Drop python 2 support & dependency on "future" due to CVE-2025-50817

[johncarter-phntm]

This package is flagged by security warnings due to this vulnerability in future

• CVE-2025-50817 PythonCharmers/python-future#650
• https://nvd.nist.gov/vuln/detail/CVE-2025-50817

It would be good to drop support for older pythons (e.g. <3.9), and remove this dependency.

[johncarter-phntm]

It does look like that was planned ( #618 (comment) ), but I think the package currently isn't maintained.

[johncarter-phntm]

See also

• Dependency on future #784
• Remove dependency on future #795

[lucemia]

For anyone hitting this in a scan: the dependency is real and still present in 0.2.0.

$ pip install ffmpeg-python
ffmpeg-python 0.2.0
future        1.0.0      <- CVE-2025-50817

future is pulled in solely for Python 2 compatibility, so dropping it means dropping Python 2 — which is what this issue asks for. Given master has had no commits since July 2022, that seems unlikely to land here.

If you need to get off it rather than wait, I maintain typed-ffmpeg (disclosure: it's mine). Relevant to this specific issue:

$ pip install typed-ffmpeg
typed-ffmpeg 4.5, typed-ffmpeg-v9 4.5, ffmpeg-core 4.5

Three packages, all first-party, and ffmpeg-core declares dependencies = [] — no third-party runtime dependencies at all, so there is nothing for a scanner to flag. requires-python = ">=3.10", so no Python 2 shims exist to begin with.

The API is close enough that most graphs port directly, and there's a typed-ffmpeg-compatible distribution that installs as typed_ffmpeg if you need it side by side with ffmpeg-python during a migration, since both otherwise claim the ffmpeg module name.