The NVIDIA CUDA base image pins to an older AL2023 release version,
so dnf upgrade --security misses patches available in newer releases.
Adding --releasever latest ensures all available security fixes are
applied, including fixes for sqlite, libxml2, libtasn1, glib2, libcap,
openssl, and glibc CVEs.

Signed-off-by: Junpu Fan <junpu@amazon.com>

setup_oss_compliance.sh calls python -m pip at build time. Since we no
longer inherit site-packages from the Lambda base image, pip must be
explicitly installed via requirements.

Signed-off-by: Junpu Fan <junpu@amazon.com>

…positives

ECR scanner attributes setuptools 38.5.0 to pip_licenses-5.5.1.dist-info/METADATA
but no such version exists in the runtime image. setuptools==78.1.1 is installed
and both pip and ensurepip/_bundled (which contained the old vendored copy) have
been removed from the runtime image.

Signed-off-by: Junpu Fan <junpu@amazon.com>

deep_learning_container.py imports botocore.session for IMDS calls.
Previously provided by Lambda base image bundled site-packages;
now that we install site-packages ourselves, botocore must be explicit.
cupy and pytorch requirements already include boto3 (which pulls botocore).

Signed-off-by: Junpu Fan <junpu@amazon.com>

Consistent with cupy and pytorch requirements which both pin boto3==1.40.4.

Signed-off-by: Junpu Fan <junpu@amazon.com>

setuptools 82.0.1 vendors jaraco.context 6.1.0 which fixes CVE-2026-23949.
Remove CVE-2026-23949 from allowlist.

Signed-off-by: Junpu Fan <junpu@amazon.com>

…dates

All 4 Go CVEs (CVE-2025-47912, CVE-2025-58188, CVE-2026-25679, CVE-2026-27142)
are in aws-lambda-rie v1.33 built with Go 1.25.7. Fixed in Go 1.25.8 (2026-03-05)
but no new RIE release yet. We use releases/latest so will auto-resolve.
Extended review_by to 2026-06-12.

Signed-off-by: Junpu Fan <junpu@amazon.com>

vulnerablePackages entries include filePath indicating exactly where the
scanner found the vulnerable package. Include it in the error log to make
false positives and vendored copies immediately diagnosable.

Signed-off-by: Junpu Fan <junpu@amazon.com>

…s, remediation

- Use top-level fixAvailable field to skip unfixable CVEs (more reliable than
  per-package fixedInVersion heuristic)
- Add inspectorScore, exploitAvailable, epss.score to failure header
- Add per-package remediation command (e.g. 'sudo dnf check-update')
- Retain filePath from previous commit

Signed-off-by: Junpu Fan <junpu@amazon.com>

- CVE-2024-6345, CVE-2025-47273: ECR scanner false positives on pip_licenses dist-info
- CVE-2026-25679, CVE-2026-27142: Go CVEs in aws-lambda-rie v1.33 (Go 1.25.7),
  fixed in Go 1.25.8, pending new RIE release

All tarfile stdlib CVEs and GnuPG CVE-2026-24882 dropped from allowlist —
fixAvailable=NO so the scan filter now correctly ignores them.

Signed-off-by: Junpu Fan <junpu@amazon.com>

Remove pip deletion from all 3 runtime stages — customers building on top
of these images need pip to install additional packages.

Keep ensurepip/_bundled removal (bootstrap artifact, not needed at runtime).

Update allowlist reason for CVE-2024-6345 and CVE-2025-47273: setuptools 38.5.0
is vendored inside pip/_vendor/pkg_resources but is never invoked at Lambda
runtime; only the installed setuptools==82.0.1 is used.

Signed-off-by: Junpu Fan <junpu@amazon.com>

Signed-off-by: Junpu Fan <junpu@amazon.com>

CVE-2024-6345 and CVE-2025-47273 are confirmed ECR scanner false positives —
scanner attributes setuptools 38.5.0 to pip_licenses dist-info/METADATA
regardless of whether pip is present or absent in the image.

Signed-off-by: Junpu Fan <junpu@amazon.com>

Latest pip release. Note: pip still vendors urllib3==1.26.20 internally
(pip/_vendor/urllib3) — this is a known upstream issue; pip has been stuck
on urllib3 1.x for compatibility reasons regardless of version.

Signed-off-by: Junpu Fan <junpu@amazon.com>