From db5e7efa6f902e3cffe7c09a0a7b9010065b3bfc Mon Sep 17 00:00:00 2001 From: Masen Furer Date: Tue, 4 Aug 2026 14:54:37 -0700 Subject: [PATCH] update aiohttp>=3.14.3 (CVE-2026-69244) --- docs/app/uv.lock | 2 +- pyproject.toml | 2 +- uv.lock | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/app/uv.lock b/docs/app/uv.lock index 2ae84bbb..7e6cbae6 100644 --- a/docs/app/uv.lock +++ b/docs/app/uv.lock @@ -1802,7 +1802,7 @@ provides-extras = ["reflex"] [package.metadata.requires-dev] codspeed = [{ name = "pytest-codspeed", specifier = ">=5,<6" }] dev = [ - { name = "aiohttp", specifier = ">=3.9" }, + { name = "aiohttp", specifier = ">=3.14.3" }, { name = "hypothesis", specifier = ">=6" }, { name = "pillow", specifier = ">=10" }, { name = "pyarrow", specifier = ">=15" }, diff --git a/pyproject.toml b/pyproject.toml index 82e286cf..5897587a 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -47,7 +47,7 @@ dev = [ "starlette>=0.36", # tests/reflex_adapter exercises the real socket data plane when the # `reflex` extra is installed in the main CI job. - "aiohttp>=3.9", + "aiohttp>=3.14.3", "uvicorn>=0.23", # Parses .binder/environment.yml in tests/test_binder_config.py so the # Binder contract is asserted on structure, not string transcription. diff --git a/uv.lock b/uv.lock index 607a9eb6..c9d6f19b 100644 --- a/uv.lock +++ b/uv.lock @@ -2228,7 +2228,7 @@ provides-extras = ["reflex"] [package.metadata.requires-dev] codspeed = [{ name = "pytest-codspeed", specifier = ">=5,<6" }] dev = [ - { name = "aiohttp", specifier = ">=3.9" }, + { name = "aiohttp", specifier = ">=3.14.3" }, { name = "hypothesis", specifier = ">=6" }, { name = "pillow", specifier = ">=10" }, { name = "pyarrow", specifier = ">=15" },