Currently we specify in dockerfiles/tox-buster/Dockerfile.template to use pip3 install tox==3.21.4. This is moderately old and we should shift to 4.x, which is "a complete re-write", but doing so will be a bit bumpy for repos involved.