[dependabot]

Bumps virtualenv from 21.7.10 to 21.7.13.

Release notes

Sourced from virtualenv's releases.

21.7.13

What's Changed

• 👷 ci: correct a stale checkout pin comment by @​gaborbernat in pypa/virtualenv#3254
• 🔧 chore: drop misc as a changelog fragment type by @​gaborbernat in pypa/virtualenv#3255
• 👷 ci: scope the nushell apt key to its own repo by @​gaborbernat in pypa/virtualenv#3253
• 🐛 fix(activation): stop path command injection in bash and fish by @​gaborbernat in pypa/virtualenv#3252

Full Changelog: pypa/virtualenv@21.7.12...21.7.13

21.7.12

What's Changed

• 🔧 chore(changelog): drop dead CVE-2026-24049 fragment by @​gaborbernat in pypa/virtualenv#3249
• 🐛 fix(activation): escape batch quote() against injection by @​gaborbernat in pypa/virtualenv#3250
• 🐛 fix(seed): verify downloaded wheel digests by @​gaborbernat in pypa/virtualenv#3251

Full Changelog: pypa/virtualenv@21.7.11...21.7.12

21.7.11

What's Changed

• Add OpenSSF Scorecard workflow by @​gaborbernat in pypa/virtualenv#3238
• Document AI-assisted contributions and licensing policy by @​gaborbernat in pypa/virtualenv#3239
• 👷 ci(release): attest and sign release provenance by @​gaborbernat in pypa/virtualenv#3242
• 👷 ci: harden Scorecard-scored checks in CI by @​gaborbernat in pypa/virtualenv#3241
• 🐛 fix(ci): parallelize graalpy tests, recover crashed workers by @​gaborbernat in pypa/virtualenv#3240
• 🐛 fix(ci): mark real-shell activation tests as slow by @​gaborbernat in pypa/virtualenv#3243
• 👷 ci: run macOS jobs on macos-26 by @​gaborbernat in pypa/virtualenv#3244
• 🐛 fix(activation): undo a live activation before activate.bat saves values by @​darrenhuai in pypa/virtualenv#3245
• 🐛 fix(create): keep pyvenv.cfg values on a single line by @​gaborbernat in pypa/virtualenv#3247
• 🔧 chore(test): add opt-in Atheris fuzz harness by @​gaborbernat in pypa/virtualenv#3246
• 📝 docs(readme): add OpenSSF Best Practices badge by @​gaborbernat in pypa/virtualenv#3248

Full Changelog: pypa/virtualenv@21.7.10...21.7.11

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.7.13

• Fix activate and activate.fish running commands embedded in the virtual environment path or in the interpreter's Tcl/Tk library paths. (:issue:3252)

---

v21.7.12 (2026-09-18)

---

Bugfixes - 21.7.12

• Fix activate.bat running arbitrary commands from a crafted --prompt, VIRTUALENV_PROMPT, or config file value. (:issue:3250)
• Verify a downloaded seed wheel's sha256 against PyPI before seeding it into a virtual environment, skipped when a custom pip index is configured. (:issue:3251)

---

v21.7.11 (2026-09-17)

---

Bugfixes - 21.7.11

• Running activate.bat again before deactivate no longer makes deactivate leave the environment's PKG_CONFIG_PATH, TCL_LIBRARY and TK_LIBRARY behind, or lose values the user had set before the first activation - by :user:darrenhuai. (:issue:3245)
• Write pyvenv.cfg values on a single line, so a prompt carrying a line boundary can no longer inject configuration. --prompt, the VIRTUALENV_PROMPT environment variable and the config file all set the prompt, and pyvenv.cfg has no escape syntax, so a newline, a carriage return, or any other boundary str.splitlines recognizes, such as U+2028, started a new configuration line. Reading the file back picked up those lines as keys, and since the last value for a key wins, they replaced anything written earlier, including home. (:issue:3247)

Improved Documentation - 21.7.11

• Document the policy for AI-assisted contributions and the licensing rules for dependencies. (:issue:3239)

Misc - 21.7.11

• :issue:3238, :issue:3240, :issue:3241, :issue:3242, :issue:3243, :issue:3244, :issue:3246

---

v21.7.10 (2026-09-15)

---

Commits

• 0c295ff release 21.7.13
• 4d5a105 🐛 fix(activation): stop path command injection in bash and fish (#3252)
• 0525dce 👷 ci: scope the nushell apt key to its own repo (#3253)
• aa8323a 🔧 chore: drop misc as a changelog fragment type (#3255)
• a435477 👷 ci: correct a stale checkout pin comment (#3254)
• 9666b42 release 21.7.12
• a01ed3e 🐛 fix(seed): verify downloaded wheel digests (#3251)
• d721ff1 🐛 fix(activation): escape batch quote() against injection (#3250)
• 087a2ef 🔧 chore(changelog): drop dead CVE-2026-24049 fragment (#3249)
• 73e352a release 21.7.11
• Additional commits viewable in compare view

[senzingdevops]

Automated: approving this pull request because it includes a patch update

[github-actions]

🤖 Claude Code Review

Code Review: bump virtualenv 21.7.8 → 21.7.13

The diff is a one-line dev-dependency bump in pyproject.toml:45. I didn't open any files or run any tools. This review rests on the diff alone.

Code Quality

• ✅ Style conventions: The change matches the surrounding pinned-version format.
• ✅ No commented-out code: None added.
• ✅ Variable names: Not applicable.
• ✅ DRY: Not applicable.
• ✅ Defects: This is a patch-level bump of a dev-only dependency (development extras). It doesn't affect runtime snippets. I did not check the upstream changelog for 21.7.9–21.7.13. The bump is pinned exactly (==), so builds are reproducible.
• ✅ .claude/CLAUDE.md: The diff doesn't touch it. From the version in the prompt, it has no local-environment-specific content. Its example paths are generic placeholders.

Testing

• ✅ Unit and integration tests, edge cases, coverage: Not applicable. There is no code change. CI should confirm the dev environment still installs.

Documentation

• ✅ README and API docs: No update needed.
• ⚠️ CHANGELOG.md: Not updated. This is acceptable for automated dependency bumps, as the earlier Dependabot-style commits suggest. Check whether the project's convention requires an entry for dev-dependency changes.
• ✅ Markdown: No Markdown files changed.

Security

• ✅ No hardcoded credentials, no sensitive data in logs: None are present in the diff.
• ✅ Input validation and error handling: Not applicable.
• ✅ License files: The diff contains no .lic files and no AQAAAD strings.

Summary

The change is low risk and ready to merge once CI passes. The only open point is whether the project's CHANGELOG convention covers dev-dependency bumps.

Automated code review analyzing defects and coding standards

[senzingdevops]

Automated: approving this pull request because it includes a patch update

[github-actions]

🤖 Claude Code Review

Review: bump virtualenv 21.7.10 → 21.7.13

This is a Dependabot-style patch bump of one dev dependency. The only change is pyproject.toml:45, in the development extras group.

Code Quality

• ✅ Style conventions: The change matches the surrounding pinned-version entries.
• ✅ No commented-out code: None added.
• ✅ Meaningful variable names: Not applicable.
• ✅ DRY: Not applicable.
• ✅ Defects: None found. The change is a patch-level bump of a dev-only tool, so it doesn't affect the runtime SDK snippets. The pin stays exact (==), which is consistent with the other entries.
• ✅ .claude/CLAUDE.md: Not modified. The existing file has no local-environment-specific content.

Testing

• ✅ Unit and integration tests: Not applicable. There are no new functions or endpoints.
• ✅ Edge cases and coverage: Not applicable. CI should confirm the dev environment still installs and the lint and test jobs pass.

Documentation

• ✅ README and API docs: No updates needed.
• ⚠️ CHANGELOG.md: It isn't updated. This is acceptable for a dev-dependency bump, since the repo's recent similar bumps (build(deps-dev): bump virtualenv from 21.7.8 to 21.7.10 #246, build(deps-dev): bump org.codehaus.mojo:build-helper-maven-plugin from 3.6.1 to 3.6.2 in /java #244, build(deps-dev): bump org.apache.maven.plugins:maven-compiler-plugin from 3.15.0 to 3.16.0 in /java #237) are routine. Confirm that is the project's convention.
• ✅ Markdown: No Markdown files changed.

Security

• ✅ Hardcoded credentials: None.
• ✅ Input validation and error handling: Not applicable.
• ✅ Sensitive data in logs: None.
• ✅ License files: No .lic files and no AQAAAD strings in the diff.

Notes

• The untracked files in the working tree (build-resources/, pr_diff.txt, prompt-header.md, prompt-temp.md, review.txt) are not part of the diff. Make sure they don't get committed.

Verdict: ✅ Approve. This is a low-risk, dev-only version bump.

Automated code review analyzing defects and coding standards

[github-actions]

🤖 Claude Code Review

Review: bump virtualenv 21.7.10 → 21.7.13

The diff changes one line in pyproject.toml:45, a dev-only dependency bump.

Code Quality

• ✅ Style: the pin format matches the other entries.
• ✅ No commented-out code.
• ✅ Variable names: not applicable.
• ✅ DRY: not applicable.
• ✅ Defects: none found. virtualenv is a development tool and isn't part of the runtime code.
• ✅ .claude/CLAUDE.md: not modified, and it has no environment-specific content.

Testing

• ✅ No new functions or endpoints, so no new tests are needed. The existing CI should confirm the bump installs.

Documentation

• ✅ README and API docs: no update needed.
• ⚠️ CHANGELOG.md: I didn't see an update. Dependabot bumps of dev-only dependencies usually don't need one.
• ✅ No Markdown files changed.

Security

• ✅ No hardcoded credentials, sensitive logging, or license files (.lic or AQAAAD strings) in the diff.
• ✅ The version is pinned exactly, which keeps builds reproducible.

Overall: this is a safe patch-level dev dependency bump, and I found no issues.

Automated code review analyzing defects and coding standards

[senzingdevops]

Automated: approving this pull request because it includes a patch update

[senzingdevops]

Automated: approving this pull request because it includes a patch update

[github-actions]

🤖 Claude Code Review

PR Review: bump virtualenv 21.7.10 → 21.7.13

This is a dev-dependency patch bump in pyproject.toml:45. The development extra is the only thing it changes.

Code Quality

• ✅ Style: The pin format matches the neighbouring entries.
• ✅ No commented-out code.
• ✅ Variable names, DRY: Not applicable.
• ✅ Defects: I see no risk. It is a patch release of a dev-only tool and doesn't touch runtime code. I did not check the 21.7.11–21.7.13 release notes, since there is no network access. CI should confirm that the dev tooling still works.
• ✅ .claude/CLAUDE.md: The PR doesn't change it, and it has no local-environment-specific content. The paths in it are placeholders.

Testing

• ✅ Unit and integration tests, edge cases: Not applicable, because there is no new code.
• ⚠️ Coverage: The PR doesn't change it. Rely on the existing CI run.

Documentation

• ✅ README and API docs: No update needed.
• ✅ Inline comments: Not applicable.
• ⚠️ CHANGELOG.md: Not updated. Dev-only dependency bumps like this one usually don't need an entry, and the earlier bumps in the log (build(deps-dev): bump build from 1.6.0 to 1.6.1 #242, build(deps-dev): bump coverage from 7.16.0 to 7.16.1 #243, build(deps-dev): bump virtualenv from 21.7.8 to 21.7.10 #246) were handled the same way.
• ✅ Markdown: The PR changes no Markdown files.

Security

• ✅ No hardcoded credentials, no sensitive data in logs.
• ✅ Input validation and error handling: Not applicable.
• ✅ No .lic files or AQAAAD strings appear in the diff.

Summary

✅ Approve. There are no blocking issues, and it can be merged once CI passes.

Automated code review analyzing defects and coding standards