build(deps): make the aiohttp floor a compatibility bound, not a security one - #257
Open
Olen wants to merge 1 commit into
Open
build(deps): make the aiohttp floor a compatibility bound, not a security one#257Olen wants to merge 1 commit into
Olen wants to merge 1 commit into
Conversation
…rity one #254 raised the floor to >=3.14.3 to clear 14 Dependabot alerts. As raised in review, that misuses the field: a library's bounds state what it needs to function, not a security policy. Which advisories matter depends on the consuming application, so the pin is theirs to choose. A floor at the newest patch release also forces an upgrade on everyone and sits one advisory away from needing the next bump. Set >=3.13.0 instead, justified purely on compatibility: it is the oldest aiohttp declaring Python 3.14 support, which this package tests against. Note the original >=3.8.5 was itself wrong — aiohttp 3.8.5 tops out at Python 3.10 while this package requires >=3.11, so no install could satisfy both. This deliberately clears no alerts; every advisory needs >=3.14.0. That separation is the point: compatibility in the manifest, security as advice in the README. Verified: suite passes against aiohttp 3.13.0 (the new floor) and 3.14.3. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Collaborator
|
This change is fine in itself (apart from unecessary verbiage) but there's a lesson missed here, which is to create a lockfile for CI add it to the repo, and ensure it is used in CI. Should use lowest matching dependency resolution strategy (which I think Poetry does by default?). Then CI will fail if e.g. Python 3.15 is added to the matrix without adjusting But one for a separate PR. |
elliot-100
reviewed
Aug 16, 2026
Comment on lines
9
to
17
|
|
||
| [tool.poetry.dependencies] | ||
| python = ">=3.11" | ||
| # Floor is a security boundary, not a feature requirement: everything below | ||
| # 3.14.3 carries known advisories in the HTTP parsers, up to and including a | ||
| # high-severity out-of-bounds read (CVE-2026-69244). As a library we publish | ||
| # this range to downstream installs, so it must not resolve to a vulnerable | ||
| # aiohttp. Don't lower it without checking the advisories first. | ||
| aiohttp = ">=3.14.3" | ||
| # Compatibility floor, not a security one: 3.13.0 is the oldest aiohttp | ||
| # supporting Python 3.14. Security pinning is left to consumers (see README). | ||
| aiohttp = ">=3.13.0" | ||
|
|
||
| [tool.poetry.group.dev.dependencies] | ||
| # Constraint on `python` is required: pdoc's transitive `markdown2` declares |
Collaborator
There was a problem hiding this comment.
oldest aiohttp supporting Python 3.14 is the absolute maximum comment I would have here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Walks back the
aiohttpfloor from #254 and re-derives it on compatibility grounds. Sets>=3.13.0.Why
@elliot-100 pushed back on #254's reasoning, and the objection is correct: a library's dependency bounds state what it needs to function, not a security policy. Which advisories matter depends on the consuming application, so the pin belongs to them. A floor at the newest patch release forces an upgrade on everyone and sits one advisory away from needing the next bump.
The second objection also lands. #254 argued the range was "the only version signal" because no lockfile is committed — but a lockfile never reaches consumers at all, so it could never be that signal either way. The conclusion was accidentally true; the reasoning was not.
Why
>=3.13.0rather than back to>=3.8.5>=3.8.5was itself incorrect, in the opposite direction. This package requirespython>=3.11, but aiohttp 3.8.5 declares support only through Python 3.10 — no install could satisfy both bounds.3.13.0 is the oldest aiohttp declaring Python 3.14 support, which this package tests against. From PyPI classifiers:
This clears zero alerts, deliberately
Every one of the 14 advisories needs
>=3.14.0at minimum, so no compatibility-justified floor clears any of them. That separation is the point: compatibility belongs in the manifest, security guidance belongs in the README as advice.The alerts are better handled by dismissing them with a rationale than by constraining consumers.
README
Reframed from requirement to advice: the CVE reference stays for consumers deciding their own pin, without imposing it.
Testing
poetry run pytestagainst aiohttp 3.13.0 (the new floor) → 30 passedpoetry run pytestagainst 3.14.3 (current resolution) → 30 passedpoetry run ruff check→ passed;ruff format --check→ 13 files already formatted🤖 Generated with Claude Code