Skip to content

Docker Image includes dev dependencies(?) #10037

Closed
Closed
Docker Image includes dev dependencies(?)#10037
Assignees
adev-code
Labels
bugThis issue is a bug.closing-soonThis issue will automatically close in 4 days unless further comments are made.p3This is a minor priority issue

Description

@Llois41
Llois41
opened on Jan 29, 2026

Describe the bug

Hello,

I am currently getting a reported vulnerability for the latest aws-cli Docker image (v2.33.9) for the wheel package (/usr/local/aws-cli/v2/2.33.9/dist/wheel-0.45.1.dist-info). In the repository I find the updated version to v0.46.3. But I only see this package defined as dev dependency (see https://github.com/search?q=repo%3Aaws%2Faws-cli%20wheel&type=code). Additionally I only could find it being updated from v0.43.0 -> v0.46.3 (see 6cedf02) so I wonder where this current v0.45.1 comes from.

Why would this package
a) end up in the published Docker image if it is only declared as dev dependency?
b) is currently not updated in latest image version? (if current behaviour described in a) is intended)

Best regards
Luis

Regression Issue

  • Select this option if this issue appears to be a regression.

Expected Behavior

dev dependencies are not part of published image or at least are updated correctly

Current Behavior

currently includes a vulnerable package version oh wheel package (v0.45.1).

Reproduction Steps

pull aws-cli Docker image in v2.33.9 and navigate to /usr/local/aws-cli/v2/2.33.9/dist/wheel-0.45.1.dist-info in the container

Possible Solution

No response

Additional Information/Context

No response

CLI version used

v2.33.9

Environment details (OS name and version, etc.)

tested under linux and mac

Activity

  1. Llois41
    added
    bugThis issue is a bug.
    needs-triageThis issue or PR still needs to be triaged.
    on Jan 29, 2026

  2. ashovlin commented on Jan 29, 2026

    @ashovlin
    ashovlin
    on Jan 29, 2026
    Member

    Yeah, wheel is a build dependency, and the 0.45.1 pin is in our internal build system, which isn't in the GitHub repo.

    We'll work on removing that .dist-info to clear the scanner as well as updating the build dependency, but in the meantime usage of the AWS CLI should not be impacted by GHSA-8rrh-rw8j-w5fx.

  3. adev-code
    self-assigned this
    on Jan 30, 2026
  4. adev-code
    added
    p3This is a minor priority issue
    and removed
    needs-triageThis issue or PR still needs to be triaged.
    on Jan 30, 2026

  5. ashovlin commented on Feb 3, 2026

    @ashovlin
    ashovlin
    on Feb 3, 2026
    Member

    In 2.33.14 released today we've removed the wheel .dist-info directory. Let us know if you're still seeing scanner results or any other issues.

  6. ashovlin
    added
    closing-soonThis issue will automatically close in 4 days unless further comments are made.
    on Feb 3, 2026
  7. ashovlin
    closed this as completedon Feb 5, 2026

  8. github-actions commented on Feb 5, 2026

    @github-actions
    github-actionsBot
    on Feb 5, 2026 – with GitHub Actions
    Contributor

    This issue is now closed. Comments on closed issues are hard for our team to see.
    If you need more assistance, please open a new issue that references this one.

  9. Llois41 commented on Feb 11, 2026

    @Llois41
    Llois41
    on Feb 11, 2026
    Author

    @ashovlin sorry for the late feedback: issue was resolved, thanks for the quick fix! :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

bugThis issue is a bug.closing-soonThis issue will automatically close in 4 days unless further comments are made.p3This is a minor priority issue

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions