chore(deps): Bump aiohttp from 3.14.0 to 3.14.3 - #235
Conversation
Bumps [aiohttp](https://github.com/aio-libs/aiohttp) from 3.14.0 to 3.14.3. - [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst) - [Commits](aio-libs/aiohttp@v3.14.0...v3.14.3) --- updated-dependencies: - dependency-name: aiohttp dependency-version: 3.14.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
⏳ Analysis QueuedYour fossabot analysis was queued at fossabot will update this comment as the analysis progresses. |
App impact analysis skipped — out of creditsBreaking change detection completed but more credits are needed to enable usage detection, impact analysis, fix suggestions, and get your final upgrade determination. aiohttp We found 2 breaking changes.
View more changes for aiohttp
...and 106 more in the full analysis You have no credits left. Reach out to autoupdates@fossa.com and we'll top you up. Credits are consumed when dependency updates are reviewed or proposed. Re-run with Mute out-of-credit notifications until next month (expires 2026-09-01T00:00:00.000Z) |
1 similar comment
App impact analysis skipped — out of creditsBreaking change detection completed but more credits are needed to enable usage detection, impact analysis, fix suggestions, and get your final upgrade determination. aiohttp We found 2 breaking changes.
View more changes for aiohttp
...and 106 more in the full analysis You have no credits left. Reach out to autoupdates@fossa.com and we'll top you up. Credits are consumed when dependency updates are reviewed or proposed. Re-run with Mute out-of-credit notifications until next month (expires 2026-09-01T00:00:00.000Z) |
|
🟠 Review before merging🟠🟣 Review one behavior before mergingA documented behavior change intersects with repository usage; impact depends on the inputs reaching the changed code path. Security advisory: GHSA-2fqr-mr3j-6wp8, GHSA-4fvr-rgm6-gqmc, GHSA-4m7w-qmgq-4wj5, GHSA-63hw-fmq6-xxg2, GHSA-9x8q-7h8h-wcw9, GHSA-cq5v-8q36-5273, GHSA-g3cq-j2xw-wf74, GHSA-hpj7-wq8m-9hgp, GHSA-mfx4-hv73-q22v, GHSA-mq44-7p77-q5h7, GHSA-xcgm-r5h9-7989, PYSEC-2026-2107, PYSEC-2026-2108, PYSEC-2026-2109, PYSEC-2026-2110, PYSEC-2026-2111, PYSEC-2026-2112, PYSEC-2026-2113, PYSEC-2026-237, PYSEC-2026-3545, PYSEC-2026-3546, PYSEC-2026-3547 View evidence and analysis receiptdepintel verdict:
|
| Signal | Result |
|---|---|
| Version delta | patch |
| Repo usage scanned | yes (66 site(s)) |
| Usage ∩ changed API | 1 |
| Static API findings | 0 |
| Release-note findings (LLM) | 1 |
| Changelog red-flag terms | 4 |
| Package type | import library |
| Dependency scope | runtime (pyproject [tool.poetry.dependencies]) |
| CI on this PR | failing (11/16 checks green) |
🔴 CI is failing on this PR (5/16 checks). Inspect the failures before considering this update.
Basis: usage intersects behavior changes, but call-site exposure analysis was unavailable — impact UNMEASURED (auto re-review queued) [shadow:verify:full=unknown] [lattice-acting: fold=caution takes the seat; assembly said unknown (recorded as shadow); receipts in causes ledger]
Touched symbols:
TCPConnector
Findings:
aiohttp.TCPConnector(behavior_change, llm, confidence 0.90)- TCPConnector now rejects legacy non-canonical numeric IPv4 host forms with InvalidUrlClientError.
- Evidence: Changed :class:
~aiohttp.TCPConnectorto reject legacy non-canonical numeric IPv4 host forms such as2130706433,017700000001and127.1with :exc:~aiohttp.InvalidUrlClientError; only canonical dotted-quad IPv4 literals are now treated as IP address literals, while every other host is sent through the configured resolver - Source: https://github.com/aio-libs/aiohttp/releases/tag/v3.14.1
Run: 20260815T094113Z-51f818a68e6f
Evidence is static analysis plus release evidence available to depintel at run time. This advisory verdict is not a substitute for maintainer review.
depintel-bot
Bot
added
lapisa:caution
Bumps aiohttp from 3.14.0 to 3.14.3.
Changelog
Sourced from aiohttp's changelog.
... (truncated)
Commits
5e392ceRelease v3.14.3 (#13225)49f65d5[PR #13222/f4866933 backport][3.14] Build C parser error message from bounded...240099e[PR #13180/ee53d655 backport][3.14] drop every copy of credential headers on ...d93f30aBump version (#13202)c1b9212Release v3.14.2 (#13201)380d4b5[PR #13054/ed8b040c backport][3.14] escape backslashes in digest auth quoted-...e1e1beeMake llhttp method array size dynamic (#13174) (#13196)aa4cf29[PR #13170/2b906869 backport][3.14] Fix StreamResponse.last_modified rounding...71b57b4[PR #13172/a57747ed backport][3.14] Fix C parser folding fragment into query_...64a03fb[PR #13169/1adc0cd7 backport][3.14] Upgrade http:// to https:// in README.rst...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.