Skip to content

build(deps-dev): bump virtualenv from 21.7.14 to 21.10.0 - #249

Merged
docktermj merged 1 commit into
mainfrom
dependabot/pip/virtualenv-21.10.0
Oct 14, 2026
Merged

docktermj merged 1 commit into
mainfrom
dependabot/pip/virtualenv-21.10.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 13, 2026

Copy link
Copy Markdown
Contributor

Bumps virtualenv from 21.7.14 to 21.10.0.

Release notes

Sourced from virtualenv's releases.

21.10.0

What's Changed

Full Changelog: pypa/virtualenv@21.9.1...21.10.0

21.9.1

What's Changed

Full Changelog: pypa/virtualenv@21.9.0...21.9.1

21.9.0

What's Changed

Full Changelog: pypa/virtualenv@21.8.1...21.9.0

21.8.1

What's Changed

Full Changelog: pypa/virtualenv@21.8.0...21.8.1

21.7.16

... (truncated)

Changelog

Sourced from virtualenv's changelog.

Features - 21.10.0

  • Include versioned identities for packages vendored inside seed wheels in the embedded SBOM. (:issue:3281)
  • Allow filelock 4.x on Python 3.10+ by relaxing the upper bound from <4 to <5 - by :user:r3wretrhy. (:issue:3285)

Bugfixes - 21.10.0

  • Skip Windows batch activation scripts when environment or Tcl/Tk paths contain ^ or !, since quoting changes those paths. Other activation scripts remain available. (:issue:3280)

v21.9.1 (2026-09-22)


Bugfixes - 21.9.1

  • Correct SBOM CSV parsing and unresolved dependency relationships, and omit CI run identifiers from reproducible builds. (:issue:3278)

v21.9.0 (2026-09-20)


Features - 21.9.0

  • The embedded SBOM now describes the root component's license, copyright, maintainers and project links, each bundled wheel from its own metadata, the declared runtime dependencies, and the full build environment (interpreter, OS and every distribution in the isolated build environment with the dependency graph between them), plus the GitHub Actions run when built there. (:issue:3270)

Bugfixes - 21.9.0

  • Add metadata.timestamp (derived from SOURCE_DATE_EPOCH for reproducibility) and metadata.tools naming the generator to the embedded SBOM, and validate both fields in the packaging checks that already run on every pull request. (:issue:3269)
  • Fix the embedded SBOM not conforming to the CycloneDX 1.6 schema (an invalid vendor key on the generator tool entry) and validate it against the schema in CI. (:issue:3270)

v21.8.1 (2026-09-19)


Bugfixes - 21.8.1

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [virtualenv](https://github.com/pypa/virtualenv) from 21.7.14 to 21.10.0.
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@21.7.14...21.10.0)

---
updated-dependencies:
- dependency-name: virtualenv
  dependency-version: 21.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner October 13, 2026 22:27
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 13, 2026
@github-actions

Copy link
Copy Markdown

🤖 Claude Code Review

PR Review: bump virtualenv 21.7.14 → 21.10.0

The diff changes one line in pyproject.toml, in the development extras. It is a Dependabot-style dev-dependency bump.

Code Quality

  • ✅ Style: The pin format matches the neighbouring entries (== exact pins, alphabetical order).
  • ✅ Commented-out code: None.
  • ✅ Variable names: Not applicable.
  • ✅ DRY: Not applicable.
  • ✅ Defects: I found no defects. virtualenv is a dev-only tool (tox/venv tooling) and isn't imported by the snippets. I haven't confirmed that 21.10.0 supports every Python version the project's CI matrix covers, so check that CI is green. The jump from 21.7.x to 21.10.0 spans several minor releases.
  • ✅ .claude/CLAUDE.md: Unchanged. It contains no machine-specific content, only generic paths and placeholders.

Testing

  • ✅ Unit and integration tests: No new code, so none are needed. The existing python/tests suite and Linux CI cover this change. Confirm that CI passes on the PR.
  • ✅ Edge cases and coverage: Not applicable.

Documentation

  • ✅ README and API docs: No update needed.
  • ⚠️ CHANGELOG.md: Not updated. This is acceptable for an automated dev-dependency bump, and prior bumps such as build(deps-dev): bump virtualenv from 21.7.13 to 21.7.14 #247 didn't update it either. Add an entry only if the project's convention requires one.
  • ✅ Markdown: No Markdown files were changed.

Security

  • ✅ Credentials: None hardcoded.
  • ✅ Input validation, error handling and logging: Not applicable.
  • ✅ License files: No .lic files and no AQAAAD strings in the diff.

Summary

This is a low-risk dev-dependency bump with no blocking issues. I recommend approving once CI passes. Ideally check the 21.10.0 release notes for any dropped Python versions.

Automated code review analyzing defects and coding standards

@docktermj
docktermj merged commit 7de0970 into main Oct 14, 2026
69 checks passed
@docktermj
docktermj deleted the dependabot/pip/virtualenv-21.10.0 branch October 14, 2026 14:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants