Skip to content

Bump virtualenv from 21.10.0 to 21.11.1 - #162

Merged
docktermj merged 3 commits into
mainfrom
dependabot/pip/virtualenv-21.11.1
Oct 15, 2026
Merged

Bump virtualenv from 21.10.0 to 21.11.1#162
docktermj merged 3 commits into
mainfrom
dependabot/pip/virtualenv-21.11.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown
Contributor

Bumps virtualenv from 21.10.0 to 21.11.1.

Release notes

Sourced from virtualenv's releases.

21.11.1

What's Changed

New Contributors

Full Changelog: pypa/virtualenv@21.11.0...21.11.1

21.11.0

What's Changed

Full Changelog: pypa/virtualenv@21.10.0...21.11.0

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.11.1

  • Include the pre-commit configuration and the zipapp lock file in the source distribution, so downstream packagers can run the test suite from it. (:issue:3314)

v21.11.0 (2026-09-23)

Features - 21.11.0

  • Attach the CycloneDX SBOM and an SPDX 2.3 rendering of it (virtualenv.cdx.json, virtualenv.spdx.json) to each GitHub release, and attest the SPDX document against the sdist and wheel. (:issue:3299)
  • Describe the zipapp in its own CycloneDX SBOM, which lists virtualenv, the embedded pip and setuptools wheels, and each bundled dependency with the Python versions that load it, down to a SHA-256 per file. The SBOM sits at the root of virtualenv.pyz, ships as the virtualenv.pyz.cdx.json release asset, and GitHub attests it against the zipapp. (:issue:3310)

Bugfixes - 21.11.0

  • Refuse a seed wheel downloaded from the default index when virtualenv cannot get its sha256 from PyPI after three retries, instead of seeding it unverified. Seeding falls back to the bundled wheel unless a specific version was requested. (:issue:3302)
  • Build the zipapp from the dependency wheels that pylock.zipapp.toml pins by URL and sha256, so a release bundles only files matching the committed hashes. (:issue:3306)
  • Leave the build machine out of the wheel and zipapp SBOMs, so the wheel rebuilds byte for byte on any operating system and architecture given the same source, SOURCE_DATE_EPOCH, Python patch version and build backend versions. Zipapp entries now carry the SOURCE_DATE_EPOCH timestamp and fixed permissions instead of the build time. (:issue:3311)

Improved Documentation - 21.11.0

  • Document the backup maintainer and the two-factor authentication and access review expectations for maintainers. (:issue:3290)
  • Link the Carl Meyer talk on the home page over HTTPS - by :user:gaborbernat. (:issue:3300)
  • Add a roadmap to the development guide listing what the project plans to do, and not do, through September 2027 - by :user:gaborbernat. (:issue:3304)
  • Document what a release publishes and how to verify each file, covering the PyPI attestations, the zipapp and its provenance, the CycloneDX and SPDX SBOMs of the wheel, the zipapp SBOM, and rebuilding the sdist from its tag. (:issue:3305)

v21.10.0 (2026-09-22)

Commits
  • 4c13875 release 21.11.1
  • ae073fb 🐛 fix(build): ship test inputs in the sdist and check it (#3315)
  • fc912de 📝 docs(security): close threat items resolved by 21.11.0 (#3313)
  • 49077e7 release 21.11.0
  • 5d9dc58 🐛 fix(sbom): keep the build machine out of the SBOMs (#3311)
  • bcb0fa6 📝 docs(security): sync threat model with merged fixes (#3312)
  • b80a3bd 🐛 fix(zipapp): bundle wheels pinned by a PEP 751 lock (#3306)
  • 29fba39 📝 docs(security): add threat model and assurance case (#3294)
  • 4608b9d 👷 ci(release): mint app tokens instead of a PAT (#3301)
  • d10b8e8 👷 ci(release): verify the zipapp served by bootstrap.pypa.io (#3309)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump virtualenv from 21.10.0 to 21.11.1
a89c02b 
Bumps [virtualenv](https://github.com/pypa/virtualenv) from 21.10.0 to 21.11.1.
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@21.10.0...21.11.1)

---
updated-dependencies:
- dependency-name: virtualenv
  dependency-version: 21.11.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner October 14, 2026 21:29
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 14, 2026
@github-actions

github-actions Bot commented Oct 14, 2026

Copy link
Copy Markdown

🤖 Claude Code Review

Code Review

The diff is a single dependency bump in pyproject.toml:46: virtualenv 21.10.0 → 21.11.1, in the development group. I did not run the tests or check the release notes for 21.11.1.

Code Quality

  • ✅ Style: the change is a pinned-version edit that matches the surrounding entries.
  • ✅ No commented-out code.
  • ✅ Variable names: not applicable.
  • ✅ DRY: no duplication.
  • ✅ Defects: none expected. virtualenv is a dev-only tool and is not imported by the library at runtime. The exact pin matches the repo's convention. I did not check that 21.11.1 supports Python 3.10–3.13.
  • ✅ .claude/CLAUDE.md is generic. It has no local-environment-specific content, and this PR doesn't touch it.

Testing

  • ✅ No new functions or endpoints, so no new tests are needed.
  • ✅ Edge cases: not applicable.
  • ⚠️ Coverage: this PR doesn't change it. CI should confirm the install still works on Python 3.10–3.13.

Documentation

  • ✅ README and API docs: no update needed for a dev-dependency bump.
  • ⚠️ CHANGELOG.md: not updated. Previous Dependabot bumps of this kind don't appear to update it either, so this is acceptable. If the project's convention is to log dependency bumps, add an entry.
  • ✅ Markdown: no Markdown files changed.

Security

  • ✅ No hardcoded credentials.
  • ✅ Input validation: not applicable.
  • ✅ Error handling: not applicable.
  • ✅ No sensitive data in logs.
  • ✅ No .lic files or AQAAAD strings in the diff.

Summary

This is a low-risk, automated dev-dependency bump with no issues found. I recommend approving it once CI passes.

Automated code review analyzing defects and coding standards

@github-actions

github-actions Bot commented Oct 15, 2026

Copy link
Copy Markdown

🤖 Claude Code Review

PR Review: Bump virtualenv 21.10.0 → 21.11.1

The diff is one line in pyproject.toml:46. It updates the pinned virtualenv version in the development dependency group. I did not run tests or check the CHANGELOG in the repo. The findings below come from the diff alone.

Code Quality

  • ✅ Style conventions: The pin format matches the other entries in the group.
  • ✅ No commented-out code
  • ✅ Variable names / DRY: Not applicable.
  • ✅ Defects: I see none. This is a patch-level bump of a dev-only tool and doesn't touch runtime code. The pin is exact (==), so builds stay reproducible. virtualenv is in the development group only, so it isn't a runtime dependency of the library.
  • ✅ .claude/CLAUDE.md: Not changed by this PR. The existing content is general and has no developer-specific paths.

Testing

  • ✅ Unit and integration tests: Not applicable. No code changed.
  • ✅ Edge cases and coverage: Not applicable. Confirm that CI passes on Python 3.10–3.13 with the new version. virtualenv 21.x may drop support for older interpreters, and the diff can't tell me whether it does.

Documentation

  • ✅ README and API docs: No update needed.
  • ⚠️ CHANGELOG.md: Not updated. Dependabot bumps of dev-only tools usually don't need an entry. If this project's convention is to log dependency bumps, add one.
  • ✅ Markdown: No Markdown files changed.

Security

  • ✅ No hardcoded credentials
  • ✅ Input validation and error handling: Not applicable.
  • ✅ No sensitive data in logs
  • ✅ No license files: There are no .lic files and no strings starting with AQAAAD in the diff.

Summary

This is safe to merge once CI is green. It's a low-risk, dev-only dependency bump with no findings.

Automated code review analyzing defects and coding standards

@docktermj
docktermj enabled auto-merge (squash) October 15, 2026 02:17
@github-actions

github-actions Bot commented Oct 15, 2026

Copy link
Copy Markdown

🤖 Claude Code Review

PR Code Review: Bump virtualenv 21.10.0 → 21.11.1

The PR changes one line, in pyproject.toml:46. It raises the pinned virtualenv in the development dependency group from 21.10.0 to 21.11.1.

Code Quality

  • ✅ Style conventions: The pin format matches the neighbouring entries.
  • ✅ No commented-out code: None added.
  • ✅ Variable names, DRY: Not applicable to a version pin.
  • ✅ Defects: virtualenv is a dev-only tool and is not imported by src/base_mapper.py. This is a minor bump, so runtime behaviour is unaffected. The package supports Python 3.10 to 3.13, and I'm not aware of anything in this release that drops those versions. The CI matrix should still confirm that.
  • ✅ .claude/CLAUDE.md: Not modified. Its content is generic, with no local-environment specifics.

Testing

  • ✅ Unit and integration tests: None needed, since no code changed.
  • ✅ Edge cases and coverage: Unchanged by this PR. CI across Python 3.10 to 3.13 is the real check that the new pin installs cleanly.

Documentation

  • ✅ README and API docs: No update needed.
  • ⚠️ CHANGELOG.md: Not updated. For a dependabot dev-dependency bump this is usually acceptable. If the project's convention is to log every dependency change, add a line under [Unreleased].
  • ✅ Markdown formatting: No Markdown files changed.

Security

  • ✅ No hardcoded credentials: None.
  • ✅ No license files: No .lic files and no strings starting with AQAAAD.
  • ✅ Input validation, error handling, logging: Not applicable.
  • ✅ Supply chain: The version is pinned exactly, which is good practice. It is a routine bump of a well-known package.

Summary

This is a low-risk, approvable change. Before merging, confirm the CI matrix passes and optionally add a CHANGELOG entry, depending on project convention.

Automated code review analyzing defects and coding standards

@docktermj
docktermj merged commit 5e7e7ef into main Oct 15, 2026
14 checks passed
@docktermj
docktermj deleted the dependabot/pip/virtualenv-21.11.1 branch October 15, 2026 02:21
This was referenced Oct 15, 2026
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@docktermj docktermj docktermj approved these changes

Assignees

@kernelsam kernelsam

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@docktermj @kernelsam