Python-Honeypot icon indicating copy to clipboard operation
Python-Honeypot copied to clipboard

security: remove deprecated and archived codecov dependency (fixes #383)

Open SankalpGhasti-dev opened this issue 1 month ago • 0 comments

Summary

This PR removes the 'codecov==2.1.12' dependency from 'requirements-dev.txt'.

The version was removed/yanked from PyPI and is no longer available, causing installation failures for contributors. More importantly, the entire Codecov Python client is now archived and deprecated, meaning no further security patches will be released.

Security Context

Through investigation (documented in Issue #383):

  • codecov==2.1.12 was removed from PyPI.
  • The Codecov Python uploader repository is archived by the maintainers.
  • Codecov uploaders have had significant security incidents, including:
    • CVE-2019-10800 (command injection)
    • The 2021 supply-chain compromise of the Bash Uploader, which leaked CI/CD secrets.
  • Using archived or unmaintained dependencies in a honeypot project introduces unnecessary supply-chain risk.

Why Remove Instead of Replace?

Even the latest version ('2.1.13') is deprecated and unmaintained. Replacing it would not provide any long-term stability or security. The honeypot does not rely on Codecov for functionality, so removal is the safest option.

Changes Made

  • Removed 'codecov==2.1.12' from 'requirements-dev.txt'.

Impact

  • Installation no longer fails due to a missing package.
  • Reduces supply-chain risk.
  • Improves maintainability and security hygiene of the project.

SankalpGhasti-dev avatar Nov 20 '25 10:11 SankalpGhasti-dev