chore(deps): bump virtualenv from 21.2.0 to 21.7.13

[dependabot]

Bumps virtualenv from 21.2.0 to 21.7.13.

Release notes

Sourced from virtualenv's releases.

21.7.13

What's Changed

• 👷 ci: correct a stale checkout pin comment by @​gaborbernat in pypa/virtualenv#3254
• 🔧 chore: drop misc as a changelog fragment type by @​gaborbernat in pypa/virtualenv#3255
• 👷 ci: scope the nushell apt key to its own repo by @​gaborbernat in pypa/virtualenv#3253
• 🐛 fix(activation): stop path command injection in bash and fish by @​gaborbernat in pypa/virtualenv#3252

Full Changelog: pypa/virtualenv@21.7.12...21.7.13

21.7.12

What's Changed

• 🔧 chore(changelog): drop dead CVE-2026-24049 fragment by @​gaborbernat in pypa/virtualenv#3249
• 🐛 fix(activation): escape batch quote() against injection by @​gaborbernat in pypa/virtualenv#3250
• 🐛 fix(seed): verify downloaded wheel digests by @​gaborbernat in pypa/virtualenv#3251

Full Changelog: pypa/virtualenv@21.7.11...21.7.12

21.7.11

What's Changed

• Add OpenSSF Scorecard workflow by @​gaborbernat in pypa/virtualenv#3238
• Document AI-assisted contributions and licensing policy by @​gaborbernat in pypa/virtualenv#3239
• 👷 ci(release): attest and sign release provenance by @​gaborbernat in pypa/virtualenv#3242
• 👷 ci: harden Scorecard-scored checks in CI by @​gaborbernat in pypa/virtualenv#3241
• 🐛 fix(ci): parallelize graalpy tests, recover crashed workers by @​gaborbernat in pypa/virtualenv#3240
• 🐛 fix(ci): mark real-shell activation tests as slow by @​gaborbernat in pypa/virtualenv#3243
• 👷 ci: run macOS jobs on macos-26 by @​gaborbernat in pypa/virtualenv#3244
• 🐛 fix(activation): undo a live activation before activate.bat saves values by @​darrenhuai in pypa/virtualenv#3245
• 🐛 fix(create): keep pyvenv.cfg values on a single line by @​gaborbernat in pypa/virtualenv#3247
• 🔧 chore(test): add opt-in Atheris fuzz harness by @​gaborbernat in pypa/virtualenv#3246
• 📝 docs(readme): add OpenSSF Best Practices badge by @​gaborbernat in pypa/virtualenv#3248

Full Changelog: pypa/virtualenv@21.7.10...21.7.11

21.7.10

What's Changed

• 🔧 chore: check spelling with typos in pre-commit by @​even-even in pypa/virtualenv#3235
• 🐛 fix(activation): keep and restore the user's TCL_LIBRARY and TK_LIBRARY by @​darrenhuai in pypa/virtualenv#3234
• 🐛 fix(create): skip blank and comment lines in pyvenv.cfg by @​r3wretrhy in pypa/virtualenv#3232
• 🐛 fix(activation): restore PKG_CONFIG_PATH that was not set before by @​darrenhuai in pypa/virtualenv#3233

... (truncated)

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.7.13

• Fix activate and activate.fish running commands embedded in the virtual environment path or in the interpreter's Tcl/Tk library paths. (:issue:3252)

---

v21.7.12 (2026-09-18)

---

Bugfixes - 21.7.12

• Fix activate.bat running arbitrary commands from a crafted --prompt, VIRTUALENV_PROMPT, or config file value. (:issue:3250)
• Verify a downloaded seed wheel's sha256 against PyPI before seeding it into a virtual environment, skipped when a custom pip index is configured. (:issue:3251)

---

v21.7.11 (2026-09-17)

---

Bugfixes - 21.7.11

• Running activate.bat again before deactivate no longer makes deactivate leave the environment's PKG_CONFIG_PATH, TCL_LIBRARY and TK_LIBRARY behind, or lose values the user had set before the first activation - by :user:darrenhuai. (:issue:3245)
• Write pyvenv.cfg values on a single line, so a prompt carrying a line boundary can no longer inject configuration. --prompt, the VIRTUALENV_PROMPT environment variable and the config file all set the prompt, and pyvenv.cfg has no escape syntax, so a newline, a carriage return, or any other boundary str.splitlines recognizes, such as U+2028, started a new configuration line. Reading the file back picked up those lines as keys, and since the last value for a key wins, they replaced anything written earlier, including home. (:issue:3247)

Improved Documentation - 21.7.11

• Document the policy for AI-assisted contributions and the licensing rules for dependencies. (:issue:3239)

Misc - 21.7.11

• :issue:3238, :issue:3240, :issue:3241, :issue:3242, :issue:3243, :issue:3244, :issue:3246

---

v21.7.10 (2026-09-15)

---

Bugfixes - 21.7.10

... (truncated)

Commits

• 0c295ff release 21.7.13
• 4d5a105 🐛 fix(activation): stop path command injection in bash and fish (#3252)
• 0525dce 👷 ci: scope the nushell apt key to its own repo (#3253)
• aa8323a 🔧 chore: drop misc as a changelog fragment type (#3255)
• a435477 👷 ci: correct a stale checkout pin comment (#3254)
• 9666b42 release 21.7.12
• a01ed3e 🐛 fix(seed): verify downloaded wheel digests (#3251)
• d721ff1 🐛 fix(activation): escape batch quote() against injection (#3250)
• 087a2ef 🔧 chore(changelog): drop dead CVE-2026-24049 fragment (#3249)
• 73e352a release 21.7.11
• Additional commits viewable in compare view

[claude]

LGTM, a routine uv.lock dependency bump.
What was reviewed: the exclude-newer metadata normalization, the python-discovery version bump (1.2.0 to 1.6.1, dropping its platformdirs dependency), the virtualenv bump (21.2.0 to 21.7.13), and the relaxed exceptiongroup→typing-extensions marker — all mechanical lockfile changes with matching hashes, no application code touched.

Extended reasoning...

The only changed file is uv.lock: a dependabot-driven bump of virtualenv and its transitive python-discovery dependency, plus a normalized exclude-newer timestamp and a loosened version marker on typing-extensions for exceptiongroup. No source, test, or doc files changed; the surface touched is dev/build tooling resolution, not runtime or security-sensitive application code. The version/hash pairs in the diff are internally consistent and the virtualenv release notes describe security fixes, not new risk, so this is a safe, mechanical bump.