From b7ca39e6de4c4fa7956e6dd201b6083fbf4a4e3c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 23 Sep 2026 10:47:43 +0000
Subject: [PATCH] Bump virtualenv from 21.7.16 to 21.9.0 (#13792)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [virtualenv](https://github.com/pypa/virtualenv) from 21.7.16 to
21.9.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/virtualenv/releases">virtualenv's
releases</a>.</em></p>
<blockquote>
<h2>21.9.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>✨ feat(build): add SBOM timestamp and generator metadata by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3269">pypa/virtualenv#3269</a></li>
<li>✨ feat(build): make the embedded SBOM exhaustive by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3270">pypa/virtualenv#3270</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pypa/virtualenv/compare/21.8.1...21.9.0">https://github.com/pypa/virtualenv/compare/21.8.1...21.9.0</a></p>
<h2>21.8.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>🐛 fix(build): make the SBOM serial number deterministic and validate
its structure in CI by <a
href="https://github.com/gaborbernat"><code>@​gaborbernat</code></a> in
<a
href="https://redirect.github.com/pypa/virtualenv/pull/3268">pypa/virtualenv#3268</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pypa/virtualenv/compare/21.8.0...21.8.1">https://github.com/pypa/virtualenv/compare/21.8.0...21.8.1</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst">virtualenv's
changelog</a>.</em></p>
<blockquote>
<h1>Features - 21.9.0</h1>
<ul>
<li>The embedded SBOM now describes the root component's license,
copyright, maintainers and project links, each bundled
wheel from its own metadata, the declared runtime dependencies, and the
full build environment (interpreter, OS and
every distribution in the isolated build environment with the dependency
graph between them), plus the GitHub Actions
run when built there. (:issue:<code>3270</code>)</li>
</ul>
<h1>Bugfixes - 21.9.0</h1>
<ul>
<li>Add <code>metadata.timestamp</code> (derived from
<code>SOURCE_DATE_EPOCH</code> for reproducibility) and
<code>metadata.tools</code> naming the
generator to the embedded SBOM, and validate both fields in the
packaging checks that already run on every pull
request. (:issue:<code>3269</code>)</li>
<li>Fix the embedded SBOM not conforming to the CycloneDX 1.6 schema (an
invalid <code>vendor</code> key on the generator tool
entry) and validate it against the schema in CI.
(:issue:<code>3270</code>)</li>
</ul>
<hr />
<p>v21.8.1 (2026-09-19)</p>
<hr />
<h1>Bugfixes - 21.8.1</h1>
<ul>
<li>Make the embedded SBOM's <code>serialNumber</code> a deterministic
UUID derived from the package name, version and bundled
wheel hashes, so the same source tree produces a byte-identical SBOM,
and validate the SBOM's structure as part of the
packaging checks that already run on every pull request.
(:issue:<code>3268</code>)</li>
</ul>
<hr />
<p>v21.8.0 (2026-09-19)</p>
<hr />
<h1>Features - 21.8.0</h1>
<ul>
<li>Every published wheel now carries a <code>CycloneDX
&lt;https://cyclonedx.org/&gt;</code>_ SBOM at
<code>.dist-info/sboms/virtualenv.cdx.json</code>
(:PEP:<code>770</code>), declaring the bundled <code>pip</code> and
<code>setuptools</code> wheels that
generic SBOM tools cannot see on their own. GitHub attests it against
the released sdist and wheel. (:issue:<code>3265</code>)</li>
</ul>
<hr />
<p>v21.7.16 (2026-09-19)</p>
<hr />
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/virtualenv/commit/1f6750ce69d1c13f784584d20c9fafe0e220f52b"><code>1f6750c</code></a>
release 21.9.0</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/7549b430a8424297f4c3ffd4c007bb28878e00f5"><code>7549b43</code></a>
✨ feat(build): make the embedded SBOM exhaustive (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3270">#3270</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/f4f69f8103eabf45e4af492b9853407573d40d6f"><code>f4f69f8</code></a>
✨ feat(build): add SBOM timestamp and generator metadata (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3269">#3269</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/ab0e25f350e937069ad1e497d1f587044e6c3666"><code>ab0e25f</code></a>
release 21.8.1</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/1d287967f309a9567e9b91490e903fadc973a0d1"><code>1d28796</code></a>
🐛 fix(build): make the SBOM serial number deterministic and validate its
stru...</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/a8b7f0a26fbed698a13f5fed8e2137506b3f9313"><code>a8b7f0a</code></a>
chore(deps): bump astral-sh/setup-uv from 10.0.1 to 10.1.0 in the
github-acti...</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/da2aacc1f1d81310f37134473711112eba4334a1"><code>da2aacc</code></a>
release 21.8.0</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/3d3537eca58c4d3366deb3bbb3a24cdc6a1480e1"><code>3d3537e</code></a>
🔧 chore(deps): watch pip ecosystem with Dependabot (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3264">#3264</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/777dc41cff5ef9b32fb71c9f7a1a844aecd07a70"><code>777dc41</code></a>
✨ feat(build): ship a CycloneDX SBOM in every wheel (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3265">#3265</a>)</li>
<li><a
href="https://github.com/pypa/virtualenv/commit/3e95492a67f7edde0c4717fcce93cb8ba3a0af43"><code>3e95492</code></a>
✨ feat(build): publish a third-party notices file (<a
href="https://redirect.github.com/pypa/virtualenv/issues/3266">#3266</a>)</li>
<li>See full diff in <a
href="https://github.com/pypa/virtualenv/compare/21.7.16...21.9.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=virtualenv&package-manager=pip&previous-version=21.7.16&new-version=21.9.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 requirements/constraints.txt | 2 +-
 requirements/dev.txt         | 2 +-
 requirements/lint.txt        | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/requirements/constraints.txt b/requirements/constraints.txt
index 32403c0a345..2746a93a457 100644
--- a/requirements/constraints.txt
+++ b/requirements/constraints.txt
@@ -336,7 +336,7 @@ uvloop==0.22.1 ; platform_system != "Windows"
     #   -r requirements/lint.in
 valkey==6.1.1
     # via -r requirements/lint.in
-virtualenv==21.7.16
+virtualenv==21.9.0
     # via pre-commit
 wheel==0.48.0
     # via pip-tools
diff --git a/requirements/dev.txt b/requirements/dev.txt
index cc4d81f0e7a..08ca8b9be20 100644
--- a/requirements/dev.txt
+++ b/requirements/dev.txt
@@ -326,7 +326,7 @@ uvloop==0.22.1 ; platform_system != "Windows" and implementation_name == "cpytho
     #   -r requirements/lint.in
 valkey==6.1.1
     # via -r requirements/lint.in
-virtualenv==21.7.16
+virtualenv==21.9.0
     # via pre-commit
 wheel==0.48.0
     # via pip-tools
diff --git a/requirements/lint.txt b/requirements/lint.txt
index be5814911ea..edee3a2af9f 100644
--- a/requirements/lint.txt
+++ b/requirements/lint.txt
@@ -166,7 +166,7 @@ uvloop==0.22.1 ; platform_system != "Windows"
     # via -r requirements/lint.in
 valkey==6.1.1
     # via -r requirements/lint.in
-virtualenv==21.7.16
+virtualenv==21.9.0
     # via pre-commit
 yarl==1.25.1
     # via aiohttp