Bump virtualenv from 21.5.1 to 21.9.0 in /.github/workflows

[dependabot]

Bumps virtualenv from 21.5.1 to 21.9.0.

Release notes

Sourced from virtualenv's releases.

21.9.0

What's Changed

• ✨ feat(build): add SBOM timestamp and generator metadata by @​gaborbernat in pypa/virtualenv#3269
• ✨ feat(build): make the embedded SBOM exhaustive by @​gaborbernat in pypa/virtualenv#3270

Full Changelog: pypa/virtualenv@21.8.1...21.9.0

21.8.1

What's Changed

• 🐛 fix(build): make the SBOM serial number deterministic and validate its structure in CI by @​gaborbernat in pypa/virtualenv#3268

Full Changelog: pypa/virtualenv@21.8.0...21.8.1

21.7.16

What's Changed

• 📝 docs(security): add an incident response plan by @​gaborbernat in pypa/virtualenv#3262
• 📝 docs(security): document both reporting lanes and scope by @​gaborbernat in pypa/virtualenv#3261
• 🐛 fix(activation): escape csh prompt expansion characters by @​gaborbernat in pypa/virtualenv#3263

Full Changelog: pypa/virtualenv@21.7.15...21.7.16

21.7.15

What's Changed

• 🐛 fix(activation): restore empty saved values on deactivate by @​gaborbernat in pypa/virtualenv#3259
• 🐛 fix(activation): make csh deactivate work without test by @​gaborbernat in pypa/virtualenv#3260

Full Changelog: pypa/virtualenv@21.7.14...21.7.15

21.7.14

What's Changed

• 🐛 fix(activation): escape ! for csh history expansion by @​gaborbernat in pypa/virtualenv#3256

Full Changelog: pypa/virtualenv@21.7.13...21.7.14

21.7.13

... (truncated)

Changelog

Sourced from virtualenv's changelog.

Features - 21.9.0

• The embedded SBOM now describes the root component's license, copyright, maintainers and project links, each bundled wheel from its own metadata, the declared runtime dependencies, and the full build environment (interpreter, OS and every distribution in the isolated build environment with the dependency graph between them), plus the GitHub Actions run when built there. (:issue:3270)

Bugfixes - 21.9.0

• Add metadata.timestamp (derived from SOURCE_DATE_EPOCH for reproducibility) and metadata.tools naming the generator to the embedded SBOM, and validate both fields in the packaging checks that already run on every pull request. (:issue:3269)
• Fix the embedded SBOM not conforming to the CycloneDX 1.6 schema (an invalid vendor key on the generator tool entry) and validate it against the schema in CI. (:issue:3270)

---

v21.8.1 (2026-09-19)

---

Bugfixes - 21.8.1

• Make the embedded SBOM's serialNumber a deterministic UUID derived from the package name, version and bundled wheel hashes, so the same source tree produces a byte-identical SBOM, and validate the SBOM's structure as part of the packaging checks that already run on every pull request. (:issue:3268)

---

v21.8.0 (2026-09-19)

---

Features - 21.8.0

• Every published wheel now carries a CycloneDX <https://cyclonedx.org/>_ SBOM at .dist-info/sboms/virtualenv.cdx.json (:PEP:770), declaring the bundled pip and setuptools wheels that generic SBOM tools cannot see on their own. GitHub attests it against the released sdist and wheel. (:issue:3265)

---

v21.7.16 (2026-09-19)

---

Bugfixes - 21.7.16

• Fix activate.csh rendering the venv's prompt text wrong when it contains ! (csh and tcsh both expand it) or % (tcsh only, since plain csh has no % prompt escape at all). (:issue:3263)

---

... (truncated)

Commits

• 1f6750c release 21.9.0
• 7549b43 ✨ feat(build): make the embedded SBOM exhaustive (#3270)
• f4f69f8 ✨ feat(build): add SBOM timestamp and generator metadata (#3269)
• ab0e25f release 21.8.1
• 1d28796 🐛 fix(build): make the SBOM serial number deterministic and validate its stru...
• a8b7f0a chore(deps): bump astral-sh/setup-uv from 10.0.1 to 10.1.0 in the github-acti...
• da2aacc release 21.8.0
• 3d3537e 🔧 chore(deps): watch pip ecosystem with Dependabot (#3264)
• 777dc41 ✨ feat(build): ship a CycloneDX SBOM in every wheel (#3265)
• 3e95492 ✨ feat(build): publish a third-party notices file (#3266)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)