Bump virtualenv to 21.14.5 to fix 4 Dependabot alerts

[dknowles2]

Why no automatic PRs

virtualenv is a transitive dev dependency (pulled in by pre-commit), so it appeared only in uv.lock and never in pyproject.toml. Dependabot security updates are enabled on this repo and version updates work fine, but Dependabot's uv ecosystem cannot bump a lockfile-only transitive dependency — a security update job for one fails with security_update_not_possible instead of producing a lockfile-only PR (dependabot/dependabot-core#16449). So four alerts piled up with no PR attached.

Fix the alerts

Ran uv lock --upgrade-package virtualenv:

• virtualenv 21.7.0 → 21.14.5 (highest patched version the alerts asked for was 21.7.13)
• python-discovery 1.5.0 → 1.6.1 (transitive side effect)

Resolves:

Alert	Severity	Advisory
16	high	GHSA-p58f-9548-mpm2 — bash/fish activation scripts execute commands embedded in paths
15	high	GHSA-x78j-v8h9-3j2q — command injection via --prompt in activate.bat
14	high	GHSA-94p9-xgh2-xp45 — downloaded seed wheels not integrity-checked
13	medium	GHSA-9h9j-4vrj-gf7g — unsanitized prompt values written to pyvenv.cfg

Dev-tooling only; nothing in the published package changes.

Stop it recurring

Two changes, covering the specific package and the general case:

1. virtualenv==21.14.5 is pinned in the dev dependency group. It stays a pre-commit dependency — the pin only restates what the lockfile already resolved, so the resolution is unchanged, but Dependabot now treats it as a direct dependency and will open a PR for future advisories.

2. New .github/workflows/update-uv-lock.yml runs uv lock --upgrade every Monday and opens a PR when the resolution moves, closing the blind spot for every other lockfile-only transitive dependency. Since all direct dependencies are == pinned, the refresh can only change transitive versions — Dependabot keeps ownership of direct bumps, so the two don't produce competing PRs. The PR body lists the version changes uv reported, mirroring how update-grills.yml summarises its own diff.

Two things worth knowing about the new workflow:

• It opens PRs as dknowles-bot, which auto-merge.yml already auto-merges once CI passes — same as the existing grills.json refresh. That is existing repo policy, not something this PR changes, but it does mean transitive bumps will land without review once pytest/ruff/mypy are green.
• The lockfile is currently 17 transitive packages behind (aiohttp, dbus-fast, filelock, multidict, yarl, platformdirs, and others), so the first scheduled run will not be a small PR. I left those out of this PR deliberately to keep the security fix reviewable — say the word if you'd rather fold them in here.

Verification

uv run pytest (1333 passed), uv run ruff check ., and uv run mypy . all pass. The new workflow's shell logic was replayed against a copy of the lockfile to confirm the change detection and PR-body summary render correctly.

🤖 Generated with Claude Code