution in #​3220

Full Changelog: pypa/virtualenv@21.7.4...21.7.5

v21.7.4

Compare Source

What's Changed

• Upgrade embedded pip/setuptools/wheel by @​github-actions[bot] in #​3208

Full Changelog: pypa/virtualenv@21.7.3...21.7.4

v21.7.3

Compare Source

What's Changed

• 🐛 fix(config): return a real list from ListType.split_values by @​darrenhuai in #​3207

New Contributors

• @​darrenhuai made their first contribution in #​3207

Full Changelog: pypa/virtualenv@21.7.2...21.7.3

v21.7.2

Compare Source

What's Changed

• Upgrade embedded pip/setuptools/wheel by @​github-actions[bot] in #​3206

Full Changelog: pypa/virtualenv@21.7.1...21.7.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 6am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cit-pr-commenter-54b7da]

evalya-impact-summary

evalya impact analysis

Impact analysis: 0 selected, 0 skipped (of 0 test tasks)
Publish tasks:   2 (always emitted)
Diff (1 file):
  .github/workflows/build-ddev.yml

Debug a specific task: evalya plan impact --path <path> --task <task>

Learn more about CI impact filtering

[AAraKKe]

This PR was opened from a forced run and is still too young (we wait for 7 days after a bump). Will keep it open and needs to be merged once the 7 day window pass and the stability-days check goes green.

[dd-octo-sts]

Disk usage change

Commit 0d95015 compared against 18e7520.

No integration or dependency changed size.

[dd-octo-sts]

Validation Report

All 21 validations passed.

Show details

Validation	Description	Status
agent-reqs	Verify check versions match the Agent requirements file	✅
ci	Validate CI configuration and code coverage settings	✅
codeowners	Validate every integration has a CODEOWNERS entry	✅
config	Validate default configuration files against spec.yaml	✅
dep	Verify dependency pins are consistent and Agent-compatible	✅
http	Validate integrations use the HTTP wrapper correctly	✅
imports	Validate check imports do not use deprecated modules	✅
integration-style	Validate check code style conventions	✅
jmx-metrics	Validate JMX metrics definition files and config	✅
labeler	Validate PR labeler config matches integration directories	✅
legacy-signature	Validate no integration uses the legacy Agent check signature	✅
license-headers	Validate Python files have proper license headers	✅
licenses	Validate third-party license attribution list	✅
metadata	Validate metadata.csv metric definitions	✅
models	Validate configuration data models match spec.yaml	✅
openmetrics	Validate OpenMetrics integrations disable the metric limit	✅
package	Validate Python package metadata and naming	✅
qa-label	Validate the pull request declares whether it needs QA for the next Agent release	✅
readmes	Validate README files have required sections	✅
saved-views	Validate saved view JSON file structure and fields	✅
version	Validate version consistency between package and changelog	✅

View full run

[datadog-prod-us1-5]

❌ Errors

Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 1 Pipeline job failed

DataDog/integrations-core | build:redisdb:tests:compose:full-coverage.compose:info-proxy-build

View more details · View in GitLab

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 004914e | Docs | View more details | Give us feedback!}