text: Title: dependency on py
  Body: tox has a direct dependency on py which is somewhat unmaintained and has had a dodgy CVE filed against it.
  
  output of `pipenv graph` (but really, the py dep is visible in setup.cfg, too.
  ```
  tox==3.27.0
    - colorama [required: >=0.4.1, installed: 0.4.6]
  ...
    - py [required: >=1.4.17, installed: 1.11.0]
    - six [required: >=1.14.0, installed: 1.16.0]
  ```
  
  Pytest also had a dependency on `py` and decided to vendorize the parts they needed. There is a whole video about the issue. https://www.youtube.com/watch?v=aZS3_-y6vsg
  
  The work around is to tell everyone to convince the corporate security team to ignore this CVE, which I guess works but scales poorly.