Skip to content

Bump virtualenv from 21.9.0 to 21.11.1 - #201

Merged
docktermj merged 1 commit into
mainfrom
dependabot/pip/virtualenv-21.11.1
Oct 14, 2026
Merged

Bump virtualenv from 21.9.0 to 21.11.1#201
docktermj merged 1 commit into
mainfrom
dependabot/pip/virtualenv-21.11.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps virtualenv from 21.9.0 to 21.11.1.

Release notes

Sourced from virtualenv's releases.

21.11.1

What's Changed

New Contributors

Full Changelog: pypa/virtualenv@21.11.0...21.11.1

21.11.0

What's Changed

Full Changelog: pypa/virtualenv@21.10.0...21.11.0

21.10.0

What's Changed

... (truncated)

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.11.1

  • Include the pre-commit configuration and the zipapp lock file in the source distribution, so downstream packagers can run the test suite from it. (:issue:3314)

v21.11.0 (2026-09-23)

Features - 21.11.0

  • Attach the CycloneDX SBOM and an SPDX 2.3 rendering of it (virtualenv.cdx.json, virtualenv.spdx.json) to each GitHub release, and attest the SPDX document against the sdist and wheel. (:issue:3299)
  • Describe the zipapp in its own CycloneDX SBOM, which lists virtualenv, the embedded pip and setuptools wheels, and each bundled dependency with the Python versions that load it, down to a SHA-256 per file. The SBOM sits at the root of virtualenv.pyz, ships as the virtualenv.pyz.cdx.json release asset, and GitHub attests it against the zipapp. (:issue:3310)

Bugfixes - 21.11.0

  • Refuse a seed wheel downloaded from the default index when virtualenv cannot get its sha256 from PyPI after three retries, instead of seeding it unverified. Seeding falls back to the bundled wheel unless a specific version was requested. (:issue:3302)
  • Build the zipapp from the dependency wheels that pylock.zipapp.toml pins by URL and sha256, so a release bundles only files matching the committed hashes. (:issue:3306)
  • Leave the build machine out of the wheel and zipapp SBOMs, so the wheel rebuilds byte for byte on any operating system and architecture given the same source, SOURCE_DATE_EPOCH, Python patch version and build backend versions. Zipapp entries now carry the SOURCE_DATE_EPOCH timestamp and fixed permissions instead of the build time. (:issue:3311)

Improved Documentation - 21.11.0

  • Document the backup maintainer and the two-factor authentication and access review expectations for maintainers. (:issue:3290)
  • Link the Carl Meyer talk on the home page over HTTPS - by :user:gaborbernat. (:issue:3300)
  • Add a roadmap to the development guide listing what the project plans to do, and not do, through September 2027 - by :user:gaborbernat. (:issue:3304)
  • Document what a release publishes and how to verify each file, covering the PyPI attestations, the zipapp and its provenance, the CycloneDX and SPDX SBOMs of the wheel, the zipapp SBOM, and rebuilding the sdist from its tag. (:issue:3305)

v21.10.0 (2026-09-22)

Features - 21.10.0

... (truncated)

Commits
  • 4c13875 release 21.11.1
  • ae073fb 🐛 fix(build): ship test inputs in the sdist and check it (#3315)
  • fc912de 📝 docs(security): close threat items resolved by 21.11.0 (#3313)
  • 49077e7 release 21.11.0
  • 5d9dc58 🐛 fix(sbom): keep the build machine out of the SBOMs (#3311)
  • bcb0fa6 📝 docs(security): sync threat model with merged fixes (#3312)
  • b80a3bd 🐛 fix(zipapp): bundle wheels pinned by a PEP 751 lock (#3306)
  • 29fba39 📝 docs(security): add threat model and assurance case (#3294)
  • 4608b9d 👷 ci(release): mint app tokens instead of a PAT (#3301)
  • d10b8e8 👷 ci(release): verify the zipapp served by bootstrap.pypa.io (#3309)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 14, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner October 14, 2026 16:21
@github-actions

github-actions Bot commented Oct 14, 2026

Copy link
Copy Markdown

🤖 Claude Code Review

PR Review: Bump virtualenv from 21.9.0 to 21.11.1

Scope: One line changed in pyproject.toml:46. It bumps the pinned virtualenv in the development dependency group. This looks like a Dependabot update.

Code Quality

  • ✅ Style conventions: The pin format "name==version" and the indentation match the neighbouring entries.
  • ✅ No commented-out code: None added.
  • ✅ Meaningful variable names: Not applicable.
  • ✅ DRY: Not applicable.
  • ✅ Defects:
    • It is a patch/minor bump of a dev-only tool, so it doesn't affect the mapper's runtime (src/safegraph-mapper.py).
    • I couldn't check the upstream release notes because there is no network access.
    • The pin is exact (==), so builds stay reproducible.
    • There is no Python-version marker, unlike the pytest entries. That is fine as long as 21.11.1 still supports the project's minimum Python version, so confirm that CI passes on all supported versions.
  • ✅ .claude/CLAUDE.md: Not modified. The existing file has no local-environment-specific content.

Testing

  • ✅ Unit and integration tests: No new code or functions, so none are needed.
  • ✅ Edge cases: Not applicable.
  • ⚠️ Coverage: The diff doesn't change coverage. Rely on the CI run (lint, tests) to confirm the new virtualenv works.

Documentation

Security

  • ✅ Hardcoded credentials: None.
  • ✅ Input validation and error handling: Not applicable.
  • ✅ Sensitive data in logs: None.
  • ✅ License files: No .lic files and no AQAAAD strings in the diff.

Housekeeping note

The working tree has untracked files (build-resources/, pr_diff.txt, prompt-header.md, prompt-temp.md, review.txt). They aren't part of this diff. Make sure they are not committed.

Verdict

✅ Approve. This is a low-risk dev-dependency bump. The only condition is that CI passes.

Automated code review analyzing defects and coding standards

@dependabot
dependabot Bot force-pushed the dependabot/pip/virtualenv-21.11.1 branch from 809bbd8 to eba6b03 Compare October 14, 2026 16:24
@github-actions

github-actions Bot commented Oct 14, 2026

Copy link
Copy Markdown

🤖 Claude Code Review

PR Review: Bump virtualenv from 21.9.0 to 21.11.1

The diff changes one line in pyproject.toml:46. It raises the pinned virtualenv version in the development dependency group.

Code Quality

  • ✅ Style: The pin format matches the neighbouring entries (twine==7.0.0, wheel==0.48.0).
  • ✅ No commented-out code.
  • ✅ Variable names: Not applicable.
  • ✅ DRY: Not applicable.
  • ✅ Defects: I found none. virtualenv is a dev-only tool and isn't imported by src/safegraph-mapper.py, so the mapper's runtime behavior is unaffected. The pin is exact, so the build stays reproducible. I haven't checked the 21.11.1 release notes. CI should confirm that the Python versions the project supports still install and lint cleanly.
  • ✅ CLAUDE.md: It isn't modified in this PR. It contains no local-environment-specific content.

Testing

  • ✅ Unit and integration tests, edge cases: Not applicable to a dependency bump.
  • ⚠️ Coverage: This PR doesn't change coverage. Rely on CI (pylint and the install step) to validate the bump.

Documentation

  • ✅ README and API docs: No update needed.
  • ✅ Inline comments: Not applicable.
  • ⚠️ CHANGELOG.md: It isn't updated. This is acceptable for an automated dev-dependency bump, unless the project's convention is to log these.
  • ✅ Markdown: No Markdown files are changed.

Security

  • ✅ No hardcoded credentials, license files (.lic) or AQAAAD strings.
  • ✅ Input validation, error handling and logging: Not affected.
  • ✅ Supply chain: The version is pinned exactly and the package is a well-known one. Newer virtualenv releases generally carry bug and security fixes.

Housekeeping note

The working tree has untracked files: build-resources/, pr_diff.txt, prompt-header.md, prompt-temp.md and review.txt. They look like review-automation artifacts and aren't part of the diff. Make sure they never get committed.

Verdict

✅ Approve. This is a low-risk, dev-only dependency bump with no code changes, so it can merge once CI passes.

Automated code review analyzing defects and coding standards

@dependabot
Bump virtualenv from 21.9.0 to 21.11.1
f0dda31 
Bumps [virtualenv](https://github.com/pypa/virtualenv) from 21.9.0 to 21.11.1.
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@21.9.0...21.11.1)

---
updated-dependencies:
- dependency-name: virtualenv
  dependency-version: 21.11.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/virtualenv-21.11.1 branch from eba6b03 to f0dda31 Compare October 14, 2026 18:24
@github-actions

github-actions Bot commented Oct 14, 2026

Copy link
Copy Markdown

🤖 Claude Code Review

PR Review: Bump virtualenv 21.9.0 → 21.11.1

The diff is one line in pyproject.toml (line 46). It bumps the pinned virtualenv version in the development dependency group. I reviewed the diff only and did not run the build or tests.

Code Quality

  • ✅ Style conventions: The pin format matches the neighbouring entries.
  • ✅ No commented-out code: None added.
  • ✅ Variable names and DRY: Not applicable to this change.
  • ✅ Defects: None found. The change is a minor-version bump of a dev-only tool, so it does not touch the mapper at runtime. I did not check the virtualenv 21.10 and 21.11 release notes for breaking changes. CI should confirm python -m pip install --group all . still resolves on every supported Python version.
  • ✅ .claude/CLAUDE.md: Not modified. The existing file has no local-environment-specific content.

Testing

  • ✅ Unit and integration tests, edge cases: None needed for a dependency pin.
  • ⚠️ Coverage: No code changed, so coverage is unaffected.

Documentation

  • ✅ README and API docs: No update needed.
  • ⚠️ CHANGELOG.md: Not updated. Dev-dependency bumps usually don't get an entry in this repo, so this is acceptable. Check against the repo's convention if you want to be sure.
  • ✅ Markdown: No Markdown files changed.

Security

  • ✅ Hardcoded credentials and sensitive data in logs: None.
  • ✅ Input validation and error handling: Not applicable.
  • ✅ License files: No .lic files or AQAAAD strings in the diff.
  • ℹ️ Untracked files: git status shows untracked build-resources/, pr_diff.txt, prompt-header.md, prompt-temp.md and review.txt. They are not part of this diff, but make sure they aren't committed.

Verdict

✅ Approve. This is a low-risk dev-dependency bump with no blocking issues. Merge once CI is green.

Automated code review analyzing defects and coding standards

@docktermj
docktermj merged commit 6e4560b into main Oct 14, 2026
12 checks passed
@docktermj
docktermj deleted the dependabot/pip/virtualenv-21.11.1 branch October 14, 2026 18:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@docktermj docktermj docktermj approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@docktermj