Bump virtualenv from 21.2.1 to 21.2.3

[dependabot]

Bumps virtualenv from 21.2.1 to 21.2.3.

Release notes

Sourced from virtualenv's releases.

21.2.3

Full Changelog: pypa/virtualenv@21.2.2...21.2.3

21.2.2

What's Changed

• bump python-discovery minimum to 1.2.2 by @​rahuldevikar in pypa/virtualenv#3117

Full Changelog: pypa/virtualenv@21.2.1...21.2.2

Changelog

Sourced from virtualenv's changelog.

################# Release History #################

.. towncrier-draft-entries:: [UNRELEASED DRAFT]

.. towncrier release notes start

---

v21.3.1 (2026-05-05)

---

Bugfixes - 21.3.1

• Upgrade embedded wheels:

  • pip to 26.1.1 from 26.1 (:issue:3138)

---

v21.3.0 (2026-04-27)

---

Features - 21.3.0

• Re-introduce xonsh shell activator (activate.xsh) previously removed in 20.7.0, and make the plugin loader prefer virtualenv's built-in entry points so a third-party package cannot override them by registering a duplicate name. (:issue:3003)

Bugfixes - 21.3.0

• Upgrade embedded wheels:

  • pip to 26.1 (:issue:3132)

---

v21.2.4 (2026-04-14)

---

Bugfixes - 21.2.4

• Security hardening: validate each entry of a seed wheel archive before extracting it so a tampered wheel cannot escape the app-data image directory via an absolute path or .. traversal. (:issue:3118)
• Security hardening: verify the SHA-256 of every bundled seed wheel when it is loaded so a corrupted or tampered file on disk fails loud instead of being handed to pip. The hash table is generated alongside BUNDLE_SUPPORT by tasks/upgrade_wheels.py. (:issue:3119)
• Security hardening: validate the distribution name and version specifier passed to pip download when acquiring a

... (truncated)

Commits

• a5fb4a2 release 21.2.3
• 7f91a9a release 21.2.2
• 33348d6 bump python-discovery minimum to 1.2.2 (#3117)
• d73ff7c [pre-commit.ci] pre-commit autoupdate (#3116)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[senzingdevops]

Automated: approving this pull request because it includes a patch update

[github-actions]

🤖 Claude Code Review

Code Review: virtualenv 21.2.1 → 21.2.3 bump

This is a minor dependency version bump in pyproject.toml.

---

Code Quality

• ✅ Style guide: Single-line change in a TOML file, nothing to evaluate beyond formatting.
• ✅ No commented-out code
• ✅ Meaningful variable names: N/A
• ✅ DRY principle: N/A
• ✅ Defects: No logic changes. The bump is from 21.2.1 to 21.2.3, skipping one patch version — consistent with the merge commit history showing an intermediate bump to 21.2.2 was not included here. No issues.
• ✅ CLAUDE.md: No concerns; the project instructions are appropriately general.

Testing

• ✅ Unit/integration tests: No code changes requiring new tests.
• ✅ Coverage: N/A — this is a dev-dependency bump only (virtualenv is in the development group), so it does not affect runtime behavior or test coverage requirements.

Documentation

• ✅ README: No update needed for a dev-dependency bump.
• ✅ API docs: N/A
• ✅ Inline comments: N/A
• ⚠️ CHANGELOG.md: Not included in the diff. Dependency bumps are often omitted from changelogs for dev-only deps, which is acceptable here since virtualenv is a development group dependency and does not affect the published library. Low concern.
• ✅ Markdown formatting: N/A

Security

• ✅ No hardcoded credentials
• ✅ No sensitive data
• ✅ No license files (.lic) or AQAAAD-prefixed strings
• ✅ Dependency safety: virtualenv 21.2.3 is a patch release; no known CVEs associated with this range. Since it is a dev-only dependency, it has no runtime security impact on consumers of mapper-base.

---

Summary: Clean, minimal diff. Approve without changes. The only minor note is that CHANGELOG.md was not updated, but this is low concern for a dev-dependency patch bump.

Automated code review analyzing defects and coding standards