Bump virtualenv from 21.2.1 to 21.2.3

[dependabot]

Bumps virtualenv from 21.2.1 to 21.2.3.

Release notes

Sourced from virtualenv's releases.

21.2.3

Full Changelog: pypa/virtualenv@21.2.2...21.2.3

21.2.2

What's Changed

• bump python-discovery minimum to 1.2.2 by @​rahuldevikar in pypa/virtualenv#3117

Full Changelog: pypa/virtualenv@21.2.1...21.2.2

Changelog

Sourced from virtualenv's changelog.

################# Release History #################

.. towncrier-draft-entries:: [UNRELEASED DRAFT]

.. towncrier release notes start

---

v21.3.1 (2026-05-05)

---

Bugfixes - 21.3.1

• Upgrade embedded wheels:

  • pip to 26.1.1 from 26.1 (:issue:3138)

---

v21.3.0 (2026-04-27)

---

Features - 21.3.0

• Re-introduce xonsh shell activator (activate.xsh) previously removed in 20.7.0, and make the plugin loader prefer virtualenv's built-in entry points so a third-party package cannot override them by registering a duplicate name. (:issue:3003)

Bugfixes - 21.3.0

• Upgrade embedded wheels:

  • pip to 26.1 (:issue:3132)

---

v21.2.4 (2026-04-14)

---

Bugfixes - 21.2.4

• Security hardening: validate each entry of a seed wheel archive before extracting it so a tampered wheel cannot escape the app-data image directory via an absolute path or .. traversal. (:issue:3118)
• Security hardening: verify the SHA-256 of every bundled seed wheel when it is loaded so a corrupted or tampered file on disk fails loud instead of being handed to pip. The hash table is generated alongside BUNDLE_SUPPORT by tasks/upgrade_wheels.py. (:issue:3119)
• Security hardening: validate the distribution name and version specifier passed to pip download when acquiring a

... (truncated)

Commits

• a5fb4a2 release 21.2.3
• 7f91a9a release 21.2.2
• 33348d6 bump python-discovery minimum to 1.2.2 (#3117)
• d73ff7c [pre-commit.ci] pre-commit autoupdate (#3116)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[senzingdevops]

Automated: approving this pull request because it includes a patch update

[github-actions]

🤖 Claude Code Review

Code Review

PR Summary: Bumps virtualenv from 21.2.1 to 21.2.3 in pyproject.toml (development dependencies).

---

Code Quality

• ✅ Style guide: Single-line change in pyproject.toml, no style concerns.
• ✅ No commented-out code
• ✅ Meaningful variable names: N/A
• ✅ DRY principle: N/A
• ✅ Defects: No logic changes; straightforward version pin update. No bugs or security issues introduced.
• ✅ CLAUDE.md: No issues — this is a dev dependency bump, consistent with the project's use of virtualenv for environment setup.

Testing

• ✅ Unit/integration tests: N/A — no functional code changed.
• ✅ Coverage: N/A

Documentation

• ✅ README/API docs: No update needed for a dev dependency bump.
• ⚠️ CHANGELOG.md: Not updated. For automated dependency bumps this is typically acceptable, but worth confirming if this project tracks dependency updates in the changelog.
• ✅ Markdown formatting: N/A

Security

• ✅ No hardcoded credentials
• ✅ No sensitive data
• ✅ No license files (.lic) or AQAAAD-prefixed strings
• ✅ virtualenv 21.2.3 — this is a patch/minor bump likely containing bug fixes or security patches; upgrading is the correct action.

---

Verdict: Approve. This is a routine automated dependency bump with no functional changes. The only minor note is the missing CHANGELOG entry, which is typical for automated dependency PRs and not a blocker.

Automated code review analyzing defects and coding standards