[dependabot]

Bumps the pip-dependencies group in /requirements.d with 2 updates: virtualenv and tox.

Updates virtualenv from 21.7.16 to 21.9.0

Release notes

Sourced from virtualenv's releases.

21.9.0

Features - 21.9.0

• The embedded SBOM now describes the root component's license, copyright, maintainers and project links, each bundled wheel from its own metadata, the declared runtime dependencies, and the full build environment (interpreter, OS and every distribution in the isolated build environment with the dependency graph between them), plus the GitHub Actions run when built there. (#3270)

Bugfixes - 21.9.0

• Add metadata.timestamp (derived from SOURCE_DATE_EPOCH for reproducibility) and metadata.tools naming the generator to the embedded SBOM, and validate both fields in the packaging checks that already run on every pull request. (#3269)
• Fix the embedded SBOM not conforming to the CycloneDX 1.6 schema (an invalid vendor key on the generator tool entry) and validate it against the schema in CI. (#3270)

PyPI release

Full Changelog: pypa/virtualenv@21.8.1...21.9.0

21.8.1

Bugfixes - 21.8.1

• Make the embedded SBOM's serialNumber a deterministic UUID derived from the package name, version and bundled wheel hashes, so the same source tree produces a byte-identical SBOM, and validate the SBOM's structure as part of the packaging checks that already run on every pull request. (#3268)

PyPI release

Full Changelog: pypa/virtualenv@21.7.16...21.8.1

Changelog

Sourced from virtualenv's changelog.

Features - 21.9.0

• The embedded SBOM now describes the root component's license, copyright, maintainers and project links, each bundled wheel from its own metadata, the declared runtime dependencies, and the full build environment (interpreter, OS and every distribution in the isolated build environment with the dependency graph between them), plus the GitHub Actions run when built there. (:issue:3270)

Bugfixes - 21.9.0

• Add metadata.timestamp (derived from SOURCE_DATE_EPOCH for reproducibility) and metadata.tools naming the generator to the embedded SBOM, and validate both fields in the packaging checks that already run on every pull request. (:issue:3269)
• Fix the embedded SBOM not conforming to the CycloneDX 1.6 schema (an invalid vendor key on the generator tool entry) and validate it against the schema in CI. (:issue:3270)

---

v21.8.1 (2026-09-19)

---

Bugfixes - 21.8.1

• Make the embedded SBOM's serialNumber a deterministic UUID derived from the package name, version and bundled wheel hashes, so the same source tree produces a byte-identical SBOM, and validate the SBOM's structure as part of the packaging checks that already run on every pull request. (:issue:3268)

---

v21.8.0 (2026-09-19)

---

Features - 21.8.0

• Every published wheel now carries a CycloneDX <https://cyclonedx.org/>_ SBOM at .dist-info/sboms/virtualenv.cdx.json (:PEP:770), declaring the bundled pip and setuptools wheels that generic SBOM tools cannot see on their own. GitHub attests it against the released sdist and wheel. (:issue:3265)

---

v21.7.16 (2026-09-19)

---

Commits

• 1f6750c release 21.9.0
• 7549b43 ✨ feat(build): make the embedded SBOM exhaustive (#3270)
• f4f69f8 ✨ feat(build): add SBOM timestamp and generator metadata (#3269)
• ab0e25f release 21.8.1
• 1d28796 🐛 fix(build): make the SBOM serial number deterministic and validate its stru...
• a8b7f0a chore(deps): bump astral-sh/setup-uv from 10.0.1 to 10.1.0 in the github-acti...
• da2aacc release 21.8.0
• 3d3537e 🔧 chore(deps): watch pip ecosystem with Dependabot (#3264)
• 777dc41 ✨ feat(build): ship a CycloneDX SBOM in every wheel (#3265)
• 3e95492 ✨ feat(build): publish a third-party notices file (#3266)
• See full diff in compare view

Updates tox from 4.61.5 to 4.63.0

Release notes

Sourced from tox's releases.

v4.63.0

Features - 4.63.0

• Plugins and test helpers can use tox.execute.api.FinishedExecuteStatus to report a fixed exit code for a command that already finished or never started - by gaborbernat. (#4080)

Bug fixes - 4.63.0

• Interrupting a parallel run with Ctrl-C no longer loses the log lines about stopping the package environment, which could appear or vanish depending on thread timing - by gaborbernat. (#4079)
• Optional dependencies declared in pyproject.toml under a name that is not normalized, such as Foo_Bar, are now installed when requested as extras = foo-bar while tox installs a package's dependencies - by gaborbernat. (#4080)

PyPI release

Full Changelog: tox-dev/tox@4.62.1...4.63.0

v4.62.1

Bug fixes - 4.62.1

• Clear obsolete markers when unconditional set_env values override conditional entries, including environment files. (#4076)

PyPI release

Full Changelog: tox-dev/tox@4.62.0...4.62.1

v4.62.0

Features - 4.62.0

• Plugins can read a configuration value that may be unset through ConfigSet.get_optional, which verifies the value against its declared type and returns None when it is not set - by gaborbernat. (#4075)

Bug fixes - 4.62.0

• Setting TOX_FACTOR_<label> to an empty value now resolves {factor:<label>} to an empty string instead of being ignored - by gaborbernat. (#4073)

Contributor-facing changes - 4.62.0

• Contributors running the type checks get a clean pass again with the latest ty release, and the checks now cover more: configuration values are read through the type-verified accessors instead of as Any, and every method that overrides a parent is marked with @override - by gaborbernat. (#4075)

... (truncated)

Changelog

Sourced from tox's changelog.

Features - 4.63.0

• Plugins and test helpers can use tox.execute.api.FinishedExecuteStatus to report a fixed exit code for a command that already finished or never started - by :user:gaborbernat. (:issue:4080)

Bug fixes - 4.63.0

• Interrupting a parallel run with Ctrl-C no longer loses the log lines about stopping the package environment, which could appear or vanish depending on thread timing - by :user:gaborbernat. (:issue:4079)
• Optional dependencies declared in pyproject.toml under a name that is not normalized, such as Foo_Bar, are now installed when requested as extras = foo-bar while tox installs a package's dependencies - by :user:gaborbernat. (:issue:4080)

---

v4.62.1 (2026-09-19)

---

Bug fixes - 4.62.1

• Clear obsolete markers when unconditional set_env values override conditional entries, including environment files. (:issue:4076)

---

v4.62.0 (2026-09-19)

---

Features - 4.62.0

• Plugins can read a configuration value that may be unset through ConfigSet.get_optional, which verifies the value against its declared type and returns None when it is not set - by :user:gaborbernat. (:issue:4075)

Bug fixes - 4.62.0

• Setting TOX_FACTOR_<label> to an empty value now resolves {factor:<label>} to an empty string instead of being ignored - by :user:gaborbernat. (:issue:4073)

Contributor-facing changes - 4.62.0

• Contributors running the type checks get a clean pass again with the latest ty release, and the checks now cover more: configuration values are read through the type-verified accessors instead of as Any, and every method that overrides a parent is marked with @override - by :user:gaborbernat. (:issue:4075)

---

v4.61.5 (2026-09-17)

... (truncated)

Commits

• 3d24853 release 4.63.0
• f9d6ff1 🐛 fix(extras): dedupe static extras resolution and other copies (#4080)
• 62a37e5 🐛 fix(run): keep package env interrupt logs in parallel (#4079)
• b2894bd release 4.62.1
• 472ed02 fix(config): clear markers overridden by unconditional set_env values (#4077)
• 2f96e32 test: skip POSIX-venv wheel-build tests on Windows (#4078)
• 99f4421 release 4.62.0
• 176c68f 🐛 fix(config): honor an empty TOX_FACTOR override (#4074)
• e521d6e 🐛 fix(type): pass the latest ty and close Any gaps (#4075)
• See full diff in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
tox	[>= 4.49.dev0, < 4.50]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions