[connesy]

The new default behavior of venv create is to automatically run pip install --upgrade pip after creating the virtual environment.

This decision was made after GHSA-6q48-6c7w-9gw2, which compromises all versions of pip before 26.2.2. When using e.g. python3.10 -m venv .venv to create a virtual environment, the default behavior is to use the version of pip that ships with the distribution, e.g.:

• python 3.10 -> pip 23.0.1
• python 3.11 -> pip 24.0
• python 3.12 -> pip 24.0
• python 3.13 -> pip 26.2.1

Since these are compromised, the safe behavior is to pass --upgrade-deps when creating the virtual environment, so that is what venv create now does per default.
This can be disabled by passing --no-pip-upgrade, but this is not advised.

[Copilot]

🟡 Changes recommended

The opt-out behavior is inverted, and the identified test and Python-version compatibility issues remain unresolved.

3 open issues

• Fix inverted --no-pip-upgrade behavior · New
• Compare only Python major and minor versions · New
• Test both upgrade flag paths · New

What changed in this PR

This pull request makes pip upgrades the default for venv create and adds a --no-pip-upgrade opt-out, with supporting documentation, shell completions, and test updates.

Changes:

• Adds parsing, help text, and Bash/Zsh completion for --no-pip-upgrade.
• Updates creation, installation, and lock tests for pip upgrades and dependency versions.
• Documents the new default behavior and opt-out flag.

File	Reviewed changes
tests/​test_venv_lock.py	Updates requirement filename construction to use enum values.
tests/​test_venv_lock_cases.py	Updates NumPy dependency fixtures.
tests/​test_venv_install.py	Filters pip upgrade output and updates package test data.
tests/​test_venv_install_cases.py	Updates dependency versions, package data, and parameter naming.
tests/​test_venv_create.py	Adds mocked creation, flag, and help tests. Moderate issue (2 votes): coverage does not verify the new flag semantics or the default upgrade path.
tests/​helpers.py	Selects NumPy versions based on the Python runtime. Moderate issue (4 votes): the sys.version_info comparison incorrectly handles exactly Python 3.10.
src/​venv-cli/​venv.sh	Adds create-option parsing and pip upgrade handling. Critical issue (4 votes): --no-pip-upgrade currently enables --upgrade-deps instead of disabling it; the same issue appears at lines 120, 165, and 166.
src/​venv-cli/​completions/​zsh/​venv_completion.sh	Adds Zsh completion for --no-pip-upgrade.
src/​venv-cli/​completions/​bash/​venv_completion.sh	Adds Bash completion for --no-pip-upgrade.
README.md	Documents automatic pip upgrades and the opt-out flag.

_{Review effort: Lite}

[Copilot]

🟡 Changes recommended

Unresolved issues remain in option handling, environment creation arguments, Python-version selection, and create-command test coverage.

4 open issues

• Avoid passing an empty venv directory argument · New
• Fix inverted --no-pip-upgrade behavior
• Test both upgrade flag paths
• Compare only Python major and minor versions

_{Review effort: Lite}

[Copilot]

🟡 Changes recommended

The implementation has unresolved command semantics, argument handling, and error-status issues that block approval.

4 open issues

• Propagate python -m venv failure status · New
• Avoid passing an empty venv directory argument
• Fix inverted --no-pip-upgrade behavior
• Test both upgrade flag paths

1 resolved since last review

• Compare only Python major and minor versions

_{Review effort: Lite}

[Copilot]

🔵 Needs a closer look

The implementation has three moderate issues in venv.sh, and the creation tests do not verify the flag’s behavior.

4 open issues

• Propagate python -m venv failure status
• Avoid passing an empty venv directory argument
• Fix inverted --no-pip-upgrade behavior
• Test both upgrade flag paths

_{Review effort: Lite}

[Copilot]

🟡 Changes recommended

The create command can pass an unintended empty environment path and can report success when environment creation or pip upgrading fails; the default upgrade and failure paths also need test coverage.

4 open issues

• Unconditional success masks virtual environment creation failures · New
• Propagate python -m venv failure status
• Test both upgrade flag paths
• Tests do not verify default pip upgrade invocation or failure handling · New

2 resolved since last review

• Avoid passing an empty venv directory argument
• Fix inverted --no-pip-upgrade behavior

_{Review effort: Lite}

[Copilot]

🟡 Changes recommended

Preserve venv create failures instead of masking them, and strengthen tests to verify both default and opt-out argument forwarding.

2 open issues

• Preserve venv creation failures instead of returning success · New
• Test both upgrade flag paths

3 resolved since last review

• Unconditional success masks virtual environment creation failures
• Propagate python -m venv failure status
• Tests do not verify default pip upgrade invocation or failure handling

_{Review effort: Lite}

[Copilot]

🟡 Changes recommended

The tests do not adequately verify the default upgrade behavior or that --no-pip-upgrade suppresses it.

2 open issues

• Test both upgrade flag paths
• Tests do not exercise venv upgrade behavior or failure propagation · New

1 resolved since last review

• Preserve venv creation failures instead of returning success

_{Review effort: Lite}

[Copilot]

🔵 Needs a closer look

Tests do not verify the new default upgrade behavior or its failure and forwarding paths.

2 open issues

• Test both upgrade flag paths
• Tests do not exercise venv upgrade behavior or failure propagation

_{Review effort: Lite}