I have been debating forking 2 more upstream projects. Not that I want to have even more to keep up with, but RH has been super slow in doing some updates that I would deem pretty critical.
ansible-runner - RH has been slow to update some packages with CVEs in the past, and they haven't merged the PR for removing the defunct python-daemon and lockfile dependencies that has been sitting there for 4 years (an issue was also raised back in 2019 and sits open). We include python-daemon in Ascender, just to ensure we get >=3.0 for runner, but don't use it ourselves. Either way, I think we can do a better job of it keeping it updated in a timely manner, and not much else changes in that repo (though I have some ideas on improvements).
ansible/ansible-runner1054
django-ansible-base - Nearly the same deal, slow update for CVEs. Still waiting for them to fix an auth issue and upgrade djangorestframework to fix CVE-2026-73228 and another one. I believe RH has an attitude of that if it doesn't directly affect them, then they don't bother. But these packages all show up in reports when any user's security teams scans the containers, and its best that we ensure they get a clean bill of health instead of having to ask for exceptions.
They are also adding more and more changes that may impact us in the future, so it might be best to get ahead of it. We can also drop a big portion of the code base, as we only use a small fraction of it. Might even be worth while to just bring those portions back in house and drop the dependency.
