virtualenv pulled <=3.6 support from package; legacy versions of tox can no longer test <=3.6

[ngie-eign]

Issue

Our organization installs tox 3.x to test on python 2.7 on old releases. This was unfortunately broken last night when the virtualenv project released a version that pulled <=3.6 support from the package: pypa/virtualenv@3022c59 .

This shouldn’t ultimately matter, but since legacy (and current) tox doesn’t pin an upper bound on the virtualenv package, the newest version will be installed and any workflows reliant on <=3.6 workflows will be broken.

This shouldn’t be an issue for the tox project, but since many configs might not have an explicit virtualenv called out under {[tox]requires}, this will hit many legacy projects and pipelines hard and result in a large number of downstream failures.

[gaborbernat]

Please set virtualenv<=20.22 in your requires.

[gaborbernat]

We plan to make no changes here, if you're testing eol pythons set virtualenv requires according.

[jugmac00]

I think it would make sense to add this to the faq, as I think quite some people could be effected. I'll prepare a MP later or the next days.

[ngie-eign]

Please @jugmac00 ... This is going to hit a lot of projects that either are still shipping versions that support python 2.7 or continue to test against python 2.7.
$work ships products that continue to run tests against 2.7 because we have it is part of our customer support contract. Yes, we should have been giving money to this project and others, but haven't been because we didn't anticipate this would have been an issue (@masenf has been volunteering some of his time toward the project though and he works with me).
We're working on modifying the affected version of tox and releasing it internally with the pinned requirement in setup.py, pyproject.toml, etc, but others might not have that luxury.

[ngie-eign]

@gaborbernat : the virtualenv release notes claim to have removed < 3.6 support, but in reality, it removed <=3.6. I know this is a subtle documentation nit, but it affected another internal pipeline that was running a py36 env. I acknowledge that it's an EOL version of python, but it's important for the documentation to be correct in release notes so others can evaluate whether or not to upgrade a version of a given package.

[ngie-eign]

The documentation issue appears to have been addressed < 30 minutes ago in virtualenv: pypa/virtualenv#2552 . We're all good here.

[gaborbernat]

My personal recommendation would be to update the configuration of this end of life python projects to use all their version of the virtualenv project instead of releasing a patched version (all -repos can help to do in bulk), but up to you.

[ngie-eign]

We're dealing with this by patching an older version of tox to require the last version of virtualenv that supports python <=3.6, not virtualenv as a package. It was the easiest path forward for us to unbreak a lot of workflows which run against older/unsupported versions of python.

[jugmac00]

Re-opening so I have a reference for the documentation PR.

[jugmac00]

fixed by #2991

[ngie-eign]

Thank you very much @jugmac00 !