[dependabot]

Bumps virtualenv from 21.12.1 to 21.13.0.

Release notes

Sourced from virtualenv's releases.

21.13.0

Features - 21.13.0

• Add Changelog and Funding links to the PyPI project metadata, and replace the 2020-202x placeholder in LICENSE with 2020-present so the copyright field of the wheel SBOM reads as a real range - by gaborbernat. (#3334)

Bugfixes - 21.13.0

• Escape the curly single quotes U+2018-U+201B in the PowerShell activator's quote so a virtual environment prompt, name or Tcl/Tk library path containing them can no longer close the string literal and run commands - by gaborbernat. (#3325)
• Stop the bash activator from re-expanding the prompt inside PS1, so a virtual environment name or --prompt value containing $(...), backticks or backslashes no longer runs as a command each time bash draws the prompt - by gaborbernat. (#3326)

Improved Documentation - 21.13.0

• Correct the documented changelog fragment types and example to match the enforced towncrier categories. (#3323)
• List the Unlicense and the SPDX BSD variants in the runtime dependency licensing policy, matching the filelock releases virtualenv installs on Python 3.9, and describe the dependency review check that enforces the policy. (#3329)
• Show how to check a release with gh release verify and gh release verify-asset, and how to rebuild the zipapp byte for byte with the build tool versions its SBOMs list. Drop the claims that the zipapp build does not pin the distributions it bundles and that wheels differ between build machines - by gaborbernat. (#3330)

PyPI release

Full Changelog: pypa/virtualenv@21.12.1...21.13.0

Changelog

Sourced from virtualenv's changelog.

Features - 21.13.0

• Add Changelog and Funding links to the PyPI project metadata, and replace the 2020-202x placeholder in LICENSE with 2020-present so the copyright field of the wheel SBOM reads as a real range - by :user:gaborbernat. (:issue:3334)

Bugfixes - 21.13.0

• Escape the curly single quotes U+2018-U+201B in the PowerShell activator's quote so a virtual environment prompt, name or Tcl/Tk library path containing them can no longer close the string literal and run commands - by :user:gaborbernat. (:issue:3325)
• Stop the bash activator from re-expanding the prompt inside PS1, so a virtual environment name or --prompt value containing $(...), backticks or backslashes no longer runs as a command each time bash draws the prompt - by :user:gaborbernat. (:issue:3326)

Improved Documentation - 21.13.0

• Correct the documented changelog fragment types and example to match the enforced towncrier categories. (:issue:3323)
• List the Unlicense and the SPDX BSD variants in the runtime dependency licensing policy, matching the filelock releases virtualenv installs on Python 3.9, and describe the dependency review check that enforces the policy. (:issue:3329)
• Show how to check a release with gh release verify and gh release verify-asset, and how to rebuild the zipapp byte for byte with the build tool versions its SBOMs list. Drop the claims that the zipapp build does not pin the distributions it bundles and that wheels differ between build machines - by :user:gaborbernat. (:issue:3330)

---

v21.12.1 (2026-09-24)

---

Commits

• 14859e6 release 21.13.0
• c83f49e 👷 ci(deps): review dependency licenses and advisories on pull requests (#3329)
• 9cbed16 👷 ci(upgrade): bump the GraalPy test version weekly (#3332)
• 7e36e66 📝 docs(release): refresh release verification docs (#3330)
• 07dcf29 🔧 build(meta): add Changelog and Funding project URLs (#3334)
• dbf474d 🔧 build(docs): pin Mermaid and bump it weekly (#3333)
• a70c1da 🐛 fix(activation): stop bash re-expanding the prompt in PS1 (#3326)
• ffb86b7 👷 ci(check): gate required checks behind one job (#3328)
• 1ef46f1 👷 ci(codeql): scan the tasks scripts (#3327)
• 876c5ba 🐛 fix(activation): escape PowerShell curly single quotes (#3325)
• Additional commits viewable in compare view

[github-actions]

🤖 Claude Code Review

PR Review: Bump virtualenv 21.12.1 → 21.13.0

The diff is a one-line dev-dependency bump in pyproject.toml:46.

Code Quality

• ✅ Style conventions: The pin format matches the surrounding entries.
• ✅ No commented-out code.
• ✅ Variable names: Not applicable.
• ✅ DRY: Not applicable.
• ✅ Defects: None found. virtualenv is only in the development group, so it doesn't affect the runtime library. I haven't checked the 21.13.0 release notes. I also haven't confirmed that the Python 3.10–3.13 CI matrix supports it. Let CI confirm that.
• ✅ CLAUDE.md: It isn't changed by this PR. It contains nothing specific to a local environment.

Testing

• ✅ Unit and integration tests: None needed, because no code was added.
• ✅ Edge cases: Not applicable.
• ✅ Coverage: Unchanged.

Documentation

• ✅ README and API docs: No update needed.
• ❌ CHANGELOG.md: Not updated. This is minor. Dependabot bumps of dev-only tooling usually don't get an entry, and earlier virtualenv bumps in the history didn't appear to add one. Add an entry only if the project's convention requires it.
• ✅ Markdown: No Markdown files changed.

Security

• ✅ No hardcoded credentials.
• ✅ Input validation and error handling: Not applicable.
• ✅ No sensitive data in logs.
• ✅ No license files: No .lic files or AQAAAD strings are in the diff.

Summary

This is a low-risk, dev-only dependency bump and I'd approve it once CI passes. The only open item is the CHANGELOG, which is optional.

Automated code review analyzing defects and coding standards

[github-actions]

🤖 Claude Code Review

PR Code Review: Bump virtualenv 21.12.1 → 21.13.0

The diff is a one-line dev-dependency bump in pyproject.toml:46.

Code Quality

• ✅ Style conventions: The change matches the existing pinned-version format.
• ✅ No commented-out code.
• ✅ Variable names: Not applicable.
• ✅ DRY: Not applicable.
• ✅ Defects: None found. virtualenv is only in the development group, so it isn't a runtime dependency of the library. I didn't check the 21.13.0 release notes, because there is no network access. The CI matrix (Python 3.10–3.13) should confirm compatibility.
• ✅ CLAUDE.md: It isn't changed by this PR. Its contents are general and not specific to a local environment.

Testing

• ✅ Unit and integration tests: Not applicable. There is no new code.
• ✅ Edge cases: Not applicable.
• ✅ Coverage: Not affected.

Documentation

• ✅ README and API docs: No update needed.
• ❌ CHANGELOG.md: It isn't updated. This is a minor point. Dependabot bumps of dev-only tooling usually don't get a changelog entry, so follow the repo's convention. The recent commits (Bump virtualenv from 21.11.1 to 21.12.0 #163, Bump virtualenv from 21.12.0 to 21.12.1 #164, Bump coverage from 7.16.1 to 7.16.2 #165) are all bumps like this one, and they appear not to have touched the changelog.
• ✅ Markdown formatting: No Markdown files changed.

Security

• ✅ No hardcoded credentials.
• ✅ Input validation: Not applicable.
• ✅ Error handling: Not applicable.
• ✅ No sensitive data in logs.
• ✅ No license files: No .lic files and no strings starting with AQAAAD in the diff.

Summary

This is a low-risk, dev-only dependency bump, and I recommend approving it once CI passes. The only open item is the optional CHANGELOG entry.

Automated code review analyzing defects and coding standards