Description
Why is this needed?
Some dependencies like boto3 depend on urllib and dependency resolution fails sometimes.
Some other dependencies like aws-requests-auth are bringing in requests as an optional dependency, but they are not pinning the minimum version of requests and are installing requests==0.14.0 which has a potential CVE. Even this does not affect customers, because it is a development dependency, it is important to fix.
Which area does this relate to?
Automation
Solution
No response
Acknowledgment
- This request meets Powertools for AWS Lambda (Python) Tenets
- Should this be considered in other Powertools for AWS Lambda languages? i.e. Java, TypeScript, and .NET
Metadata
Metadata
Assignees
Type
Projects
Status
Shipped