[dependabot]

Bumps virtualenv from 21.12.1 to 21.13.0.

Release notes

Sourced from virtualenv's releases.

21.13.0

Features - 21.13.0

• Add Changelog and Funding links to the PyPI project metadata, and replace the 2020-202x placeholder in LICENSE with 2020-present so the copyright field of the wheel SBOM reads as a real range - by gaborbernat. (#3334)

Bugfixes - 21.13.0

• Escape the curly single quotes U+2018-U+201B in the PowerShell activator's quote so a virtual environment prompt, name or Tcl/Tk library path containing them can no longer close the string literal and run commands - by gaborbernat. (#3325)
• Stop the bash activator from re-expanding the prompt inside PS1, so a virtual environment name or --prompt value containing $(...), backticks or backslashes no longer runs as a command each time bash draws the prompt - by gaborbernat. (#3326)

Improved Documentation - 21.13.0

• Correct the documented changelog fragment types and example to match the enforced towncrier categories. (#3323)
• List the Unlicense and the SPDX BSD variants in the runtime dependency licensing policy, matching the filelock releases virtualenv installs on Python 3.9, and describe the dependency review check that enforces the policy. (#3329)
• Show how to check a release with gh release verify and gh release verify-asset, and how to rebuild the zipapp byte for byte with the build tool versions its SBOMs list. Drop the claims that the zipapp build does not pin the distributions it bundles and that wheels differ between build machines - by gaborbernat. (#3330)

PyPI release

Full Changelog: pypa/virtualenv@21.12.1...21.13.0

Changelog

Sourced from virtualenv's changelog.

Features - 21.13.0

• Add Changelog and Funding links to the PyPI project metadata, and replace the 2020-202x placeholder in LICENSE with 2020-present so the copyright field of the wheel SBOM reads as a real range - by :user:gaborbernat. (:issue:3334)

Bugfixes - 21.13.0

• Escape the curly single quotes U+2018-U+201B in the PowerShell activator's quote so a virtual environment prompt, name or Tcl/Tk library path containing them can no longer close the string literal and run commands - by :user:gaborbernat. (:issue:3325)
• Stop the bash activator from re-expanding the prompt inside PS1, so a virtual environment name or --prompt value containing $(...), backticks or backslashes no longer runs as a command each time bash draws the prompt - by :user:gaborbernat. (:issue:3326)

Improved Documentation - 21.13.0

• Correct the documented changelog fragment types and example to match the enforced towncrier categories. (:issue:3323)
• List the Unlicense and the SPDX BSD variants in the runtime dependency licensing policy, matching the filelock releases virtualenv installs on Python 3.9, and describe the dependency review check that enforces the policy. (:issue:3329)
• Show how to check a release with gh release verify and gh release verify-asset, and how to rebuild the zipapp byte for byte with the build tool versions its SBOMs list. Drop the claims that the zipapp build does not pin the distributions it bundles and that wheels differ between build machines - by :user:gaborbernat. (:issue:3330)

---

v21.12.1 (2026-09-24)

---

Commits

• 14859e6 release 21.13.0
• c83f49e 👷 ci(deps): review dependency licenses and advisories on pull requests (#3329)
• 9cbed16 👷 ci(upgrade): bump the GraalPy test version weekly (#3332)
• 7e36e66 📝 docs(release): refresh release verification docs (#3330)
• 07dcf29 🔧 build(meta): add Changelog and Funding project URLs (#3334)
• dbf474d 🔧 build(docs): pin Mermaid and bump it weekly (#3333)
• a70c1da 🐛 fix(activation): stop bash re-expanding the prompt in PS1 (#3326)
• ffb86b7 👷 ci(check): gate required checks behind one job (#3328)
• 1ef46f1 👷 ci(codeql): scan the tasks scripts (#3327)
• 876c5ba 🐛 fix(activation): escape PowerShell curly single quotes (#3325)
• Additional commits viewable in compare view

[github-actions]

🤖 Claude Code Review

PR review: bump virtualenv 21.12.1 → 21.13.0

The diff is one line in pyproject.toml:46. It updates the pinned virtualenv in the development dependency group.

Code Quality

• ✅ Style: The pin format matches the neighbouring entries.
• ✅ No commented-out code.
• ✅ Naming and DRY: Not applicable to this change.
• ✅ Defects: I found none. virtualenv is a development-only tool and isn't imported by src/dnb_mapper.py, so runtime behaviour is unaffected. I didn't check whether 21.13.0 raises its minimum supported Python version, so confirm that CI passes on the full Python matrix. The file already has version-conditional pins for pytest.
• ✅ .claude/CLAUDE.md: It is not part of this diff. Its contents are generic, with no local-environment specifics.

Testing

• ✅ Unit and integration tests, edge cases, coverage: None of these are needed for a dev-tool version bump. CI (lint and the existing tests) is the right check.

Documentation

• ✅ README and API docs: No update needed.
• ⚠️ CHANGELOG.md: It isn't updated. This matches the previous Dependabot bumps (Bump virtualenv from 21.10.0 to 21.11.1 #171–Bump virtualenv from 21.12.0 to 21.12.1 #173), and dev-only dependency bumps usually don't need an entry. Add one only if the project's convention requires it.
• ✅ Markdown: No Markdown files changed.

Security

• ✅ No hardcoded credentials, no sensitive data in logs, no license files (.lic or AQAAAD strings) in the diff.
• ✅ Input validation and error handling: Not applicable.
• ✅ Supply chain: The version is pinned exactly, and the bump comes from Dependabot. The build-resources/, pr_diff.txt, prompt-*.md and review.txt files in the working tree are untracked and not part of the PR.

Verdict

✅ Approve. This is a low-risk, dev-only dependency bump, and I have no blocking concerns.

Automated code review analyzing defects and coding standards

[github-actions]

🤖 Claude Code Review

PR Code Review

This PR changes one line. It bumps the dev dependency virtualenv from 21.12.1 to 21.13.0 in pyproject.toml:46.

Code Quality

• ✅ Style conventions: The line matches the format of the surrounding pinned entries.
• ✅ No commented-out code.
• ✅ Meaningful variable names: Not applicable.
• ✅ DRY: Not applicable.
• ✅ Defects: None found. virtualenv is only in the development group and isn't a runtime dependency of the mapper. It is pinned exactly, like the other entries. I didn't check the 21.13.0 release notes, because network access is disabled.
• ✅ .claude/CLAUDE.md: It isn't changed in this PR. Its contents are generic, with no local-environment specifics.

Testing

• ✅ Unit and integration tests, edge cases, coverage: Not applicable to a dev-tooling version bump. The CI lint and test runs on the PR will show whether anything breaks.

Documentation

• ✅ README and API docs: No update needed.
• ⚠️ CHANGELOG.md: It isn't updated. This is consistent with earlier automated dependency bumps such as Bump virtualenv from 21.11.1 to 21.12.0 #172, Bump virtualenv from 21.12.0 to 21.12.1 #173 and Bump coverage from 7.16.1 to 7.16.2 #175. A changelog entry is optional for dev-only bumps.
• ✅ Markdown: No Markdown files changed.

Security

• ✅ No hardcoded credentials.
• ✅ Input validation, error handling, logging: Not applicable.
• ✅ No license files: No .lic files or AQAAAD strings in the diff.

Summary

This is a low-risk, dev-only dependency bump, and I recommend approving it. The only open point is the optional CHANGELOG entry.

Automated code review analyzing defects and coding standards