# A defunct project of mine has been categorized as "critical"

**URL:** <https://discuss.python.org/t/a-defunct-project-of-mine-has-been-categorized-as-critical/17219>\
**Category:** Packaging\
**Created:** [July 8, 2022, 5:29pm UTC](https://discuss.python.org/t/a-defunct-project-of-mine-has-been-categorized-as-critical/17219 "2022-07-08T17:29:04Z")\
**Posts on this page:** 1\
**Showing post:** 11

<div class="post-metadata">

**Author:** ![fungi](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/fungi/32/5963_2.png) [@fungi](https://discuss.python.org/u/fungi)\
**Post date:** [July 9, 2022, 4:12am UTC](https://discuss.python.org/t/a-defunct-project-of-mine-has-been-categorized-as-critical/17219/11 "2022-07-09T04:12:23Z")

</div>

I’ve found that some OpenStack projects depend on ansible-runner,  
which in turn depends on python-daemon, which itself declares a  
dependency on lockfile. I’ll need to confer with other contributors  
on a way forward, but probably it’s to either help python-daemon  
maintainers replace their use of lockfile, or help ansible-runner  
maintainers replace their use of python-daemon.

> <https://github.com/ansible/ansible-runner/issues/379>
>
> Runner's python dependency chain requires daemon, which in turn require lockfile… (at least that's how the rpms are built!). The issue is that lockfile is deprecated - https://pypi.org/project/lockfile/ so any security related issues relating to that package may not be addressed leading to a potential exposure in runner itself.
> 
> This is also covered in a downstream BZ - https://bugzilla.redhat.com/show\_bug.cgi?id=1758507

[https://pagure.io/python-daemon/issue/42](https://pagure.io/python-daemon/issue/42)

---

_[View the full topic](https://discuss.python.org/t/a-defunct-project-of-mine-has-been-categorized-as-critical/17219)._