Bump virtualenv from 21.3.3 to 21.4.0

[dependabot]

Bumps virtualenv from 21.3.3 to 21.4.0.

Release notes

Sourced from virtualenv's releases.

21.4.0

What's Changed

• Fix Mermaid flowchart rendering by @​Herrtian in pypa/virtualenv#3147
• ♻️ refactor(create): remove dead code and document droppable paths by @​gaborbernat in pypa/virtualenv#3149
• ✨ feat(create): support Windows debug builds and remove dead code by @​gaborbernat in pypa/virtualenv#3150

New Contributors

• @​Herrtian made their first contribution in pypa/virtualenv#3147

Full Changelog: pypa/virtualenv@21.3.3...21.4.0

Changelog

Sourced from virtualenv's changelog.

Features - 21.4.0

• Remove dead code targeting Python versions below the supported target range (PyPy 3.6, deprecated importlib APIs) and simplify the runtime import hook in _virtualenv.py - by :user:gaborbernat. (:issue:3149)
• Support Windows debug builds (python_d.exe, venvlauncher_d.exe) matching CPython venv behavior, remove dead __SCRIPT_DIR__ replacement and has_shim version guard, drop unreachable Python 3.7 branch from pyvenv_launch_patch_active, and fix wheel deprecation message to say >= 3.9 - by :user:gaborbernat. (:issue:3150)

---

v21.3.3 (2026-05-13)

---

Commits

• 30bcf62 release 21.4.0
• 6143498 ✨ feat(create): support Windows debug builds and remove dead code (#3150)
• ceaf88f ♻️ refactor(create): remove dead code and document droppable paths (#3149)
• d423ddc [pre-commit.ci] pre-commit autoupdate (#3148)
• f4a7936 Fix Mermaid flowchart rendering (#3147)
• 7189e8e [pre-commit.ci] pre-commit autoupdate (#3145)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

🤖 Claude Code Review

---

Code Review: virtualenv bump 21.3.3 → 21.4.0

This is a dependency version bump — a Dependabot-style automated update to pyproject.toml.

---

Code Quality

	Item	Result
✅	Code style	Single-line change in pyproject.toml, no style concerns.
✅	No commented-out code	None present.
✅	Meaningful variable names	N/A
✅	DRY principle	N/A
✅	Defects / bugs	No logic change; version bump only. virtualenv 21.4.0 is a legitimate release.
✅	CLAUDE.md	No issues — project instructions are general-purpose and environment-agnostic.

---

Testing

	Item	Result
✅	Unit / integration tests	N/A for a dev-dependency version bump. virtualenv is in the development group and is not imported by application code.
✅	Test coverage	Unchanged.

---

Documentation

	Item	Result
✅	README	No update needed.
✅	API docs	No update needed.
✅	Inline comments	N/A
❌	CHANGELOG.md	The [Unreleased] section was not updated to note the virtualenv bump. The project's CHANGELOG.md uses Keep a Changelog format and appears to be actively maintained. A one-liner under [Unreleased] (e.g., - Bump virtualenv from 21.3.3 to 21.4.0) should be added — pyproject.toml:46.
✅	Markdown formatting	Existing CHANGELOG follows CommonMark; no new Markdown introduced.

---

Security

	Item	Result
✅	No hardcoded credentials	None.
✅	Input validation	N/A
✅	Error handling	N/A
✅	Sensitive data in logs	N/A
✅	License files (.lic / AQAAAD)	None present.

---

Summary

One finding: CHANGELOG.md was not updated. All other checklist items pass. The change itself is safe and routine.

Automated code review analyzing defects and coding standards