Repository navigation
chore(deps): Bump aiohttp from 3.14.0 to 3.14.3 - #235
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [aiohttp](https://github.com/aio-libs/aiohttp) from 3.14.0 to 3.14.3. - [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst) - [Commits](aio-libs/aiohttp@v3.14.0...v3.14.3) --- updated-dependencies: - dependency-name: aiohttp dependency-version: 3.14.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
⏳ Analysis QueuedYour fossabot analysis was queued at fossabot will update this comment as the analysis progresses. |
App impact analysis skipped — out of creditsBreaking change detection completed but more credits are needed to enable usage detection, impact analysis, fix suggestions, and get your final upgrade determination. aiohttp We found 2 breaking changes.
View more changes for aiohttp
...and 106 more in the full analysis You have no credits left. Reach out to autoupdates@fossa.com and we'll top you up. Credits are consumed when dependency updates are reviewed or proposed. Re-run with Mute out-of-credit notifications until next month (expires 2026-09-01T00:00:00.000Z) |
1 similar comment
App impact analysis skipped — out of creditsBreaking change detection completed but more credits are needed to enable usage detection, impact analysis, fix suggestions, and get your final upgrade determination. aiohttp We found 2 breaking changes.
View more changes for aiohttp
...and 106 more in the full analysis You have no credits left. Reach out to autoupdates@fossa.com and we'll top you up. Credits are consumed when dependency updates are reviewed or proposed. Re-run with Mute out-of-credit notifications until next month (expires 2026-09-01T00:00:00.000Z) |
|
🟠 Review before merging🟠🟣 Review one behavior before mergingA documented behavior change intersects with repository usage; impact depends on the inputs reaching the changed code path. Known-regression note: 3.14.2 shipped a defect fixed in 3.14.4 — consider jumping directly to 3.14.4 or later. Evidence: "- Fixed the WebSocket reader rejecting a compressed data frame with close code 1002 when a control frame arrived before the first data frame (regression in 3.14.2) -- by :user: Security advisory: GHSA-2fqr-mr3j-6wp8, GHSA-4fvr-rgm6-gqmc, GHSA-4m7w-qmgq-4wj5, GHSA-63hw-fmq6-xxg2, GHSA-9x8q-7h8h-wcw9, GHSA-cq5v-8q36-5273, GHSA-g3cq-j2xw-wf74, GHSA-hpj7-wq8m-9hgp, GHSA-mfx4-hv73-q22v, GHSA-mq44-7p77-q5h7, GHSA-xcgm-r5h9-7989, PYSEC-2026-2107, PYSEC-2026-2108, PYSEC-2026-2109, PYSEC-2026-2110, PYSEC-2026-2111, PYSEC-2026-2112, PYSEC-2026-2113, PYSEC-2026-237, PYSEC-2026-3545, PYSEC-2026-3546, PYSEC-2026-3547 View evidence and analysis receiptdepintel verdict:
|
| Signal | Result |
|---|---|
| Version delta | patch |
| Repo usage scanned | yes (66 site(s)) |
| Usage ∩ changed API | 1 |
| Static API findings | 0 |
| Release-note findings (LLM) | 1 |
| Changelog red-flag terms | 4 |
| Package type | import library |
| Dependency scope | runtime (pyproject [tool.poetry.dependencies]) |
| CI on this PR | failing (11/16 checks green) |
🔴 CI is failing on this PR (5/16 checks). Inspect the failures before considering this update.
Basis: behavior change intersects usage; breaking requires positive exposure proof ('likely'), not intersection alone [shadow:verify-2:full=caution]
Touched symbols:
TCPConnector
Call-site exposure analysis: possible — 🟡 possible — cannot be ruled out from the visible code
aiohttp.TCPConnector→ possible [fails loudly (clear exception); requires spec-illegal input]: Both call sites build a TCPConnector and then GET URLs whose host is what the new InvalidUrlClientError path inspects. (1) judge.py:107 does session.get(url=self.url). self.url is the Judge ctor arg (self.url=url; self.host=urlparse(url).netloc). get_judges() defaults are all DNS names (httpbin.org, azenv.net, proxy-listen.de, …) and SMTP URLs return before the connector, so defaults cannot hit the new rejection. But judges is a public Broker/Checker parameter with no shown host-form filter; a user URL like http://127.1/ or http://2130706433/ would be passed through. A prior self._resolver.resolve(self.host) may abort on ResolveError before GET, but Resolver.resolve was unresolvable, so that filter cannot be assumed. (2) resolver.py:214 (_probe_family) GETs eachcandidatesURL via _try_endpoint on that connector. The candidate list and _try_endpoint body could not be retrieved (unresolvable; evidence budget exhausted), so a non-canonical IPv4 host in a candidate cannot be ruled out. If the new path fires, aiohttp raises InvalidUrlClientError, which is not a subclass of the shown handlers (ClientOSError/ClientResponseError in judge.py; OSError around connector creation in resolver.py), so the failure is loud. Triggering requires non-canonical numeric IPv4 hosts (127.1, 2130706433, 017700000001), which are illegal under RFC 3986 §3.2.2 (IPv4address = four dec-octets).
Findings:
aiohttp.TCPConnector(behavior_change, llm, confidence 1.00)- TCPConnector now rejects non-canonical numeric IPv4 host forms, raising InvalidUrlClientError instead of treating them as IP literals.
- Evidence:
Changed :class:'~aiohttp.TCPConnector' to reject legacy non-canonical numeric IPv4 host forms such as ''2130706433'', ''017700000001'' and ''127.1'' with :exc:'~aiohttp.InvalidUrlClientError'; only canonical dotted-quad IPv4 literals are now treated as IP address literals, while every other host is sent through the configured resolver - Source: https://github.com/aio-libs/aiohttp/releases/tag/V1
Run: 20261017T125441Z-2a304d56f7f1
Evidence is static analysis plus release evidence available to depintel at run time. This advisory verdict is not a substitute for maintainer review.
depintel-bot
Bot
added
lapisa:caution
|
Superseded by #237. |
Bumps aiohttp from 3.14.0 to 3.14.3.
Changelog
Sourced from aiohttp's changelog.
... (truncated)
Commits
5e392ceRelease v3.14.3 (#13225)49f65d5[PR #13222/f4866933 backport][3.14] Build C parser error message from bounded...240099e[PR #13180/ee53d655 backport][3.14] drop every copy of credential headers on ...d93f30aBump version (#13202)c1b9212Release v3.14.2 (#13201)380d4b5[PR #13054/ed8b040c backport][3.14] escape backslashes in digest auth quoted-...e1e1beeMake llhttp method array size dynamic (#13174) (#13196)aa4cf29[PR #13170/2b906869 backport][3.14] Fix StreamResponse.last_modified rounding...71b57b4[PR #13172/a57747ed backport][3.14] Fix C parser folding fragment into query_...64a03fb[PR #13169/1adc0cd7 backport][3.14] Upgrade http:// to https:// in README.rst...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.