Bump virtualenv from 21.7.12 to 21.7.13

[dependabot]

Bumps virtualenv from 21.7.12 to 21.7.13.

Release notes

Sourced from virtualenv's releases.

21.7.13

What's Changed

• 👷 ci: correct a stale checkout pin comment by @​gaborbernat in pypa/virtualenv#3254
• 🔧 chore: drop misc as a changelog fragment type by @​gaborbernat in pypa/virtualenv#3255
• 👷 ci: scope the nushell apt key to its own repo by @​gaborbernat in pypa/virtualenv#3253
• 🐛 fix(activation): stop path command injection in bash and fish by @​gaborbernat in pypa/virtualenv#3252

Full Changelog: pypa/virtualenv@21.7.12...21.7.13

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.7.13

• Fix activate and activate.fish running commands embedded in the virtual environment path or in the interpreter's Tcl/Tk library paths. (:issue:3252)

---

v21.7.12 (2026-09-18)

---

Commits

• 0c295ff release 21.7.13
• 4d5a105 🐛 fix(activation): stop path command injection in bash and fish (#3252)
• 0525dce 👷 ci: scope the nushell apt key to its own repo (#3253)
• aa8323a 🔧 chore: drop misc as a changelog fragment type (#3255)
• a435477 👷 ci: correct a stale checkout pin comment (#3254)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[senzingdevops]

Automated: approving this pull request because it includes a patch update

[github-actions]

🤖 Claude Code Review

PR Review: Bump virtualenv 21.7.12 → 21.7.13

This PR changes one line in pyproject.toml:46, the pinned virtualenv version in the development dependency group. It's a patch-level bump to a dev-only dependency.

Code Quality

• ✅ Style conventions: The change keeps the existing pinned == format.
• ✅ No commented-out code: None added.
• ✅ Meaningful names: Not applicable.
• ✅ DRY: Not applicable.
• ✅ Defects: I found none. A patch bump of a dev-only tool doesn't affect runtime code. I did not run the CI matrix (Python 3.10–3.13) or check the upstream release notes. Confirm that pylint passes in CI.
• ✅ .claude/CLAUDE.md: Unchanged by this PR. Its content is general and has nothing specific to a local environment.

Testing

• ✅ Unit and integration tests: No new functions or endpoints, so none are needed.
• ✅ Edge cases: Not applicable.
• ✅ Coverage: Unaffected, since no source code changed.

Documentation

• ✅ README and API docs: No update needed.
• ✅ Inline comments: Not applicable.
• ⚠️ CHANGELOG.md: Not updated. This is consistent with the other recent Dependabot bumps (Bump build from 1.6.0 to 1.6.1 #164–Bump coverage from 7.16.0 to 7.16.1 #166), so it's acceptable. If the project changelogs dependency bumps, add an entry.
• ✅ Markdown: No Markdown files changed.

Security

• ✅ No hardcoded credentials: None.
• ✅ Input validation and error handling: Not applicable.
• ✅ No sensitive data in logs: None.
• ✅ License files: No .lic files or AQAAAD strings in the diff.

Other observations

The working tree has untracked files: build-resources/, pr_diff.txt, prompt-header.md, prompt-temp.md and review.txt. They aren't part of the PR diff. They look like review-tooling artifacts, so make sure they aren't committed.

Verdict

✅ Approve. This is a low-risk dev-dependency patch bump with no issues found.

Automated code review analyzing defects and coding standards