build(deps): require aiohttp >=3.14.3 for security advisories

[Olen]

Summary

Raises the aiohttp dependency floor from >=3.8.5 to >=3.14.3, closing all 14 open Dependabot alerts on this repository.

Why the alerts were stuck

Every open security alert on the repo is aiohttp — 1 high, 8 medium, 5 low. None of them ever produced a Dependabot PR, and that is a consequence of how the constraint was written rather than an oversight in configuration (the pip ecosystem is enabled in .github/dependabot.yml).

Dependabot's security updater only opens a PR when the manifest forbids the patched version. >=3.8.5 already permitted 3.14.3, so there was no edit for it to make — while simultaneously telling every downstream consumer that resolving to a vulnerable aiohttp is acceptable. With no committed lockfile (poetry.lock is gitignored, correct for a library), this declared range is the only version signal consumers get.

The highest-severity item is CVE-2026-69244: an out-of-bounds heap read in the C HTTP response parser when handling a malformed chunked response, exploitable by a server the client talks to. Practical exposure for this library is limited, since it speaks only to api.spond.com — but that safety rests on trusting that endpoint and the network path to it, which is not something worth encoding as a dependency floor.

Compatibility

The floor moves a long way, so it is worth being explicit about who it affects: the package already requires Python >=3.11 and CI covers 3.11–3.14, all of which aiohttp 3.14.3 supports. The constraint is a lower bound only, so consumers already on a recent aiohttp are unaffected. Consumers deliberately pinned below 3.14.3 will need to upgrade.

The floor is commented in pyproject.toml, matching the file's existing convention of documenting non-obvious constraints, so it isn't lowered inadvertently later.

Testing

Full CI sequence run locally under Poetry, against the newly resolved aiohttp 3.14.3:

• poetry install → resolves aiohttp 3.14.3
• poetry run ruff check → all checks passed
• poetry run ruff format --check --diff → 13 files already formatted
• poetry run pytest → 30 passed

One note: the suite emits an Unclosed client session warning. I verified this is pre-existing test hygiene and unrelated to this change by re-running the suite against aiohttp 3.13.3, which produces the identical warning. Not addressed here.

🤖 Generated with Claude Code

[elliot-100]

@Olen I don't feel these points are correct:

telling every downstream consumer that resolving to a vulnerable aiohttp is acceptable.

That is not what requirements bounds for a library are intended to do - they are requisites for the functionality of the library*. It is up to consumers to choose (pin) exact requirement versions within those bounds, based on e.g. the specific impact of vulnerabilities on their application.

The author of a library can't know this, and it's wrong to assume all vulnerabilities are relevant to all consumers.

With no committed lockfile (poetry.lock is gitignored correct for a library), this declared range is the only version signal consumers get.

A lockfile can be included in a repo for a library, for reproducible builds in dev + CI. But it doesn't affect the locking of package versions by consumers at all. So it can never be a 'version signal' to them.

[*admittedly, the lower bound of the dependency is usually adjusted to the floor which has been tested, or was the current version at initial release]

[Olen]

Both points taken — you're right. Walked back in #257, which re-derives the floor on compatibility grounds only. That also turned up that >=3.8.5 was wrong in the other direction: we require python>=3.11, but aiohttp 3.8.5 only supports up to Python 3.10.

Would appreciate your review on #257.