deps(deps): update virtualenv requirement from <22.0.0,>=21.7.16 to >=21.12.1,<22.0.0

[dependabot]

Updates the requirements on virtualenv to permit the latest version.

Release notes

Sourced from virtualenv's releases.

21.12.1

What's Changed

• 🐛 fix(create): limit .venv redirect to projects by @​gaborbernat in pypa/virtualenv#3316

Full Changelog: pypa/virtualenv@21.12.0...21.12.1

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.12.1

• Limit the :PEP:832 .venv redirect to folders holding a pyproject.toml and no .venv yet, so virtualenv foo in a scratch folder, and tools such as tox or nox building environments through virtualenv, no longer claim a folder's default environment - by :user:gaborbernat.

  • --venv-redirect writes the redirect in any folder and replaces an earlier virtualenv redirect.
  • A flag on the command line overrides the environment variable and the config file in either direction. (:issue:3316)

---

v21.12.0 (2026-09-24)

---

Features - 21.12.0

• Write the PEP 838 <https://peps.python.org/pep-0838/>_ python-version key into pyvenv.cfg, holding the target interpreter's feature release. The new :doc:reference/files page covers it alongside every other file a created environment holds - by :user:konstin. (:issue:3193)

• Point a .venv redirect file in the parent folder at the created environment, per PEP 832 <https://peps.python.org/pep-0832/>_, so editors and type checkers can find it - by :user:gaborbernat.

  • virtualenv leaves a .venv folder alone, and a redirect pointing at an environment it did not create.
  • Pass --no-venv-redirect to opt out.
  • The feature is provisional while PEP 832 is a draft: a minor or patch release may change it in backward incompatible ways to follow the PEP. (:issue:3204)

---

v21.11.1 (2026-09-23)

---

Bugfixes - 21.11.1

• Include the pre-commit configuration and the zipapp lock file in the source distribution, so downstream packagers can run the test suite from it. (:issue:3314)

---

v21.11.0 (2026-09-23)

---

Features - 21.11.0

• Attach the CycloneDX SBOM and an SPDX 2.3 rendering of it (virtualenv.cdx.json, virtualenv.spdx.json) to each GitHub release, and attest the SPDX document against the sdist and wheel. (:issue:3299)
• Describe the zipapp in its own CycloneDX SBOM, which lists virtualenv, the embedded pip and setuptools wheels, and each bundled dependency with the Python versions that load it, down to a SHA-256 per file. The SBOM sits at the root

... (truncated)

Commits

• befec5e release 21.12.1
• 572d159 🐛 fix(create): limit .venv redirect to projects (#3316)
• f19165b release 21.12.0
• 554bc8f ✨ feat(create): point a .venv redirect per PEP 832 (#3204)
• 4c13875 release 21.11.1
• ae073fb 🐛 fix(build): ship test inputs in the sdist and check it (#3315)
• fc912de 📝 docs(security): close threat items resolved by 21.11.0 (#3313)
• 49077e7 release 21.11.0
• 5d9dc58 🐛 fix(sbom): keep the build machine out of the SBOMs (#3311)
• bcb0fa6 📝 docs(security): sync threat model with merged fixes (#3312)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[strix-security]

Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here.

So far, Strix has reviewed 30 pull requests across this workspace.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!