Remove deprecated Python 2 dependencies (pyopenssl, pyasn1, ndg-httpsclient) with known CVEs

[AhsanSheraz]

Summary

The pusher package currently ships with three dependencies that exist solely for Python 2 SNI (Server Name Indication) support: pyopenssl, pyasn1, and ndg-httpsclient. These dependencies have known security vulnerabilities:

CVE	Library	Current	Fixed
CVE-2026-27459	pyopenssl	25.3.0	26.0.0
CVE-2026-30922	pyasn1	0.6.2	0.6.3

Why these dependencies exist

These were added for Python 2, which lacked native SNI support in its ssl module. The workaround was:

1. pyopenssl — provided SNI-capable SSL via OpenSSL bindings
2. ndg-httpsclient — patched urllib3 to use pyopenssl
3. pyasn1 — ASN.1 parsing required by both pyopenssl and ndg-httpsclient

In the codebase, this is visible in pusher/requests.py, where the pyopenssl injection is gated behind sys.version_info < (3,) — meaning it was never executed on Python 3.

Why we can't just upgrade to fixed versions

Simply pinning to the fixed versions (pyopenssl>=26.0.0, pyasn1>=0.6.3) would not restore Python 2 support because:

• pyopenssl dropped Python 2 support years ago (around v22.0)
• pyasn1 also no longer supports Python 2
• ndg-httpsclient is unmaintained

So there is no version combination that fixes these CVEs while maintaining Python 2 compatibility.

Why removing Python 2 support is the right approach

• Python 2 reached end-of-life on January 1, 2020 — over 6 years ago
• The project's CI already targets Python 3.10–3.12 only
• The Python 2 code paths (e.g., pyopenssl injection) are dead code on Python 3
• These dependencies add unnecessary attack surface for zero functional benefit on Python 3, as Python 3's stdlib ssl module handles SNI natively

Changes

• Remove pyopenssl, ndg-httpsclient, and pyasn1 from install_requires in setup.py
• Remove the dead Python 2 pyopenssl injection code in pusher/requests.py
• Update setup.py classifiers and README.md to reflect Python 3 only support

Related PR

• security: remove vulnerable Python 2 deps (pyopenssl, pyasn1, ndg-httpsclient) #251

[AhsanSheraz]

Hey Maintainers,
can someone have a look here?