Skip to content

Conversation

@adammcmaster
Copy link
Contributor

There is a high severity CVE open on the python-future module (CVE-2025-50817). It's been a few weeks and there is no sign of the project owners addressing the vulnerability, presumably since the module is no longer being maintained.

python-future is only required to provide backwards compatibility in order to support Python 2. Since Python 2 has been EOL for five years I think it's safe for us to just remove Python 2 support and remove the dependency on python-future. Anyone who is still using Python 2 for any reason can always continue to use the current version of the client.

@yuenmichelle1 yuenmichelle1 self-requested a review November 13, 2025 16:25
Copy link
Collaborator

@yuenmichelle1 yuenmichelle1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TODO: Update Changelog with other new changes that were made since 1.7.1 released.

@yuenmichelle1 yuenmichelle1 merged commit 22c14bf into zooniverse:master Dec 29, 2025
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants