I've hit this while looking into the plugins API and needed to extract some env deps.
Apparently, https://github.com/tox-dev/tox/blob/5e0784a/src/tox/tox_env/python/package.py#L33 claims that the PythonPathPackageWithDeps.deps attribute is a sequence of packages. But in reality, in runtime, it's a list of requirements. Also, the deps argument to the initializer gets a list of requirements too.
The correct argument signature would be deps: Sequence[Requirement] and the attribute assignment does not need to re-define it to something else to fool MyPy.