With T46443 we have python tox installed using the puppet 'pip' provider:
package { 'tox': ensure => present, provider => 'pip', require => Package['python-pip'], }
I guess that installs whatever latest version is available in pipy, so we want to pin it to a specific version. Looking at puppet code, it seems we can pass the version to the ensure parameters.
Currently all slaves have 1.9.2.