# Are there incompatibilities between AWX and the latest version of setuptools/paramiko/pip?

**URL:** <https://forum.ansible.com/t/are-there-incompatibilities-between-awx-and-the-latest-version-of-setuptools-paramiko-pip/3101>\
**Category:** Get Help\
**Tags:** awx, ee\
**Created:** [December 29, 2023, 1:16pm UTC](https://forum.ansible.com/t/are-there-incompatibilities-between-awx-and-the-latest-version-of-setuptools-paramiko-pip/3101 "2023-12-29T13:16:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![actionmystique](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/actionmystique/32/1678_2.png) [@actionmystique](https://forum.ansible.com/u/actionmystique)\
**Post date:** [December 29, 2023, 1:16pm UTC](https://forum.ansible.com/t/are-there-incompatibilities-between-awx-and-the-latest-version-of-setuptools-paramiko-pip/3101/1 "2023-12-29T13:16:24Z")

</div>

I have noticed some security vulnerabilities in the latest official awx-ee available [here](https://quay.io/repository/ansible/awx-ee?tab=tags&tag=latest). Updating some python packages with their latest version [would solve those flaws](https://quay.io/repository/ansible/awx-ee/manifest/sha256:66ce4a8d75bc398616557861315c77be98ccf378c4d0a1a7acaad2920643887b?tab=vulnerabilities):

- setuptools 53.0.0 → 69.0.3
- paramiko 2.12.0 → 3.4.0
- pip 21.2.3 → 23.3.2

It could be performed with the following lines added in execution-environment.yml:

```auto
additional_build_steps:
  append_final:
    - RUN pip3 --disable-pip-version-check list --outdated --format=json | python3 -c "import json, sys; print('\n'.join([x['name'] for x in json.load(sys.stdin)]))" | xargs -n1 pip3 install -U

```

The fact that it has not been done might suggest some sort of incompatibilities/conflicts with AWX.  
Is it the case or is it safe to upgrade them?

#ee #awx #ansible-builder

---

<div class="post-metadata">

**Author:** ![MallocArray](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mallocarray/32/1655_2.png) [@MallocArray](https://forum.ansible.com/u/MallocArray)\
**Post date:** [January 3, 2024, 6:23pm UTC](https://forum.ansible.com/t/are-there-incompatibilities-between-awx-and-the-latest-version-of-setuptools-paramiko-pip/3101/2 "2024-01-03T18:23:15Z")

</div>

What I’ve done in my EE is to manually install the latest with something like `pip3 install paramiko --force` and it completes but then tells me that it isn’t compatible with one of the Azure related modules, so that let me know why it wasn’t updated.

You could try that with the others and see if anything comes up.

---

<div class="post-metadata">

**Author:** ![actionmystique](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/actionmystique/32/1678_2.png) [@actionmystique](https://forum.ansible.com/u/actionmystique)\
**Post date:** [January 12, 2024, 10:58am UTC](https://forum.ansible.com/t/are-there-incompatibilities-between-awx-and-the-latest-version-of-setuptools-paramiko-pip/3101/3 "2024-01-12T10:58:52Z")

</div>

I confirm that the azure collection drags every one down.  
The only secure solution is to NOT use awx-ee and to build an ee from [scratch](https://github.com/ansible/awx-ee/blob/devel/execution-environment.yml) without azure collection (and all the others) unless you really need it/them.