Bump virtualenv from 21.2.1 to 21.2.3

[dependabot]

Bumps virtualenv from 21.2.1 to 21.2.3.

Release notes

Sourced from virtualenv's releases.

21.2.3

Full Changelog: pypa/virtualenv@21.2.2...21.2.3

21.2.2

What's Changed

• bump python-discovery minimum to 1.2.2 by @​rahuldevikar in pypa/virtualenv#3117

Full Changelog: pypa/virtualenv@21.2.1...21.2.2

Changelog

Sourced from virtualenv's changelog.

################# Release History #################

.. towncrier-draft-entries:: [UNRELEASED DRAFT]

.. towncrier release notes start

---

v21.3.1 (2026-05-05)

---

Bugfixes - 21.3.1

• Upgrade embedded wheels:

  • pip to 26.1.1 from 26.1 (:issue:3138)

---

v21.3.0 (2026-04-27)

---

Features - 21.3.0

• Re-introduce xonsh shell activator (activate.xsh) previously removed in 20.7.0, and make the plugin loader prefer virtualenv's built-in entry points so a third-party package cannot override them by registering a duplicate name. (:issue:3003)

Bugfixes - 21.3.0

• Upgrade embedded wheels:

  • pip to 26.1 (:issue:3132)

---

v21.2.4 (2026-04-14)

---

Bugfixes - 21.2.4

• Security hardening: validate each entry of a seed wheel archive before extracting it so a tampered wheel cannot escape the app-data image directory via an absolute path or .. traversal. (:issue:3118)
• Security hardening: verify the SHA-256 of every bundled seed wheel when it is loaded so a corrupted or tampered file on disk fails loud instead of being handed to pip. The hash table is generated alongside BUNDLE_SUPPORT by tasks/upgrade_wheels.py. (:issue:3119)
• Security hardening: validate the distribution name and version specifier passed to pip download when acquiring a

... (truncated)

Commits

• a5fb4a2 release 21.2.3
• 7f91a9a release 21.2.2
• 33348d6 bump python-discovery minimum to 1.2.2 (#3117)
• d73ff7c [pre-commit.ci] pre-commit autoupdate (#3116)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[senzingdevops]

Automated: approving this pull request because it includes a patch update

[github-actions]

🤖 Claude Code Review

Code Review

PR Summary: Bumps virtualenv from 21.2.1 to 21.2.3 in pyproject.toml (development dependency).

---

Code Quality

• ✅ Style guide — Single-line change in a TOML config file; no style concerns.
• ✅ No commented-out code — N/A.
• ✅ Meaningful variable names — N/A.
• ✅ DRY principle — N/A.
• ✅ Defects / bugs / security — Dependency version bump only. virtualenv 21.2.3 is a patch release; no known regressions or vulnerabilities introduced.

Testing

• ✅ Unit/integration tests — No new logic; no tests required for a dependency bump.
• ✅ Test coverage — N/A.

Documentation

• ✅ README / API docs — No changes needed for a dev-dependency bump.
• ✅ CHANGELOG.md — Not updated, but this is a bot-generated dependency bump (Dependabot/Renovate pattern); omitting a changelog entry is acceptable per typical project conventions for automated bumps.
• ✅ Markdown formatting — No markdown changes.

Security

• ✅ No hardcoded credentials — N/A.
• ✅ No license files (.lic / AQAAAD) — None present.
• ✅ Input validation / error handling — N/A.

---

Summary

This is a clean, low-risk patch version bump for a development-only dependency. Approved with no issues.

Automated code review analyzing defects and coding standards