Bump virtualenv from 21.7.5 to 21.8.1

[dependabot]

Bumps virtualenv from 21.7.5 to 21.8.1.

Release notes

Sourced from virtualenv's releases.

21.8.1

What's Changed

• 🐛 fix(build): make the SBOM serial number deterministic and validate its structure in CI by @​gaborbernat in pypa/virtualenv#3268

Full Changelog: pypa/virtualenv@21.8.0...21.8.1

21.7.16

What's Changed

• 📝 docs(security): add an incident response plan by @​gaborbernat in pypa/virtualenv#3262
• 📝 docs(security): document both reporting lanes and scope by @​gaborbernat in pypa/virtualenv#3261
• 🐛 fix(activation): escape csh prompt expansion characters by @​gaborbernat in pypa/virtualenv#3263

Full Changelog: pypa/virtualenv@21.7.15...21.7.16

21.7.15

What's Changed

• 🐛 fix(activation): restore empty saved values on deactivate by @​gaborbernat in pypa/virtualenv#3259
• 🐛 fix(activation): make csh deactivate work without test by @​gaborbernat in pypa/virtualenv#3260

Full Changelog: pypa/virtualenv@21.7.14...21.7.15

21.7.14

What's Changed

• 🐛 fix(activation): escape ! for csh history expansion by @​gaborbernat in pypa/virtualenv#3256

Full Changelog: pypa/virtualenv@21.7.13...21.7.14

21.7.13

What's Changed

• 👷 ci: correct a stale checkout pin comment by @​gaborbernat in pypa/virtualenv#3254
• 🔧 chore: drop misc as a changelog fragment type by @​gaborbernat in pypa/virtualenv#3255
• 👷 ci: scope the nushell apt key to its own repo by @​gaborbernat in pypa/virtualenv#3253
• 🐛 fix(activation): stop path command injection in bash and fish by @​gaborbernat in pypa/virtualenv#3252

Full Changelog: pypa/virtualenv@21.7.12...21.7.13

... (truncated)

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.8.1

• Make the embedded SBOM's serialNumber a deterministic UUID derived from the package name, version and bundled wheel hashes, so the same source tree produces a byte-identical SBOM, and validate the SBOM's structure as part of the packaging checks that already run on every pull request. (:issue:3268)

---

v21.8.0 (2026-09-19)

---

Features - 21.8.0

• Every published wheel now carries a CycloneDX <https://cyclonedx.org/>_ SBOM at .dist-info/sboms/virtualenv.cdx.json (:PEP:770), declaring the bundled pip and setuptools wheels that generic SBOM tools cannot see on their own. GitHub attests it against the released sdist and wheel. (:issue:3265)

---

v21.7.16 (2026-09-19)

---

Bugfixes - 21.7.16

• Fix activate.csh rendering the venv's prompt text wrong when it contains ! (csh and tcsh both expand it) or % (tcsh only, since plain csh has no % prompt escape at all). (:issue:3263)

---

v21.7.15 (2026-09-18)

---

Bugfixes - 21.7.15

• Restore an empty PATH on deactivate in the bash and fish activators, and stop bash leaving the prompt in PS1 when it was unset before activation. (:issue:3259)
• Fix activate.csh failing to restore PATH and other saved variables on deactivate when PATH was already empty. (:issue:3260)

---

v21.7.14 (2026-09-18)

---

Bugfixes - 21.7.14

• Fix activate.csh failing with Event not found when the virtual environment path contains !. (:issue:3256)

... (truncated)

Commits

• ab0e25f release 21.8.1
• 1d28796 🐛 fix(build): make the SBOM serial number deterministic and validate its stru...
• a8b7f0a chore(deps): bump astral-sh/setup-uv from 10.0.1 to 10.1.0 in the github-acti...
• da2aacc release 21.8.0
• 3d3537e 🔧 chore(deps): watch pip ecosystem with Dependabot (#3264)
• 777dc41 ✨ feat(build): ship a CycloneDX SBOM in every wheel (#3265)
• 3e95492 ✨ feat(build): publish a third-party notices file (#3266)
• 4c946c2 release 21.7.16
• 630ae10 🐛 fix(activation): escape csh prompt expansion characters (#3263)
• 496e8c9 📝 docs(security): document both reporting lanes and scope (#3261)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #334.