Bump virtualenv from 21.10.0 to 21.11.1

[dependabot]

Bumps virtualenv from 21.10.0 to 21.11.1.

Release notes

Sourced from virtualenv's releases.

21.11.1

What's Changed

• 📝 docs(security): close threat items resolved by 21.11.0 by @​gaborbernat in pypa/virtualenv#3313
• 🐛 fix(build): ship test inputs in the sdist and check it by @​Gonghan-Princess in pypa/virtualenv#3315

New Contributors

• @​Gonghan-Princess made their first contribution in pypa/virtualenv#3315

Full Changelog: pypa/virtualenv@21.11.0...21.11.1

21.11.0

What's Changed

• ci(pre-release): disable the uv cache by @​gaborbernat in pypa/virtualenv#3288
• ci: pass expressions to run scripts via env by @​gaborbernat in pypa/virtualenv#3292
• ci(release): audit egress in build and publish by @​gaborbernat in pypa/virtualenv#3289
• 📝 docs: define maintainer roles and access by @​gaborbernat in pypa/virtualenv#3290
• ci: resolve zizmor auditor findings by @​gaborbernat in pypa/virtualenv#3297
• ci(pre-commit): freeze hook revs to commit SHAs by @​gaborbernat in pypa/virtualenv#3298
• docs: link docs and pyvideo over https by @​gaborbernat in pypa/virtualenv#3300
• docs(development): add a one-year roadmap by @​gaborbernat in pypa/virtualenv#3304
• 🐛 fix(seed): fail closed when PyPI digest is unknown by @​gaborbernat in pypa/virtualenv#3302
• ✨ feat(release): publish SBOMs as release assets by @​gaborbernat in pypa/virtualenv#3299
• docs(security): describe the project under the CRA by @​gaborbernat in pypa/virtualenv#3295
• docs(template): name the trust boundary crossed by @​gaborbernat in pypa/virtualenv#3296
• ♻️ refactor(sbom): type the SPDX renderer by @​gaborbernat in pypa/virtualenv#3307
• ✨ feat(zipapp): publish an SBOM for the zipapp by @​gaborbernat in pypa/virtualenv#3310
• 👷 ci(check): pin test tool downloads and bump them weekly by @​gaborbernat in pypa/virtualenv#3293
• 📝 docs: explain what a release publishes and how to verify it by @​gaborbernat in pypa/virtualenv#3305
• 👷 ci(release): verify the zipapp served by bootstrap.pypa.io by @​gaborbernat in pypa/virtualenv#3309
• 👷 ci(release): mint app tokens instead of a PAT by @​gaborbernat in pypa/virtualenv#3301
• 📝 docs(security): add threat model and assurance case by @​gaborbernat in pypa/virtualenv#3294
• 🐛 fix(zipapp): bundle wheels pinned by a PEP 751 lock by @​gaborbernat in pypa/virtualenv#3306
• 📝 docs(security): sync threat model with merged fixes by @​gaborbernat in pypa/virtualenv#3312
• 🐛 fix(sbom): keep the build machine out of the SBOMs by @​gaborbernat in pypa/virtualenv#3311

Full Changelog: pypa/virtualenv@21.10.0...21.11.0

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.11.1

• Include the pre-commit configuration and the zipapp lock file in the source distribution, so downstream packagers can run the test suite from it. (:issue:3314)

---

v21.11.0 (2026-09-23)

---

Features - 21.11.0

• Attach the CycloneDX SBOM and an SPDX 2.3 rendering of it (virtualenv.cdx.json, virtualenv.spdx.json) to each GitHub release, and attest the SPDX document against the sdist and wheel. (:issue:3299)
• Describe the zipapp in its own CycloneDX SBOM, which lists virtualenv, the embedded pip and setuptools wheels, and each bundled dependency with the Python versions that load it, down to a SHA-256 per file. The SBOM sits at the root of virtualenv.pyz, ships as the virtualenv.pyz.cdx.json release asset, and GitHub attests it against the zipapp. (:issue:3310)

Bugfixes - 21.11.0

• Refuse a seed wheel downloaded from the default index when virtualenv cannot get its sha256 from PyPI after three retries, instead of seeding it unverified. Seeding falls back to the bundled wheel unless a specific version was requested. (:issue:3302)
• Build the zipapp from the dependency wheels that pylock.zipapp.toml pins by URL and sha256, so a release bundles only files matching the committed hashes. (:issue:3306)
• Leave the build machine out of the wheel and zipapp SBOMs, so the wheel rebuilds byte for byte on any operating system and architecture given the same source, SOURCE_DATE_EPOCH, Python patch version and build backend versions. Zipapp entries now carry the SOURCE_DATE_EPOCH timestamp and fixed permissions instead of the build time. (:issue:3311)

Improved Documentation - 21.11.0

• Document the backup maintainer and the two-factor authentication and access review expectations for maintainers. (:issue:3290)
• Link the Carl Meyer talk on the home page over HTTPS - by :user:gaborbernat. (:issue:3300)
• Add a roadmap to the development guide listing what the project plans to do, and not do, through September 2027 - by :user:gaborbernat. (:issue:3304)
• Document what a release publishes and how to verify each file, covering the PyPI attestations, the zipapp and its provenance, the CycloneDX and SPDX SBOMs of the wheel, the zipapp SBOM, and rebuilding the sdist from its tag. (:issue:3305)

---

v21.10.0 (2026-09-22)

---

Commits

• 4c13875 release 21.11.1
• ae073fb 🐛 fix(build): ship test inputs in the sdist and check it (#3315)
• fc912de 📝 docs(security): close threat items resolved by 21.11.0 (#3313)
• 49077e7 release 21.11.0
• 5d9dc58 🐛 fix(sbom): keep the build machine out of the SBOMs (#3311)
• bcb0fa6 📝 docs(security): sync threat model with merged fixes (#3312)
• b80a3bd 🐛 fix(zipapp): bundle wheels pinned by a PEP 751 lock (#3306)
• 29fba39 📝 docs(security): add threat model and assurance case (#3294)
• 4608b9d 👷 ci(release): mint app tokens instead of a PAT (#3301)
• d10b8e8 👷 ci(release): verify the zipapp served by bootstrap.pypa.io (#3309)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

🤖 Claude Code Review

PR Code Review

The diff is a single-line dependency bump in pyproject.toml: virtualenv goes from 21.10.0 to 21.11.1 in the development group.

Code Quality

• ✅ Style: the change matches the existing pinned-version format.
• ✅ No commented-out code.
• ✅ Variable names: not applicable.
• ✅ DRY: not applicable.
• ✅ Defects: none found. This is a dev-only dependency pinned to an exact version, and it doesn't affect the mapper's runtime. I did not check the 21.11.x release notes, so I can't confirm there are no breaking changes. CI will show whether the virtualenv install and linting still work.
• ✅ .claude/CLAUDE.md: it contains nothing specific to a local environment, and the PR doesn't touch it.

Testing

• ✅ Unit and integration tests: not applicable, since no code changed.
• ✅ Edge cases and coverage: unaffected.

Documentation

• ✅ README and API docs: no update needed.
• ❌ CHANGELOG.md: not updated. The recent commits for earlier virtualenv bumps (e.g. Bump virtualenv from 21.7.13 to 21.7.14 #167, Bump virtualenv from 21.7.14 to 21.10.0 #168, Bump pylint from 4.0.8 to 4.0.9 #170) follow the same pattern, so this is probably the project's convention for Dependabot bumps and is acceptable.
• ✅ Markdown: no Markdown files changed.

Security

• ✅ No hardcoded credentials.
• ✅ Input validation and error handling: not applicable.
• ✅ No sensitive data in logs.
• ✅ No license files (.lic) or AQAAAD strings in the diff.

Summary

This is a low-risk Dependabot version bump with no issues found. It is fine to approve once CI passes.

Automated code review analyzing defects and coding standards

[github-actions]

🤖 Claude Code Review

PR Review: Bump virtualenv 21.10.0 → 21.11.1

The only change is a pin bump in the development dependency group of pyproject.toml:46. I reviewed the diff only and did not run anything.

Code Quality

• ✅ Style: The change keeps the existing exact-pin (==) format.
• ✅ No commented-out code: None added.
• ✅ Variable names and DRY: Not applicable.
• ✅ Defects: None found. virtualenv is a dev-only tool used to create environments, so it is not a runtime dependency of the mapper. The bump is a minor version, and I did not check it against the installed Python versions.
• ✅ .claude/CLAUDE.md: It is unchanged, and its content is generic with nothing specific to a local environment.

Testing

• ✅ Unit and integration tests: Not applicable, since no code changed. The existing CI (pylint and the install step) will confirm the new pin resolves.
• ✅ Edge cases and coverage: Not applicable.

Documentation

• ✅ README and API docs: No update needed.
• ⚠️ CHANGELOG.md: It is not updated. That is normal for dev-only dependency bumps from Dependabot, so this is optional unless the project logs them.
• ✅ Markdown: No Markdown files changed.

Security

• ✅ Credentials and sensitive data: None.
• ✅ License files: No .lic files or AQAAAD strings are in the diff.
• ✅ Input validation and error handling: Not applicable.

Summary

This is a safe, low-risk dev-dependency bump with no blocking issues. It is fine to merge once CI passes.

Automated code review analyzing defects and coding standards