Skip to content

Release 2.1.159 (2026-07-23)

Features

  • isolate container venv with anonymous mask over .venv (#2490) Mask the bind-mounted host .venv with a fresh anonymous volume for Python repos so an in-container uv sync builds a throwaway venv at the default path and cannot corrupt the host venv. Structural isolation, gated to Python repos.

Drop the is_dir() guard on vrg-validate's PATH-add so .venv/bin is prepended unconditionally (the mask is empty at startup and populated by the install stage; PATH resolves at exec time). Keep the UV_LINK_MODE=copy pin.

Refactoring

  • retire .venv-host dual-venv model in favor of single .venv (#2491) The dev container now structurally masks .venv with an anonymous volume (#2486/T2), so the host dev tree is safe using a plain .venv and the .venv-host workaround is no longer needed.

  • repo_init render_gitignore: template now ignores .venv/ (closing a gap where consumers' host venv was untracked) instead of .venv-host/

  • validate_common: drop .venv-host from the _find_yaml_files docstring
  • CLAUDE.md: collapse the dual-venv Environment Setup explanation to the single-.venv host model
  • tests updated to match

CI Evidence: All gates passed — full audit bundle available. Download →