Skip to content

🐛 fix(cache): key exe lookups by version - #215

Merged
gaborbernat merged 2 commits into
tox-dev:mainfrom
gaborbernat:bug/aic1bqko-discovery-cache
Nov 3, 2026
Merged

gaborbernat merged 2 commits into
tox-dev:mainfrom
gaborbernat:bug/aic1bqko-discovery-cache

Conversation

@gaborbernat

@gaborbernat gaborbernat commented Nov 3, 2026 •

Copy link
Copy Markdown
Member

PythonInfo.discover_exe() reused a prefix lookup result without considering the requested version. A caller that resolved one virtual environment could then receive that version's metadata for a different interpreter. The cache key now includes the requested version, so the second lookup checks candidates for its own version. Fixes #186.

The lookup cache omitted the version

The previous cache key contained only the prefix and exact-match flag. The new key includes version_info. This keeps results from one requested version out of lookups for another version under the same prefix.

Behavior changes

A lookup for a different version may interrogate candidates even when the prefix was searched earlier. Lookups for the same version still reuse the cached result. In the reported case, the second 3.11 request returns no match instead of reporting a 3.15 executable as 3.11.

Reported by Anthropic's OSS Scanner: ANT-2026-AIC1BQKO.

@gaborbernat gaborbernat added the bug Something isn't working label Nov 3, 2026
@gaborbernat
gaborbernat merged commit aece5ef into tox-dev:main Nov 3, 2026
20 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Interpreter lookup can report Python 3.15 as 3.11

1 participant