[dependabot]

Bumps virtualenv from 21.11.1 to 21.13.0.

Release notes

Sourced from virtualenv's releases.

21.13.0

Features - 21.13.0

• Add Changelog and Funding links to the PyPI project metadata, and replace the 2020-202x placeholder in LICENSE with 2020-present so the copyright field of the wheel SBOM reads as a real range - by gaborbernat. (#3334)

Bugfixes - 21.13.0

• Escape the curly single quotes U+2018-U+201B in the PowerShell activator's quote so a virtual environment prompt, name or Tcl/Tk library path containing them can no longer close the string literal and run commands - by gaborbernat. (#3325)
• Stop the bash activator from re-expanding the prompt inside PS1, so a virtual environment name or --prompt value containing $(...), backticks or backslashes no longer runs as a command each time bash draws the prompt - by gaborbernat. (#3326)

Improved Documentation - 21.13.0

• Correct the documented changelog fragment types and example to match the enforced towncrier categories. (#3323)
• List the Unlicense and the SPDX BSD variants in the runtime dependency licensing policy, matching the filelock releases virtualenv installs on Python 3.9, and describe the dependency review check that enforces the policy. (#3329)
• Show how to check a release with gh release verify and gh release verify-asset, and how to rebuild the zipapp byte for byte with the build tool versions its SBOMs list. Drop the claims that the zipapp build does not pin the distributions it bundles and that wheels differ between build machines - by gaborbernat. (#3330)

PyPI release

Full Changelog: pypa/virtualenv@21.12.1...21.13.0

21.12.1

Bugfixes - 21.12.1

• Limit the 832 .venv redirect to folders holding a pyproject.toml and no .venv yet, so virtualenv foo in a scratch folder, and tools such as tox or nox building environments through virtualenv, no longer claim a folder's default environment - by gaborbernat.

  • --venv-redirect writes the redirect in any folder and replaces an earlier virtualenv redirect.
  • A flag on the command line overrides the environment variable and the config file in either direction. (#3316)

PyPI release

Full Changelog: pypa/virtualenv@21.12.0...21.12.1

... (truncated)

Changelog

Sourced from virtualenv's changelog.

Features - 21.13.0

• Add Changelog and Funding links to the PyPI project metadata, and replace the 2020-202x placeholder in LICENSE with 2020-present so the copyright field of the wheel SBOM reads as a real range - by :user:gaborbernat. (:issue:3334)

Bugfixes - 21.13.0

• Escape the curly single quotes U+2018-U+201B in the PowerShell activator's quote so a virtual environment prompt, name or Tcl/Tk library path containing them can no longer close the string literal and run commands - by :user:gaborbernat. (:issue:3325)
• Stop the bash activator from re-expanding the prompt inside PS1, so a virtual environment name or --prompt value containing $(...), backticks or backslashes no longer runs as a command each time bash draws the prompt - by :user:gaborbernat. (:issue:3326)

Improved Documentation - 21.13.0

• Correct the documented changelog fragment types and example to match the enforced towncrier categories. (:issue:3323)
• List the Unlicense and the SPDX BSD variants in the runtime dependency licensing policy, matching the filelock releases virtualenv installs on Python 3.9, and describe the dependency review check that enforces the policy. (:issue:3329)
• Show how to check a release with gh release verify and gh release verify-asset, and how to rebuild the zipapp byte for byte with the build tool versions its SBOMs list. Drop the claims that the zipapp build does not pin the distributions it bundles and that wheels differ between build machines - by :user:gaborbernat. (:issue:3330)

---

v21.12.1 (2026-09-24)

---

Bugfixes - 21.12.1

• Limit the :PEP:832 .venv redirect to folders holding a pyproject.toml and no .venv yet, so virtualenv foo in a scratch folder, and tools such as tox or nox building environments through virtualenv, no longer claim a folder's default environment - by :user:gaborbernat.

  • --venv-redirect writes the redirect in any folder and replaces an earlier virtualenv redirect.
  • A flag on the command line overrides the environment variable and the config file in either direction. (:issue:3316)

---

v21.12.0 (2026-09-24)

---

Features - 21.12.0

... (truncated)

Commits

• 14859e6 release 21.13.0
• c83f49e 👷 ci(deps): review dependency licenses and advisories on pull requests (#3329)
• 9cbed16 👷 ci(upgrade): bump the GraalPy test version weekly (#3332)
• 7e36e66 📝 docs(release): refresh release verification docs (#3330)
• 07dcf29 🔧 build(meta): add Changelog and Funding project URLs (#3334)
• dbf474d 🔧 build(docs): pin Mermaid and bump it weekly (#3333)
• a70c1da 🐛 fix(activation): stop bash re-expanding the prompt in PS1 (#3326)
• ffb86b7 👷 ci(check): gate required checks behind one job (#3328)
• 1ef46f1 👷 ci(codeql): scan the tasks scripts (#3327)
• 876c5ba 🐛 fix(activation): escape PowerShell curly single quotes (#3325)
• Additional commits viewable in compare view

[github-actions]

🤖 Claude Code Review

PR Review: bump virtualenv 21.11.1 → 21.13.0

The diff is a one-line change to the pinned dev dependency in pyproject.toml:45. It is a Dependabot-style bump.

Code Quality

• ✅ Style: the pin format matches the neighbouring entries.
• ✅ No commented-out code.
• ✅ Variable names: not applicable.
• ✅ DRY: no duplication.
• ✅ Defects: virtualenv is only a development dependency, so it doesn't affect the snippets' runtime. I did not check the 21.12 and 21.13 release notes, so I can't rule out behaviour changes. CI will show whether tox or virtualenv usage still works.
• ✅ .claude/CLAUDE.md: not changed in this PR. Its contents are generic and contain no developer-specific paths.

Testing

• ✅ Unit and integration tests, edge cases, coverage: not applicable to a dependency pin change. The existing python/tests suite should be run in CI to confirm nothing broke.

Documentation

• ✅ README and API docs: no update needed.
• ⚠️ CHANGELOG.md: not updated. Dependabot bumps of dev-only tooling usually don't need an entry. If this project logs dependency bumps, add one.
• ✅ Markdown: no markdown files changed.

Security

• ✅ No hardcoded credentials.
• ✅ Input validation and error handling: not applicable.
• ✅ No sensitive data in logs.
• ✅ No license files (.lic) and no AQAAAD strings in the diff.

Summary

This is a low-risk, dev-only version bump with no issues found. I recommend approving once CI passes.

Automated code review analyzing defects and coding standards

[github-actions]

🤖 Claude Code Review

PR Review: bump virtualenv 21.11.1 → 21.13.0

The diff is one line in pyproject.toml:45. It bumps a pinned dev dependency.

Code Quality

• ✅ Style: the pin format matches the neighboring entries.
• ✅ No commented-out code.
• ✅ Variable names: not applicable.
• ✅ DRY: no duplication.
• ✅ Defects: I found none. virtualenv is a development-only dependency, so it never ships at runtime. I didn't check the 21.13.0 changelog, which I couldn't fetch. Skim it for breaking changes, such as dropped Python versions, before merging. CI passing would also confirm the bump is safe.
• ✅ .claude/CLAUDE.md: the diff doesn't touch it. It contains no environment-specific content, only generic paths and placeholders.

Testing

• ✅ No new functions or endpoints, so no new tests are needed.
• ✅ Edge cases: not applicable.
• ⚠️ Coverage: this change doesn't affect it. The existing python/tests suite should be the CI signal.

Documentation

• ✅ README and API docs don't need changes for a dev-dependency bump.
• ✅ Inline comments: none needed.
• ⚠️ CHANGELOG.md: it isn't updated. Dependabot-style dependency bumps usually don't get entries, so this is acceptable if the project's convention is to skip them.
• ✅ Markdown: no markdown files changed.

Security

• ✅ No hardcoded credentials.
• ✅ Input validation: not applicable.
• ✅ Error handling: not applicable.
• ✅ No sensitive data in logs.
• ✅ No .lic files or AQAAAD strings in the diff.
• ℹ️ The git status shows untracked files: build-resources/, pr_diff.txt, prompt-header.md, prompt-temp.md and review.txt. They aren't part of the PR diff. Make sure they aren't committed. Check that build-resources/ holds no license files.

Summary

This is a low-risk automated dependency bump, and I recommend approving it once CI passes.

Automated code review analyzing defects and coding standards