Impact: Keeping this pin exposes systems to multiple serious CVEs including request smuggling and cookie injection vulnerabilities. The significant version gap also blocks access to performance improvements and newer features.
Impact: Keeping this severely outdated pin exposes systems to CVE-2019-18874 and prevents access to 5+ years of bug fixes, performance improvements, and new Python version compatibility.
Impact: Keeping this severely outdated pin exposes systems to multiple critical security vulnerabilities including potential cryptographic weaknesses and memory safety issues. The 40+ major version gap indicates missing years of security patches and bug fixes.
Impact: Keeping this outdated pin prevents access to 2+ years of bug fixes, security patches, and performance improvements. May cause compatibility issues with newer Juju versions and block adoption of modern operator patterns.
Impact: Keeping this pin exposes the charm repositories to multiple CVEs including recent ones from 2024-2025. However, upgrading beyond 81.0.0 would break functionality due to missing pkg_resources dependency.
Impact: Keeping this severely outdated pin (0.7.x vs 1.3.0 available) creates significant security risks from unpatched vulnerabilities and prevents access to bug fixes and performance improvements from nearly 3 years of development.
Impact: This severely outdated pin blocks access to 3+ years of bug fixes and security updates. It may cause dependency conflicts with other packages requiring newer versions.
Impact: Keeping this severely outdated pin (2.7.0 vs 4.3.0 latest) exposes the system to potential security vulnerabilities and prevents access to bug fixes and new features. It also creates technical debt as Python 3.5 is long deprecated.
Impact: Keeping this pin prevents access to 8 newer versions with potential bug fixes and security updates. However, it avoids build system complexity from Rust dependencies in deployment environments.
Impact: Keeping this pin exposes the repositories to potential security vulnerabilities from multiple CVEs. The 4-version gap may also cause compatibility issues with newer dependencies that require more recent pyopenssl versions.
Impact: Keeping this outdated pin prevents access to 4+ years of bug fixes, security patches, and new features. May cause compatibility issues with newer OpenStack releases and Python versions.
Impact: Keeping this pin prevents access to 3+ years of bug fixes, security patches, and performance improvements. It creates technical debt as pika 1.0+ has different connection handling that will eventually require refactoring.
Impact: Keeping this severely outdated pin (3.1.x vs 7.2.0) exposes the system to security vulnerabilities and prevents access to 4+ years of bug fixes and performance improvements.
Impact: Unpinned git dep (master) across 100 charms. Breaking changes propagate instantly.
Impact: Unpinned git dep (master) across 99 charms. Breaking changes propagate instantly.
Impact: Keeping this severely outdated pin exposes code to undetected style violations and potential security issues since flake8 2.4.1 lacks modern Python syntax support and bug fixes from 5+ years of development.
Impact: Unpinned git dep (master) across 81 charms. Breaking changes propagate instantly.
Impact: Unpinned git dep (master) across 44 charms. Breaking changes propagate instantly.
Impact: Unpinned git dep (master) across 24 charms. Breaking changes propagate instantly.
Impact: Unpinned git dep (master) across 21 charms. Breaking changes propagate instantly.
Impact: Unpinned git dep (master) across 16 charms. Breaking changes propagate instantly.
Impact: Keeping this extremely outdated pin (3+ major versions behind) exposes the system to security vulnerabilities and prevents access to bug fixes and performance improvements in newer versions.
Impact: Keeping this severely outdated pin blocks access to 4+ years of bug fixes, security patches, and performance improvements. It creates significant technical debt and potential security vulnerabilities.
Impact: Keeping this severely outdated pin exposes the charms to security vulnerabilities and prevents access to bug fixes and performance improvements from 6+ major versions of updates.
Impact: Unpinned git dep (master) across 11 charms. Breaking changes propagate instantly.
Impact: Keeping this severely outdated pin creates significant security vulnerabilities and prevents access to 4+ years of bug fixes, performance improvements, and modern OpenStack features.
Impact: Unpinned git dep (master) across 7 charms. Breaking changes propagate instantly.
Impact: Unpinned git dep (master) across 7 charms. Breaking changes propagate instantly.
Impact: Keeping this severely outdated pin creates significant security vulnerabilities and prevents access to bug fixes, performance improvements, and new features available in versions 2.x through 6.4.0.
Impact: Keeping this severely outdated pin blocks access to 4+ years of security fixes, bug patches, and performance improvements. It may cause compatibility issues with newer OpenStack services.
Impact: Keeping this severely outdated pin creates significant security vulnerabilities and prevents access to bug fixes, performance improvements, and new OpenStack features from 7+ major versions of updates.
Impact: This severely outdated pin blocks access to 15+ major versions of bug fixes, security patches, and new OpenStack API features. It creates significant security vulnerabilities and compatibility issues with modern OpenStack deployments.
Impact: This severely outdated pin creates significant security vulnerabilities and blocks access to 8+ years of bug fixes and feature improvements. Modern OpenStack environments may fail to deploy or operate correctly.
Impact: Keeping this severely outdated pin blocks access to 22+ major versions of bug fixes, security patches, and new testing capabilities. This creates potential security vulnerabilities and limits testing effectiveness.
Impact: Unpinned git dep (master) across 5 charms. Breaking changes propagate instantly.
Impact: Unpinned git dep (master) across 4 charms. Breaking changes propagate instantly.
Impact: Keeping this old pin blocks access to 4+ years of security fixes and bug improvements in keyring versions 21-25. The charm-tools issue may have been resolved, making this restriction unnecessary.
Impact: Keeping this severely outdated pin exposes the system to multiple security vulnerabilities and prevents access to performance improvements and bug fixes from newer versions.
Impact: Using an outdated hacking version may miss important code quality improvements and bug fixes. The significantly older version (3.0.1 vs 8.0.0) likely lacks support for newer Python syntax and modern linting capabilities.
Impact: Keeping this pin creates significant security risks as version 8.x is severely outdated compared to the latest 13.4.0. The charm may miss critical security patches and bug fixes from 5+ major version releases.
Impact: Keeping this severely outdated pin creates security vulnerabilities and prevents access to newer Kubernetes API features. The charm will fail to work with modern Kubernetes clusters that require updated client libraries.
Impact: Keeping this pin blocks access to 4+ years of security fixes, bug patches, and performance improvements. May cause dependency conflicts with newer packages requiring recent oslo.config versions.
Impact: Keeping this outdated pin blocks access to 3+ years of security fixes, bug patches, and performance improvements. May cause dependency conflicts with newer OpenStack components requiring recent oslo.context versions.
Impact: Using pbr 5.6.0 from 2020 creates security risks from unpatched vulnerabilities and may cause build failures with newer Python versions or packaging tools.
Impact: Keeping this pin maintains Python 3.5 compatibility but exposes the codebase to potential security vulnerabilities and missing bug fixes from newer cffi versions. It also blocks access to performance improvements in cffi 2.0.0.
Impact: Keeping this pin prevents access to bug fixes, security updates, and new features available in versions 2.8+ through 3.0.8. This creates potential security vulnerabilities and limits tooling capabilities.
Impact: Keeping this outdated pin means missing 3+ years of bug fixes and improved Python syntax support. May cause linting failures with newer Python features and miss detection of actual code issues.
Impact: Keeping this pin prevents access to 2+ years of bug fixes and security updates in versions 4.0.0-6.7.2. This creates potential security vulnerabilities and compatibility issues with newer OpenStack components.
Impact: Keeping this severely outdated pin blocks access to 4+ years of critical bug fixes, security updates, and new Juju features. This likely causes build failures with modern charm development practices.
Impact: Keeping this pin may miss bug fixes and improvements in version 8.0.2. However, the risk is minimal since this is a documentation tool used in development, not production runtime code.
Impact: Keeping this pin exposes the system to security vulnerabilities and missing bug fixes from 19 months of updates. It also prevents access to new OpenStack service features and API improvements.
Impact: Keeping this severely outdated pin creates security vulnerabilities and prevents access to bug fixes and performance improvements. The package is over 7 years behind current versions.
Cross-reference of the top 35 most common packages (rows) against the top 30 charms with the most dependencies (columns). Each cell shows how that charm pins that package. Hover over any colored cell to see the exact version specifier.
| Package | ceph-rbd-mirror | ceph-fs | barbican-softhsm | tempest | ceph-mon | mysql-innodb-cluster | mysql-router | neutron-api-plugin-arista | ceph-proxy | cinder-dell-emc-powerstore | cinder-ibm-storwize-svc | layer-openstack-principle | keystone-saml-mellon | percona-cluster | hacluster | manila-netapp | infoblox | cinder-netapp | keystone-ldap | panko | template-api | template-neutron-plugin | trilio-data-mover | trilio-dm-api | trilio-horizon-plugin | trilio-wlm | barbican-vault | ceph-radosgw | gnocchi | octavia | Latest |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| stestr | 4.2.1 | ||||||||||||||||||||||||||||||
| coverage | 7.13.5 | ||||||||||||||||||||||||||||||
| mock | 5.2.0 | ||||||||||||||||||||||||||||||
| requests | 2.32.5 | ||||||||||||||||||||||||||||||
| flake8 | 7.3.0 | ||||||||||||||||||||||||||||||
| charms_reactive | 1.5.3 | ||||||||||||||||||||||||||||||
| netifaces | 0.11.0 | ||||||||||||||||||||||||||||||
| simplejson | 3.20.2 | ||||||||||||||||||||||||||||||
| psutil | 7.2.2 | ||||||||||||||||||||||||||||||
| cryptography | 46.0.5 | ||||||||||||||||||||||||||||||
| pbr | 7.0.3 | ||||||||||||||||||||||||||||||
| pyparsing | 3.3.2 | ||||||||||||||||||||||||||||||
| cliff | 4.13.2 | ||||||||||||||||||||||||||||||
| nose | 1.3.7 | ||||||||||||||||||||||||||||||
| tenacity | 9.1.4 | ||||||||||||||||||||||||||||||
| hvac | 2.4.0 | ||||||||||||||||||||||||||||||
| psycopg2_binary | 2.9.11 | ||||||||||||||||||||||||||||||
| lxml | 6.0.2 | ||||||||||||||||||||||||||||||
| pyudev | 0.24.4 | ||||||||||||||||||||||||||||||
| jinja2 | 3.1.6 | ||||||||||||||||||||||||||||||
| ops | 3.6.0 | ||||||||||||||||||||||||||||||
| charm_tools | 3.0.8 | ||||||||||||||||||||||||||||||
| setuptools | 82.0.1 | ||||||||||||||||||||||||||||||
| netaddr | 1.3.0 | ||||||||||||||||||||||||||||||
| croniter | 6.2.2 | ||||||||||||||||||||||||||||||
| dnspython | 2.8.0 | ||||||||||||||||||||||||||||||
| cffi | 2.0.0 | ||||||||||||||||||||||||||||||
| six | 1.17.0 | ||||||||||||||||||||||||||||||
| os_testr | 3.0.0 | ||||||||||||||||||||||||||||||
| importlib_resources | 6.5.2 | ||||||||||||||||||||||||||||||
| importlib_metadata | 8.7.1 | ||||||||||||||||||||||||||||||
| pytz | 2026.1.post1 | ||||||||||||||||||||||||||||||
| osprofiler | 4.3.0 | ||||||||||||||||||||||||||||||
| stevedore | 5.7.0 | ||||||||||||||||||||||||||||||
| debtcollector | 3.0.0 |
Git-sourced dependencies installed directly from a git repository URL (e.g., git+https://...) rather than PyPI. These are common in OpenStack charms for zaza, zaza-openstack-tests, tempest, and charms.openstack. The orange bar shows the proportion pointing at an unpinned master branch, meaning any breaking commit propagates instantly to all dependent charms.
| Dependency | Total | Unpinned | Pinned | Unpinned % |
|---|---|---|---|---|
| zaza | 100 | 100 | 0 | |
| zaza.openstack | 99 | 99 | 0 | |
| charms.openstack | 81 | 81 | 0 | |
| unknown | 44 | 44 | 0 | |
| tempest | 24 | 24 | 0 | |
| ops_openstack | 21 | 21 | 0 | |
| charmhelpers | 16 | 16 | 0 | |
| ops_sunbeam | 11 | 11 | 0 | |
| tempest;python_version>='3.8' | 7 | 7 | 0 | |
| ops | 7 | 7 | 0 | |
| interface_tls_certificates | 5 | 5 | 0 | |
| interface_ceph_client | 4 | 4 | 0 | |
| interface_ceph_iscsi_admin_access | 3 | 3 | 0 | |
| interface_openstack_loadbalancer | 3 | 3 | 0 | |
| charm-tools | 3 | 3 | 0 | |
| charms_ceph | 2 | 2 | 0 | |
| interface_hacluster | 2 | 2 | 0 | |
| charms-openstack | 2 | 2 | 0 | |
| charmcraft | 2 | 2 | 0 | |
| advanced_sunbeam_openstack | 1 | 1 | 0 |
All analyzed charms with their dependency counts. Source indicates the authoritative repository: opendev = opendev.org/openstack (canonical upstream), gh:openstack = GitHub mirror, gh:charmers = openstack-charmers org, canonical = github.com/canonical (ceph-charms mono-repo, charm-ovn-*).