From be556019b6d2e9a519a4ae53b55435b801a7cbde Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 30 Sep 2026 10:49:40 +0000
Subject: [PATCH] Bump nodeenv from 1.10.0 to 1.11.0 (#13873)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [nodeenv](https://github.com/ekalinin/nodeenv) from 1.10.0 to
1.11.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/ekalinin/nodeenv/releases">nodeenv's
releases</a>.</em></p>
<blockquote>
<h2>1.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>feat(certifi): optionally use certifi certificates by <a
href="https://github.com/ekalinin"><code>@​ekalinin</code></a> in <a
href="https://redirect.github.com/ekalinin/nodeenv/pull/394">ekalinin/nodeenv#394</a></li>
<li>feat(nodeenv): accept npm-style semver ranges in --node by <a
href="https://github.com/ekalinin"><code>@​ekalinin</code></a> in <a
href="https://redirect.github.com/ekalinin/nodeenv/pull/393">ekalinin/nodeenv#393</a></li>
<li>feat(nodeenv): add --prefer-system to use system node when available
by <a href="https://github.com/ekalinin"><code>@​ekalinin</code></a> in
<a
href="https://redirect.github.com/ekalinin/nodeenv/pull/395">ekalinin/nodeenv#395</a></li>
<li>feat(nodeenv): add --isolate-npm to keep npm config inside the
environment by <a
href="https://github.com/ekalinin"><code>@​ekalinin</code></a> in <a
href="https://redirect.github.com/ekalinin/nodeenv/pull/396">ekalinin/nodeenv#396</a></li>
<li>feat(nodeenv): install local packages from a requirements file by <a
href="https://github.com/ekalinin"><code>@​ekalinin</code></a> in <a
href="https://redirect.github.com/ekalinin/nodeenv/pull/407">ekalinin/nodeenv#407</a></li>
<li>feat(nodeenv): write the posix activate on Windows for git-bash by
<a href="https://github.com/ekalinin"><code>@​ekalinin</code></a> in <a
href="https://redirect.github.com/ekalinin/nodeenv/pull/409">ekalinin/nodeenv#409</a></li>
</ul>
<h3>Fixed bugs 🐛</h3>
<ul>
<li>fix: repair Windows CI (ZipFile.extractall filter, test_smoke
layout) by <a
href="https://github.com/ekalinin"><code>@​ekalinin</code></a> in <a
href="https://redirect.github.com/ekalinin/nodeenv/pull/392">ekalinin/nodeenv#392</a></li>
<li>fix(nodeenv): replace leftover debug print with logger.debug by <a
href="https://github.com/ekalinin"><code>@​ekalinin</code></a> in <a
href="https://redirect.github.com/ekalinin/nodeenv/pull/391">ekalinin/nodeenv#391</a></li>
<li>fix(nodeenv): stop -p from reinstalling node that is already there
by <a href="https://github.com/ekalinin"><code>@​ekalinin</code></a> in
<a
href="https://redirect.github.com/ekalinin/nodeenv/pull/403">ekalinin/nodeenv#403</a></li>
<li>fix(nodeenv): let -p target a virtualenv nodeenv isn't installed in
by <a href="https://github.com/ekalinin"><code>@​ekalinin</code></a> in
<a
href="https://redirect.github.com/ekalinin/nodeenv/pull/402">ekalinin/nodeenv#402</a></li>
<li>fix(nodeenv): report the url and proxy instead of a traceback by <a
href="https://github.com/ekalinin"><code>@​ekalinin</code></a> in <a
href="https://redirect.github.com/ekalinin/nodeenv/pull/410">ekalinin/nodeenv#410</a></li>
<li>fix(nodeenv): keep the python virtualenv's scripts under -p on
Windows by <a
href="https://github.com/ekalinin"><code>@​ekalinin</code></a> in <a
href="https://redirect.github.com/ekalinin/nodeenv/pull/411">ekalinin/nodeenv#411</a></li>
<li>fix(nodeenv): report a missing node archive instead of a traceback
by <a href="https://github.com/ekalinin"><code>@​ekalinin</code></a> in
<a
href="https://redirect.github.com/ekalinin/nodeenv/pull/412">ekalinin/nodeenv#412</a></li>
<li>fix(nodeenv): detect musl regardless of the host triplet vendor by
<a href="https://github.com/ekalinin"><code>@​ekalinin</code></a> in <a
href="https://redirect.github.com/ekalinin/nodeenv/pull/413">ekalinin/nodeenv#413</a></li>
<li>fix(nodeenv): read npm's parseable listing in freeze by <a
href="https://github.com/ekalinin"><code>@​ekalinin</code></a> in <a
href="https://redirect.github.com/ekalinin/nodeenv/pull/414">ekalinin/nodeenv#414</a></li>
<li>fix: allow zsh to source bin/activate by <a
href="https://github.com/r3wretrhy"><code>@​r3wretrhy</code></a> in <a
href="https://redirect.github.com/ekalinin/nodeenv/pull/417">ekalinin/nodeenv#417</a></li>
<li>fix(nodeenv): link nodejs.exe without mklink by <a
href="https://github.com/ekalinin"><code>@​ekalinin</code></a> in <a
href="https://redirect.github.com/ekalinin/nodeenv/pull/415">ekalinin/nodeenv#415</a></li>
</ul>
<h3>Improvements 🛠</h3>
<ul>
<li>FEAT: Check if activate is called as script. by <a
href="https://github.com/quazgar"><code>@​quazgar</code></a> in <a
href="https://redirect.github.com/ekalinin/nodeenv/pull/384">ekalinin/nodeenv#384</a></li>
<li>address deprecation warning in tarfile.TarFile.extract all in Python
… by <a href="https://github.com/nernst"><code>@​nernst</code></a> in <a
href="https://redirect.github.com/ekalinin/nodeenv/pull/380">ekalinin/nodeenv#380</a></li>
<li>chore(ci): run the activation scripts in sh, dash, bash, zsh and
fish by <a
href="https://github.com/ekalinin"><code>@​ekalinin</code></a> in <a
href="https://redirect.github.com/ekalinin/nodeenv/pull/397">ekalinin/nodeenv#397</a></li>
<li>chore(ci): give the integration smoke tests a home and stop running
them 20 times by <a
href="https://github.com/ekalinin"><code>@​ekalinin</code></a> in <a
href="https://redirect.github.com/ekalinin/nodeenv/pull/401">ekalinin/nodeenv#401</a></li>
<li>feat(nodeenv): clean &quot;src&quot; directory by default by <a
href="https://github.com/ekalinin"><code>@​ekalinin</code></a> in <a
href="https://redirect.github.com/ekalinin/nodeenv/pull/404">ekalinin/nodeenv#404</a></li>
</ul>
<h3>Documentation 📄</h3>
<ul>
<li>docs(readme): document file:// mirrors as a local download source by
<a href="https://github.com/ekalinin"><code>@​ekalinin</code></a> in <a
href="https://redirect.github.com/ekalinin/nodeenv/pull/405">ekalinin/nodeenv#405</a></li>
<li>docs(changes): backfill the changelog from 1.3.2 to 1.10.0 by <a
href="https://github.com/ekalinin"><code>@​ekalinin</code></a> in <a
href="https://redirect.github.com/ekalinin/nodeenv/pull/408">ekalinin/nodeenv#408</a></li>
</ul>
<h3>Other Changes</h3>
<ul>
<li>chore(release): bump nodeenv version to 1.11.0 by <a
href="https://github.com/ekalinin"><code>@​ekalinin</code></a> in <a
href="https://redirect.github.com/ekalinin/nodeenv/pull/418">ekalinin/nodeenv#418</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/quazgar"><code>@​quazgar</code></a> made
their first contribution in <a
href="https://redirect.github.com/ekalinin/nodeenv/pull/384">ekalinin/nodeenv#384</a></li>
<li><a href="https://github.com/nernst"><code>@​nernst</code></a> made
their first contribution in <a
href="https://redirect.github.com/ekalinin/nodeenv/pull/380">ekalinin/nodeenv#380</a></li>
<li><a href="https://github.com/r3wretrhy"><code>@​r3wretrhy</code></a>
made their first contribution in <a
href="https://redirect.github.com/ekalinin/nodeenv/pull/417">ekalinin/nodeenv#417</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/ekalinin/nodeenv/compare/1.10.0...1.11.0">https://github.com/ekalinin/nodeenv/compare/1.10.0...1.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ekalinin/nodeenv/blob/master/CHANGES">nodeenv's
changelog</a>.</em></p>
<blockquote>
<h2>Version 1.11.0</h2>
<ul>
<li>Fixed zsh <code>source bin/activate</code> aborting on the
direct-call guard
<code>[#398](https://github.com/ekalinin/nodeenv/issues/398)
&lt;https://github.com/ekalinin/nodeenv/issues/398&gt;</code>_</li>
<li>Added check for how <code>activate</code> is called
<code>[#384](https://github.com/ekalinin/nodeenv/issues/384)
&lt;https://github.com/ekalinin/nodeenv/pull/384&gt;</code>_</li>
<li>Addressed the <code>tarfile.extractall</code> deprecation on Python
&gt;= 3.12 by
setting <code>filter='data'</code>, which also prevents writing files
via &quot;..&quot; or
absolute paths
<code>[#380](https://github.com/ekalinin/nodeenv/issues/380)
&lt;https://github.com/ekalinin/nodeenv/pull/380&gt;</code>_</li>
<li>Added support for Solaris/illumos
<code>[#360](https://github.com/ekalinin/nodeenv/issues/360)
&lt;https://github.com/ekalinin/nodeenv/issues/360&gt;</code>_</li>
<li>Added <code>predeactivate</code> hooks for Windows</li>
<li>Added error handling and tests for the node installation
<code>[#336](https://github.com/ekalinin/nodeenv/issues/336)
&lt;https://github.com/ekalinin/nodeenv/issues/336&gt;</code>_</li>
<li>Removed the leftover debug <code>print</code> that leaked a dict to
stdout on every
version detection
<code>[#390](https://github.com/ekalinin/nodeenv/issues/390)
&lt;https://github.com/ekalinin/nodeenv/issues/390&gt;</code>_</li>
<li>Added <code>--with-certifi</code> to download packages with the
certifi certificate
bundle <code>[#388](https://github.com/ekalinin/nodeenv/issues/388)
&lt;https://github.com/ekalinin/nodeenv/pull/388&gt;</code>_</li>
<li><code>--node</code> accepts npm-style semver ranges
<code>[#393](https://github.com/ekalinin/nodeenv/issues/393)
&lt;https://github.com/ekalinin/nodeenv/pull/393&gt;</code>_</li>
<li>Added <code>--prefer-system</code> to use system-wide node.js when
available and
install one otherwise
<code>[#153](https://github.com/ekalinin/nodeenv/issues/153)
&lt;https://github.com/ekalinin/nodeenv/issues/153&gt;</code>_</li>
<li>Added <code>--isolate-npm</code> to keep npm cache, userconfig and
init-module inside
the environment
<code>[#154](https://github.com/ekalinin/nodeenv/issues/154)
&lt;https://github.com/ekalinin/nodeenv/issues/154&gt;</code>_</li>
<li>Added tests that run the activation scripts in sh, dash, bash, zsh
and fish.</li>
<li><code>-p</code> no longer reinstalls node when the requested version
is already in the
virtualenv <code>[#159](https://github.com/ekalinin/nodeenv/issues/159)
&lt;https://github.com/ekalinin/nodeenv/issues/159&gt;</code>_</li>
<li>Repeated <code>-p</code> runs no longer duplicate the
<code>predeactivate</code> hook
<code>[#159](https://github.com/ekalinin/nodeenv/issues/159)
&lt;https://github.com/ekalinin/nodeenv/issues/159&gt;</code>_</li>
<li><code>-p</code> accepts an optional virtualenv directory and prefers
the activated
<code>VIRTUAL_ENV</code> over the virtualenv nodeenv itself is installed
in
<code>[#156](https://github.com/ekalinin/nodeenv/issues/156)
&lt;https://github.com/ekalinin/nodeenv/issues/156&gt;</code>_</li>
<li><code>-r/--requirements</code> may now be given more than once, and
the new
<code>--local-requirements</code> installs the packages of a file
locally, into
&quot;node_modules&quot; of the current directory, which is what
<code>freeze -l</code> writes.
Under npm &lt; 1.0.0, which has no <code>-g</code>, a local file is
still installed the
old way <code>[#206](https://github.com/ekalinin/nodeenv/issues/206)
&lt;https://github.com/ekalinin/nodeenv/issues/206&gt;</code>_</li>
<li>The &quot;src&quot; directory is now removed after installation by
default, which
halves the size of an environment. Added <code>--no-clean-src</code> to
keep it: with
<code>--source</code> that is what lets a repeated <code>--force</code>
build reuse the
downloaded source tree
<code>[#205](https://github.com/ekalinin/nodeenv/issues/205)
&lt;https://github.com/ekalinin/nodeenv/issues/205&gt;</code>_</li>
<li>Documented that <code>--mirror</code> takes a <code>file://</code>
URL, so a local directory can
serve as the download source
<code>[#193](https://github.com/ekalinin/nodeenv/issues/193)
&lt;https://github.com/ekalinin/nodeenv/issues/193&gt;</code>_</li>
<li>The posix <code>activate</code> is now written on Windows too, into
&quot;Scripts&quot;, so
git-bash and the other posix shells there can activate an environment
<code>[#226](https://github.com/ekalinin/nodeenv/issues/226)
&lt;https://github.com/ekalinin/nodeenv/issues/226&gt;</code>_</li>
<li>A download that reaches nothing at all, which a broken
<code>http_proxy</code> or
<code>https_proxy</code> usually causes, now reports the url and the
proxy settings
instead of a traceback</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/ekalinin/nodeenv/commit/e7453580730938674da3e6928cc663cf9faf9e66"><code>e745358</code></a>
Merge pull request <a
href="https://redirect.github.com/ekalinin/nodeenv/issues/418">#418</a>
from ekalinin/chore/release-1.11.0</li>
<li><a
href="https://github.com/ekalinin/nodeenv/commit/fd19956502f268aeb69757cbee17569ec7adf97a"><code>fd19956</code></a>
chore(release): bump nodeenv version to 1.11.0</li>
<li><a
href="https://github.com/ekalinin/nodeenv/commit/17670153663efc3b4998861f0f57683bf93271b9"><code>1767015</code></a>
Merge pull request <a
href="https://redirect.github.com/ekalinin/nodeenv/issues/415">#415</a>
from ekalinin/fix/nodejs-exe-link</li>
<li><a
href="https://github.com/ekalinin/nodeenv/commit/55df3ce8286a0ca3e0e93fb6a3d02e3602625acc"><code>55df3ce</code></a>
Merge pull request <a
href="https://redirect.github.com/ekalinin/nodeenv/issues/417">#417</a>
from r3wretrhy/fix/zsh-activate-source-guard</li>
<li><a
href="https://github.com/ekalinin/nodeenv/commit/bb15c5c1700c6fc1ed441dd6c5509452392ad255"><code>bb15c5c</code></a>
fix: allow zsh to source bin/activate</li>
<li><a
href="https://github.com/ekalinin/nodeenv/commit/152cd3d524f1e03230b2bec89bb74f01f3bd5489"><code>152cd3d</code></a>
fix(nodeenv): link nodejs.exe without mklink</li>
<li><a
href="https://github.com/ekalinin/nodeenv/commit/d163302c61980de2c73635751565c02d70d688c1"><code>d163302</code></a>
Merge pull request <a
href="https://redirect.github.com/ekalinin/nodeenv/issues/414">#414</a>
from ekalinin/fix/freeze-requirements</li>
<li><a
href="https://github.com/ekalinin/nodeenv/commit/ef5ec3518b23ee3f11165f437441c8cc34bfc15e"><code>ef5ec35</code></a>
fix(nodeenv): read npm's parseable listing in freeze</li>
<li><a
href="https://github.com/ekalinin/nodeenv/commit/b1f0c54bae353ace6574fb9a1bbb895484928521"><code>b1f0c54</code></a>
Merge pull request <a
href="https://redirect.github.com/ekalinin/nodeenv/issues/413">#413</a>
from ekalinin/fix/musl-vendor-detection</li>
<li><a
href="https://github.com/ekalinin/nodeenv/commit/aadf307ecf998718b33cdc5a3789fe40f16802ad"><code>aadf307</code></a>
fix(nodeenv): detect musl regardless of the host triplet vendor</li>
<li>Additional commits viewable in <a
href="https://github.com/ekalinin/nodeenv/compare/1.10.0...1.11.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=nodeenv&package-manager=pip&previous-version=1.10.0&new-version=1.11.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 requirements/constraints.txt | 2 +-
 requirements/dev.txt         | 2 +-
 requirements/lint.txt        | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/requirements/constraints.txt b/requirements/constraints.txt
index 7bad5eb0a8e..3661bc83a1c 100644
--- a/requirements/constraints.txt
+++ b/requirements/constraints.txt
@@ -152,7 +152,7 @@ mypy-extensions==1.1.0
     # via mypy
 myst-parser==4.0.1
     # via -r requirements/doc.in
-nodeenv==1.10.0
+nodeenv==1.11.0
     # via pre-commit
 packaging==26.3
     # via
diff --git a/requirements/dev.txt b/requirements/dev.txt
index eae60f3d183..dbd32b1749c 100644
--- a/requirements/dev.txt
+++ b/requirements/dev.txt
@@ -149,7 +149,7 @@ mypy-extensions==1.1.0
     # via mypy
 myst-parser==4.0.1
     # via -r requirements/doc.in
-nodeenv==1.10.0
+nodeenv==1.11.0
     # via pre-commit
 packaging==26.3
     # via
diff --git a/requirements/lint.txt b/requirements/lint.txt
index ca3d745e35e..c0e9fe50095 100644
--- a/requirements/lint.txt
+++ b/requirements/lint.txt
@@ -80,7 +80,7 @@ mypy==2.1.0 ; implementation_name == "cpython"
     # via -r requirements/lint.in
 mypy-extensions==1.1.0
     # via mypy
-nodeenv==1.10.0
+nodeenv==1.11.0
     # via pre-commit
 packaging==26.3
     # via pytest