[ludoch]

Fixes open Dependabot alerts #38–#48, all for virtualenv < 21.14.9 in kokoro/gcp_ubuntu/requirements.txt (9 high, 2 medium: command injection via activation scripts, unchecked seed wheels, pyvenv.cfg injection, symlink handling).

Changes:

• virtualenv 20.36.1 → 21.14.12
• Dependencies required by virtualenv 21.x: distlib 0.3.8 → 0.4.4, filelock 3.20.3 → 4.2.4, platformdirs 4.2.2 → 4.13.5
• New dependencies: packaging==26.3, python-discovery==1.6.4

All entries are pinned with PyPI sha256 hashes, since build.sh installs with --require-hashes.

Tested: hash-checked install of the file on Python 3.12 (the version build.sh uses) succeeds, the dependency check reports no conflicts, and the new virtualenv creates a working environment.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.