dependency on py

[matthewdeanmartin]

tox has a direct dependency on py which is somewhat unmaintained and has had a dodgy CVE filed against it.

output of pipenv graph (but really, the py dep is visible in setup.cfg, too.

tox==3.27.0
  - colorama [required: >=0.4.1, installed: 0.4.6]
...
  - py [required: >=1.4.17, installed: 1.11.0]
  - six [required: >=1.14.0, installed: 1.16.0]

Pytest also had a dependency on py and decided to vendorize the parts they needed. There is a whole video about the issue. https://www.youtube.com/watch?v=aZS3_-y6vsg

The work around is to tell everyone to convince the corporate security team to ignore this CVE, which I guess works but scales poorly.

[jugmac00]

Duplicate of #2524.

Btw the linked video was created by a maintainer of tox :-)