Pin virtualenv to 20.0.21

[cjolowicz]

No description provided.

[wandering-tales]

@cjolowicz Was there any reason to pin the virtualenv package in the constraints file?

[cjolowicz]

@wandering-tales It was pinned to have more deterministic CI, and to isolate CI failures caused by breaking changes to a PR performing the upgrade. In general, we pin all direct dependencies of GA workflows. virtualenv is an indirect dependency via Nox, but it's special: It bundles pip, so our pin for pip does not affect Nox environments (see #324). Also, in the 20.0.* series virtualenv was in a stabilization phase after its rewrite, so it made good sense to use well-known versions. But I think it's still a good idea even now that virtualenv is stable, and even if we pinned the bundled pip using some other means, such as VIRTUALENV_PIP.

Edit: Just to be clear, the pins in the GA workflow constraints are upgraded by Dependabot. The intention is to always use the latest virtualenv, but gate this through a PR with CI checks.

[wandering-tales]

@cjolowicz Many thanks for your explanation. You did a great job with this project!