[Package] docker image contains components which have reached EOL

[j3t]

Product

Amazon Linux 2023

Package

python3 and node.js both in versions which have not yet reached EOL

Why do you need this package?

We would like to use the official opensearch and opensearch-dashboards docker image (baseimage amazonlinux:2023, see (here and here)), but this violates our internal guidelines because the image contains components that have reached EOL.

Below you can see the output of the scans:

❯ xeol public.ecr.aws/amazonlinux/amazonlinux:2023
 ✔ EOL DB                          [no update available]  
 ✔ Scanned for EOL                 [1 eol matches]  
NAME     VERSION                EOL         DAYS EOL  TYPE 
python3  3.9.25-1.amzn2023.0.3  2025-10-31  67        rpm

❯ xeol opensearchproject/opensearch:3.4.0
 ✔ EOL DB                          [updated]  
 ✔ Scanned for EOL                 [1 eol matches]  
NAME     VERSION                EOL         DAYS EOL  TYPE 
python3  3.9.25-1.amzn2023.0.1  2025-10-31  67        rpm

❯ xeol opensearchproject/opensearch-dashboards:3.4.0
 ✔ EOL DB                          [no update available]  
 ✔ Scanned for EOL                 [3 eol matches]  
NAME     VERSION                EOL         DAYS EOL  TYPE   
node     14.21.3                2023-04-30  982       binary  
node     20.18.3                2026-04-30  -         binary  
python3  3.9.25-1.amzn2023.0.1  2025-10-31  67        rpm