Bump virtualenv from 21.7.5 to 21.12.1

[dependabot]

Bumps virtualenv from 21.7.5 to 21.12.1.

Release notes

Sourced from virtualenv's releases.

21.12.1

What's Changed

• 🐛 fix(create): limit .venv redirect to projects by @​gaborbernat in pypa/virtualenv#3316

Full Changelog: pypa/virtualenv@21.12.0...21.12.1

21.12.0

What's Changed

• ✨ feat(create): point a .venv redirect per PEP 832 by @​gaborbernat in pypa/virtualenv#3204

Full Changelog: pypa/virtualenv@21.11.1...21.12.0

21.11.1

What's Changed

• 📝 docs(security): close threat items resolved by 21.11.0 by @​gaborbernat in pypa/virtualenv#3313
• 🐛 fix(build): ship test inputs in the sdist and check it by @​Gonghan-Princess in pypa/virtualenv#3315

New Contributors

• @​Gonghan-Princess made their first contribution in pypa/virtualenv#3315

Full Changelog: pypa/virtualenv@21.11.0...21.11.1

21.11.0

What's Changed

• ci(pre-release): disable the uv cache by @​gaborbernat in pypa/virtualenv#3288
• ci: pass expressions to run scripts via env by @​gaborbernat in pypa/virtualenv#3292
• ci(release): audit egress in build and publish by @​gaborbernat in pypa/virtualenv#3289
• 📝 docs: define maintainer roles and access by @​gaborbernat in pypa/virtualenv#3290
• ci: resolve zizmor auditor findings by @​gaborbernat in pypa/virtualenv#3297
• ci(pre-commit): freeze hook revs to commit SHAs by @​gaborbernat in pypa/virtualenv#3298
• docs: link docs and pyvideo over https by @​gaborbernat in pypa/virtualenv#3300
• docs(development): add a one-year roadmap by @​gaborbernat in pypa/virtualenv#3304
• 🐛 fix(seed): fail closed when PyPI digest is unknown by @​gaborbernat in pypa/virtualenv#3302
• ✨ feat(release): publish SBOMs as release assets by @​gaborbernat in pypa/virtualenv#3299
• docs(security): describe the project under the CRA by @​gaborbernat in pypa/virtualenv#3295
• docs(template): name the trust boundary crossed by @​gaborbernat in pypa/virtualenv#3296
• ♻️ refactor(sbom): type the SPDX renderer by @​gaborbernat in pypa/virtualenv#3307
• ✨ feat(zipapp): publish an SBOM for the zipapp by @​gaborbernat in pypa/virtualenv#3310
• 👷 ci(check): pin test tool downloads and bump them weekly by @​gaborbernat in pypa/virtualenv#3293
• 📝 docs: explain what a release publishes and how to verify it by @​gaborbernat in pypa/virtualenv#3305

... (truncated)

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.12.1

• Limit the :PEP:832 .venv redirect to folders holding a pyproject.toml and no .venv yet, so virtualenv foo in a scratch folder, and tools such as tox or nox building environments through virtualenv, no longer claim a folder's default environment - by :user:gaborbernat.

  • --venv-redirect writes the redirect in any folder and replaces an earlier virtualenv redirect.
  • A flag on the command line overrides the environment variable and the config file in either direction. (:issue:3316)

---

v21.12.0 (2026-09-24)

---

Features - 21.12.0

• Write the PEP 838 <https://peps.python.org/pep-0838/>_ python-version key into pyvenv.cfg, holding the target interpreter's feature release. The new :doc:reference/files page covers it alongside every other file a created environment holds - by :user:konstin. (:issue:3193)

• Point a .venv redirect file in the parent folder at the created environment, per PEP 832 <https://peps.python.org/pep-0832/>_, so editors and type checkers can find it - by :user:gaborbernat.

  • virtualenv leaves a .venv folder alone, and a redirect pointing at an environment it did not create.
  • Pass --no-venv-redirect to opt out.
  • The feature is provisional while PEP 832 is a draft: a minor or patch release may change it in backward incompatible ways to follow the PEP. (:issue:3204)

---

v21.11.1 (2026-09-23)

---

Bugfixes - 21.11.1

• Include the pre-commit configuration and the zipapp lock file in the source distribution, so downstream packagers can run the test suite from it. (:issue:3314)

---

v21.11.0 (2026-09-23)

---

Features - 21.11.0

• Attach the CycloneDX SBOM and an SPDX 2.3 rendering of it (virtualenv.cdx.json, virtualenv.spdx.json) to each GitHub release, and attest the SPDX document against the sdist and wheel. (:issue:3299)
• Describe the zipapp in its own CycloneDX SBOM, which lists virtualenv, the embedded pip and setuptools wheels, and each bundled dependency with the Python versions that load it, down to a SHA-256 per file. The SBOM sits at the root

... (truncated)

Commits

• befec5e release 21.12.1
• 572d159 🐛 fix(create): limit .venv redirect to projects (#3316)
• f19165b release 21.12.0
• 554bc8f ✨ feat(create): point a .venv redirect per PEP 832 (#3204)
• 4c13875 release 21.11.1
• ae073fb 🐛 fix(build): ship test inputs in the sdist and check it (#3315)
• fc912de 📝 docs(security): close threat items resolved by 21.11.0 (#3313)
• 49077e7 release 21.11.0
• 5d9dc58 🐛 fix(sbom): keep the build machine out of the SBOMs (#3311)
• bcb0fa6 📝 docs(security): sync threat model with merged fixes (#3312)
• Additional commits viewable in compare view

[dependabot]

Superseded by #336.