Skip to content

build(deps-dev): bump virtualenv from 21.10.0 to 21.11.1 - #250

Merged
docktermj merged 2 commits into
mainfrom
dependabot/pip/virtualenv-21.11.1
Oct 15, 2026
Merged

build(deps-dev): bump virtualenv from 21.10.0 to 21.11.1#250
docktermj merged 2 commits into
mainfrom
dependabot/pip/virtualenv-21.11.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown
Contributor

Bumps virtualenv from 21.10.0 to 21.11.1.

Release notes

Sourced from virtualenv's releases.

21.11.1

What's Changed

New Contributors

Full Changelog: pypa/virtualenv@21.11.0...21.11.1

21.11.0

What's Changed

Full Changelog: pypa/virtualenv@21.10.0...21.11.0

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.11.1

  • Include the pre-commit configuration and the zipapp lock file in the source distribution, so downstream packagers can run the test suite from it. (:issue:3314)

v21.11.0 (2026-09-23)

Features - 21.11.0

  • Attach the CycloneDX SBOM and an SPDX 2.3 rendering of it (virtualenv.cdx.json, virtualenv.spdx.json) to each GitHub release, and attest the SPDX document against the sdist and wheel. (:issue:3299)
  • Describe the zipapp in its own CycloneDX SBOM, which lists virtualenv, the embedded pip and setuptools wheels, and each bundled dependency with the Python versions that load it, down to a SHA-256 per file. The SBOM sits at the root of virtualenv.pyz, ships as the virtualenv.pyz.cdx.json release asset, and GitHub attests it against the zipapp. (:issue:3310)

Bugfixes - 21.11.0

  • Refuse a seed wheel downloaded from the default index when virtualenv cannot get its sha256 from PyPI after three retries, instead of seeding it unverified. Seeding falls back to the bundled wheel unless a specific version was requested. (:issue:3302)
  • Build the zipapp from the dependency wheels that pylock.zipapp.toml pins by URL and sha256, so a release bundles only files matching the committed hashes. (:issue:3306)
  • Leave the build machine out of the wheel and zipapp SBOMs, so the wheel rebuilds byte for byte on any operating system and architecture given the same source, SOURCE_DATE_EPOCH, Python patch version and build backend versions. Zipapp entries now carry the SOURCE_DATE_EPOCH timestamp and fixed permissions instead of the build time. (:issue:3311)

Improved Documentation - 21.11.0

  • Document the backup maintainer and the two-factor authentication and access review expectations for maintainers. (:issue:3290)
  • Link the Carl Meyer talk on the home page over HTTPS - by :user:gaborbernat. (:issue:3300)
  • Add a roadmap to the development guide listing what the project plans to do, and not do, through September 2027 - by :user:gaborbernat. (:issue:3304)
  • Document what a release publishes and how to verify each file, covering the PyPI attestations, the zipapp and its provenance, the CycloneDX and SPDX SBOMs of the wheel, the zipapp SBOM, and rebuilding the sdist from its tag. (:issue:3305)

v21.10.0 (2026-09-22)

Commits
  • 4c13875 release 21.11.1
  • ae073fb 🐛 fix(build): ship test inputs in the sdist and check it (#3315)
  • fc912de 📝 docs(security): close threat items resolved by 21.11.0 (#3313)
  • 49077e7 release 21.11.0
  • 5d9dc58 🐛 fix(sbom): keep the build machine out of the SBOMs (#3311)
  • bcb0fa6 📝 docs(security): sync threat model with merged fixes (#3312)
  • b80a3bd 🐛 fix(zipapp): bundle wheels pinned by a PEP 751 lock (#3306)
  • 29fba39 📝 docs(security): add threat model and assurance case (#3294)
  • 4608b9d 👷 ci(release): mint app tokens instead of a PAT (#3301)
  • d10b8e8 👷 ci(release): verify the zipapp served by bootstrap.pypa.io (#3309)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps-dev): bump virtualenv from 21.10.0 to 21.11.1
043060f 
Bumps [virtualenv](https://github.com/pypa/virtualenv) from 21.10.0 to 21.11.1.
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@21.10.0...21.11.1)

---
updated-dependencies:
- dependency-name: virtualenv
  dependency-version: 21.11.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner October 14, 2026 21:07
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 14, 2026
@github-actions

github-actions Bot commented Oct 14, 2026

Copy link
Copy Markdown

🤖 Claude Code Review

Code Review: bump virtualenv 21.10.0 → 21.11.1

The diff is a single-line dev-dependency bump in pyproject.toml:45.

Code Quality

  • ✅ Style: the pin format matches the other entries, which use exact == pins.
  • ✅ No commented-out code.
  • ✅ Naming: not applicable.
  • ✅ DRY: no duplication.
  • ✅ Defects: I found none. virtualenv is in the development extras only, so it doesn't ship at runtime. I didn't check the 21.11.1 release notes, because there is no network access. It's a minor bump, so a breaking change is unlikely.
  • ✅ .claude/CLAUDE.md: unchanged by this PR. I saw nothing in it that is specific to a local developer environment. It uses generic placeholder paths like /path/to/data and <project_path>.

Testing

  • ✅ No new functions or endpoints, so no new tests are needed.
  • ℹ️ The existing python/tests suite and the Linux CI added in feat(python): add snippet tests and Linux CI #248 will exercise the environment. Confirm CI is green before merging.
  • Coverage isn't affected.

Documentation

  • ✅ README and API docs: no update needed.
  • ℹ️ CHANGELOG.md: dependency bumps from Dependabot have not typically needed an entry. If the project does track them, add one.
  • ✅ No Markdown files changed.

Security

  • ✅ No hardcoded credentials, no input handling changes, no logging changes.
  • ✅ No .lic files or AQAAAD strings in the diff.
  • ℹ️ The untracked files in the working tree (build-resources/, pr_diff.txt, prompt-header.md, prompt-temp.md, review.txt) aren't part of the PR diff. Make sure none of them get committed accidentally.

Verdict

✅ Approve. This is a low-risk, routine dev-dependency update. Merge once CI passes.

Automated code review analyzing defects and coding standards

@github-actions

github-actions Bot commented Oct 15, 2026

Copy link
Copy Markdown

🤖 Claude Code Review

PR Code Review

Change: a Dependabot bump of virtualenv from 21.10.0 to 21.11.1 in the development extras of pyproject.toml.

Code Quality

  • ✅ Style: the change is a one-line version bump and the pinned format matches the surrounding entries.
  • ✅ No commented-out code.
  • ✅ Variable names: not applicable.
  • ✅ DRY: not applicable.
  • ✅ Defects: I found none. virtualenv is a dev-only tool and is not imported by the snippets. The pin is exact, which matches the other entries. I haven't checked the 21.11.1 release notes. The change is limited to dev tooling, so the risk is low.
  • ✅ .claude/CLAUDE.md: not modified. It contains nothing specific to a local environment.

Testing

  • ✅ Unit and integration tests: none needed for a dev-dependency bump. The existing python/tests suite and CI cover it.
  • ✅ Edge cases and coverage: not affected.

Documentation

  • ✅ README and API docs: no update needed.
  • ⚠️ CHANGELOG.md: not updated. Dependabot bumps of dev-only dependencies usually don't need an entry. Check whether this project's convention expects one.
  • ✅ Markdown: no markdown files changed.

Security

  • ✅ No hardcoded credentials.
  • ✅ Input validation and error handling: not applicable.
  • ✅ No sensitive data in logs.
  • ✅ No .lic files or AQAAAD strings in the diff.

The untracked files in the working tree (build-resources/, pr_diff.txt, prompt-header.md, prompt-temp.md, review.txt) are not part of this diff. Make sure none of them are committed, and that build-resources/ contains no license files.

Verdict

✅ Approve. This is a low-risk dev-dependency bump. The only open item is confirming the CHANGELOG convention.

Automated code review analyzing defects and coding standards

@docktermj
docktermj enabled auto-merge (squash) October 15, 2026 02:17
@docktermj
docktermj merged commit 9e07d6a into main Oct 15, 2026
73 checks passed
@docktermj
docktermj deleted the dependabot/pip/virtualenv-21.11.1 branch October 15, 2026 02:21
This was referenced Oct 15, 2026
Merged
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@docktermj docktermj docktermj approved these changes

Assignees

@antaenc antaenc

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@docktermj @antaenc @senzingdevops