Bump virtualenv from 21.7.14 to 21.9.0

[dependabot]

Bumps virtualenv from 21.7.14 to 21.9.0.

Release notes

Sourced from virtualenv's releases.

21.9.0

What's Changed

• ✨ feat(build): add SBOM timestamp and generator metadata by @​gaborbernat in pypa/virtualenv#3269
• ✨ feat(build): make the embedded SBOM exhaustive by @​gaborbernat in pypa/virtualenv#3270

Full Changelog: pypa/virtualenv@21.8.1...21.9.0

21.8.1

What's Changed

• 🐛 fix(build): make the SBOM serial number deterministic and validate its structure in CI by @​gaborbernat in pypa/virtualenv#3268

Full Changelog: pypa/virtualenv@21.8.0...21.8.1

21.7.16

What's Changed

• 📝 docs(security): add an incident response plan by @​gaborbernat in pypa/virtualenv#3262
• 📝 docs(security): document both reporting lanes and scope by @​gaborbernat in pypa/virtualenv#3261
• 🐛 fix(activation): escape csh prompt expansion characters by @​gaborbernat in pypa/virtualenv#3263

Full Changelog: pypa/virtualenv@21.7.15...21.7.16

21.7.15

What's Changed

• 🐛 fix(activation): restore empty saved values on deactivate by @​gaborbernat in pypa/virtualenv#3259
• 🐛 fix(activation): make csh deactivate work without test by @​gaborbernat in pypa/virtualenv#3260

Full Changelog: pypa/virtualenv@21.7.14...21.7.15

Changelog

Sourced from virtualenv's changelog.

Features - 21.9.0

• The embedded SBOM now describes the root component's license, copyright, maintainers and project links, each bundled wheel from its own metadata, the declared runtime dependencies, and the full build environment (interpreter, OS and every distribution in the isolated build environment with the dependency graph between them), plus the GitHub Actions run when built there. (:issue:3270)

Bugfixes - 21.9.0

• Add metadata.timestamp (derived from SOURCE_DATE_EPOCH for reproducibility) and metadata.tools naming the generator to the embedded SBOM, and validate both fields in the packaging checks that already run on every pull request. (:issue:3269)
• Fix the embedded SBOM not conforming to the CycloneDX 1.6 schema (an invalid vendor key on the generator tool entry) and validate it against the schema in CI. (:issue:3270)

---

v21.8.1 (2026-09-19)

---

Bugfixes - 21.8.1

• Make the embedded SBOM's serialNumber a deterministic UUID derived from the package name, version and bundled wheel hashes, so the same source tree produces a byte-identical SBOM, and validate the SBOM's structure as part of the packaging checks that already run on every pull request. (:issue:3268)

---

v21.8.0 (2026-09-19)

---

Features - 21.8.0

• Every published wheel now carries a CycloneDX <https://cyclonedx.org/>_ SBOM at .dist-info/sboms/virtualenv.cdx.json (:PEP:770), declaring the bundled pip and setuptools wheels that generic SBOM tools cannot see on their own. GitHub attests it against the released sdist and wheel. (:issue:3265)

---

v21.7.16 (2026-09-19)

---

Bugfixes - 21.7.16

• Fix activate.csh rendering the venv's prompt text wrong when it contains ! (csh and tcsh both expand it) or % (tcsh only, since plain csh has no % prompt escape at all). (:issue:3263)

---

... (truncated)

Commits

• 1f6750c release 21.9.0
• 7549b43 ✨ feat(build): make the embedded SBOM exhaustive (#3270)
• f4f69f8 ✨ feat(build): add SBOM timestamp and generator metadata (#3269)
• ab0e25f release 21.8.1
• 1d28796 🐛 fix(build): make the SBOM serial number deterministic and validate its stru...
• a8b7f0a chore(deps): bump astral-sh/setup-uv from 10.0.1 to 10.1.0 in the github-acti...
• da2aacc release 21.8.0
• 3d3537e 🔧 chore(deps): watch pip ecosystem with Dependabot (#3264)
• 777dc41 ✨ feat(build): ship a CycloneDX SBOM in every wheel (#3265)
• 3e95492 ✨ feat(build): publish a third-party notices file (#3266)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

🤖 Claude Code Review

PR Review: Bump virtualenv 21.7.14 → 21.9.0

This PR changes one line in pyproject.toml:46. It bumps the pinned virtualenv version in the development dependency group.

Code Quality

• ✅ Style conventions: The pin format matches the other entries (== exact pin, alphabetical order).
• ✅ No commented-out code.
• ✅ Variable names: Not applicable.
• ✅ DRY: Not applicable.
• ✅ Defects: None found. virtualenv is a dev-only tool and is not imported by src/safegraph-mapper.py. A minor version bump (21.7 → 21.9) has no effect on mapper runtime behavior. I could not check network resources, so I did not confirm that 21.9.0 exists on PyPI. CI installing the dependencies will confirm it.
• ✅ .claude/CLAUDE.md: Not modified. It has no environment-specific content.

Testing

• ✅ Unit and integration tests, edge cases: Not applicable to a dev-dependency bump.
• ⚠️ Coverage: This PR does not change coverage. Rely on the CI run to confirm the install and lint steps still pass with the new version.

Documentation

• ✅ README and API docs: No update needed.
• ⚠️ CHANGELOG.md: Not updated. Dependabot bumps of dev-only dependencies are usually exempt, and recent commits (Bump virtualenv from 21.7.9 to 21.7.13 #196, Bump coverage from 7.16.0 to 7.16.1 #197, Bump virtualenv from 21.7.13 to 21.7.14 #198) follow the same pattern.
• ✅ Markdown: No Markdown files changed.

Security

• ✅ No hardcoded credentials.
• ✅ Input validation and error handling: Not applicable.
• ✅ No sensitive data in logs.
• ✅ No license files: There are no .lic files and no AQAAAD strings in the diff.

Summary

Approve. This is a low-risk, dev-only dependency bump with no code, test, or documentation impact. The only thing to confirm is that CI passes.

Automated code review analyzing defects and coding standards