Bump virtualenv from 21.12.1 to 21.13.0

[dependabot]

Bumps virtualenv from 21.12.1 to 21.13.0.

Release notes

Sourced from virtualenv's releases.

21.13.0

What's Changed

• 👷 ci(codeql): scan local inputs and guard activation templates by @​gaborbernat in pypa/virtualenv#3317
• 👷 ci(codeql): add regression queries for 21.7 advisories by @​gaborbernat in pypa/virtualenv#3318
• 👷 ci(upgrade): pass base to create-pull-request by @​gaborbernat in pypa/virtualenv#3320
• 👷 ci(upgrade): dispatch CI on the upgrade pull request by @​gaborbernat in pypa/virtualenv#3322
• Upgrade embedded pip/setuptools/wheel and CI test tools by @​github-actions[bot] in pypa/virtualenv#3321
• docs: correct changelog fragment types by @​januththedev in pypa/virtualenv#3324
• 🐛 fix(activation): escape PowerShell curly single quotes by @​gaborbernat in pypa/virtualenv#3325
• 👷 ci(codeql): scan the tasks scripts by @​gaborbernat in pypa/virtualenv#3327
• 👷 ci(check): gate required checks behind one job by @​gaborbernat in pypa/virtualenv#3328
• 🐛 fix(activation): stop bash re-expanding the prompt in PS1 by @​gaborbernat in pypa/virtualenv#3326
• 🔧 build(docs): pin Mermaid and bump it weekly by @​gaborbernat in pypa/virtualenv#3333
• 🔧 build(meta): add Changelog and Funding project URLs by @​gaborbernat in pypa/virtualenv#3334
• 📝 docs(release): refresh release verification docs by @​gaborbernat in pypa/virtualenv#3330
• 👷 ci(upgrade): bump the GraalPy test version weekly by @​gaborbernat in pypa/virtualenv#3332
• 👷 ci(deps): review dependency licenses and advisories on pull requests by @​gaborbernat in pypa/virtualenv#3329

New Contributors

• @​januththedev made their first contribution in pypa/virtualenv#3324

Full Changelog: pypa/virtualenv@21.12.1...21.13.0

Changelog

Sourced from virtualenv's changelog.

Features - 21.13.0

• Add Changelog and Funding links to the PyPI project metadata, and replace the 2020-202x placeholder in LICENSE with 2020-present so the copyright field of the wheel SBOM reads as a real range - by :user:gaborbernat. (:issue:3334)

Bugfixes - 21.13.0

• Escape the curly single quotes U+2018-U+201B in the PowerShell activator's quote so a virtual environment prompt, name or Tcl/Tk library path containing them can no longer close the string literal and run commands - by :user:gaborbernat. (:issue:3325)
• Stop the bash activator from re-expanding the prompt inside PS1, so a virtual environment name or --prompt value containing $(...), backticks or backslashes no longer runs as a command each time bash draws the prompt - by :user:gaborbernat. (:issue:3326)

Improved Documentation - 21.13.0

• Correct the documented changelog fragment types and example to match the enforced towncrier categories. (:issue:3323)
• List the Unlicense and the SPDX BSD variants in the runtime dependency licensing policy, matching the filelock releases virtualenv installs on Python 3.9, and describe the dependency review check that enforces the policy. (:issue:3329)
• Show how to check a release with gh release verify and gh release verify-asset, and how to rebuild the zipapp byte for byte with the build tool versions its SBOMs list. Drop the claims that the zipapp build does not pin the distributions it bundles and that wheels differ between build machines - by :user:gaborbernat. (:issue:3330)

---

v21.12.1 (2026-09-24)

---

Commits

• 14859e6 release 21.13.0
• c83f49e 👷 ci(deps): review dependency licenses and advisories on pull requests (#3329)
• 9cbed16 👷 ci(upgrade): bump the GraalPy test version weekly (#3332)
• 7e36e66 📝 docs(release): refresh release verification docs (#3330)
• 07dcf29 🔧 build(meta): add Changelog and Funding project URLs (#3334)
• dbf474d 🔧 build(docs): pin Mermaid and bump it weekly (#3333)
• a70c1da 🐛 fix(activation): stop bash re-expanding the prompt in PS1 (#3326)
• ffb86b7 👷 ci(check): gate required checks behind one job (#3328)
• 1ef46f1 👷 ci(codeql): scan the tasks scripts (#3327)
• 876c5ba 🐛 fix(activation): escape PowerShell curly single quotes (#3325)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)