python-future is now deprecated

[gedia]

Details

python-future is now deprecated and does not work with python 3.12. From gentoo's package notes:

# Deprecated, doesn't work with python 3.12. Unmaintained with last
# serious release in 2019, and another release in 2024 that claims
# to support python 3.12 but fails tests if you actually do. No
# route to making it work with python 3.13 at all, and upstream
# explicitly states that future "like Python 2, is now done". The
# package is entirely redundant to packages not supporting python
# 2 anymore, and the ones that do support it should be using
# dev-python/six instead, anyways.  Bug #888271
# Removal on 2024-04-13.

Impact

If this project does depend on future (as stated in requirements-python3x.txt), it will stop working or present with issues starting with python 3.12.

NeedBy

future library should be purged from this project before distributions ship with python 3.12 or potentially 3.13 as the default. Until fixed, users should be instructed to use a virtualenv with <python-3.12.

Severity

Moderate.

[gedia]

I'm no python expert, but it appears python-future is not really used anywhere.

The only reference is in omsdk/sdkprint.py:

from __future__ import print_function

Additionally, the print function is not used in that file (pprint is used instead).

So if my analysis is correct, the following diff should be enough to purge python-future from this package:

diff -Naur a/omsdk/sdkprint.py b/omsdk/sdkprint.py
--- a/omsdk/sdkprint.py 2023-06-26 13:56:53.000000000 +0300
+++ b/omsdk/sdkprint.py 2024-04-06 15:37:36.124727639 +0300
@@ -20,7 +20,6 @@
 #
 # Authors: Vaideeswaran Ganesan
 #
-from __future__ import print_function
 import io
 import logging
 import threading
diff -Naur a/requirements-python2x.txt b/requirements-python2x.txt
--- a/requirements-python2x.txt 2023-06-26 13:56:53.000000000 +0300
+++ b/requirements-python2x.txt 2024-04-06 15:37:46.611362341 +0300
@@ -3,5 +3,4 @@
 enum34>=1.1.6
 requests>=2.12.3
 PyYAML>=3.12
-future>=0.16.0
 pysnmp_mibs>=0
\ No newline at end of file
diff -Naur a/requirements-python3x.txt b/requirements-python3x.txt
--- a/requirements-python3x.txt 2023-06-26 13:56:53.000000000 +0300
+++ b/requirements-python3x.txt 2024-04-06 15:37:50.418017411 +0300
@@ -1,5 +1,4 @@
 pysnmp>=4.4.1
 requests>=2.12.3
 PyYAML>=3.12
-future>=0.16.0
 pysnmp_mibs>=0
\ No newline at end of file
diff -Naur a/setup-omsdk.py b/setup-omsdk.py
--- a/setup-omsdk.py    2023-06-26 13:56:53.000000000 +0300
+++ b/setup-omsdk.py    2024-04-06 15:38:03.627977191 +0300
@@ -107,7 +107,6 @@
         "enum34; python_version<'3.4'",
         "requests>=2.12.3",
         "PyYAML>=3.12",
-        "future>=0.16.0",
         "pysnmp_mibs>=0",
         "ipaddress>=0"
     ],
diff -Naur a/setup.py b/setup.py
--- a/setup.py  2023-06-26 13:56:53.000000000 +0300
+++ b/setup.py  2024-04-06 15:38:10.161290647 +0300
@@ -30,7 +30,6 @@
         'python_version<3.4',
         'requests>=2.12.3',
         'PyYAML>=3.12',
-        'future>=0.16.0',
         'pysnmp_mibs>=0',
         'ipaddress>=0'
     ]

I haven't checked whether it's needed by any dependencies, though. In any case, I would say purging python2 support entirely in future versions would be a welcome change.

[thebeanogamer]

Fedora is tracking this bug downstream https://bugzilla.redhat.com/show_bug.cgi?id=2276615 as it is failing our Python 3.13 pre-release checks. If I get time, I'll try to do a PR for this.

[MallocArray]

Bringing this up again as now the Trivy scanner is showing future 1.0.0 as a High severity CVE
https://avd.aquasec.com/nvd/2025/cve-2025-50817/

No fixed version is available and if future only provides support for python2 code to run in python3, is it time to retire that functionality and depend on recent Python?