Repository navigation
chore(deps): Bump aiohttp from 3.14.0 to 3.14.4 - #237
dependabot[bot] wants to merge 1 commit into
Conversation
--- updated-dependencies: - dependency-name: aiohttp dependency-version: 3.14.4 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
⏳ Analysis QueuedYour fossabot analysis was queued at fossabot will update this comment as the analysis progresses. |
App impact analysis skipped — out of creditsBreaking change detection completed but more credits are needed to enable usage detection, impact analysis, fix suggestions, and get your final upgrade determination. aiohttp We found 5 breaking changes and 2 deprecations.
View more changes for aiohttp
...and 247 more in the full analysis Full analysis skipped — out of credits. Re-run with |
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
App impact analysis skipped — out of creditsBreaking change detection completed but more credits are needed to enable usage detection, impact analysis, fix suggestions, and get your final upgrade determination. aiohttp We found 5 breaking changes and 2 deprecations.
View more changes for aiohttp
...and 247 more in the full analysis Full analysis skipped — out of credits. Re-run with |
|
🟠 Review before merging3 third-party packages in this PR: 1 safe, 2 caution. 🟠🟣 Review one behavior before mergingA documented behavior change intersects with repository usage; impact depends on the inputs reaching the changed code path. Security advisory: GHSA-2fqr-mr3j-6wp8, GHSA-2g87-pp6c-29x5, GHSA-494j-54xm-rwp3, GHSA-4fvr-rgm6-gqmc, GHSA-4m7w-qmgq-4wj5, GHSA-5wr8-gcqf-gqf3, GHSA-63hw-fmq6-xxg2, GHSA-9x8q-7h8h-wcw9, GHSA-cq5v-8q36-5273, GHSA-g3cq-j2xw-wf74, GHSA-hpj7-wq8m-9hgp, GHSA-mfx4-hv73-q22v, GHSA-mq44-7p77-q5h7, GHSA-xcgm-r5h9-7989, PYSEC-2026-2107, PYSEC-2026-2108, PYSEC-2026-2109, PYSEC-2026-2110, PYSEC-2026-2111, PYSEC-2026-2112, PYSEC-2026-2113, PYSEC-2026-237, PYSEC-2026-3545, PYSEC-2026-3546, PYSEC-2026-3547 View evidence and analysis receiptdepintel verdict:
|
| Signal | Result |
|---|---|
| Version delta | patch |
| Repo usage scanned | yes (66 site(s)) |
| Usage ∩ changed API | 1 |
| Static API findings | 0 |
| Release-note findings (LLM) | 1 |
| Changelog red-flag terms | 16 |
| Package type | import library |
| Dependency scope | runtime (pyproject [tool.poetry.dependencies]) |
| CI on this PR | failing (11/16 checks green) |
| Non-Python payload changed | 15 file(s) under aiohttp (.hash x8, .c x3, .pxd x2, .pxi x1, .pyx x1; 368 KiB moved) — not covered by the API diff |
🔴 CI is failing on this PR (5/16 checks) — newly failing with this change (green on the base commit): build (3.10, 2.3.2), build (3.11, 2.3.2), build (3.12, 2.3.2), build (3.13, 2.3.2), build (3.14, 2.3.2). Inspect the new failures before considering this update.
Basis: behavior change intersects usage; breaking requires positive exposure proof ('likely'), not intersection alone [wheel matrix: declared wheel platform coverage shrank: lost 2: android_21_arm64_v8a, android_21_x86_64] [shadow:verify-2:full=caution] [shadow:shadow-verify-nemo:full=caution]
Touched symbols:
TCPConnector
Call-site exposure analysis: possible — 🟡 possible — cannot be ruled out from the visible code
aiohttp.TCPConnector→ possible [requires spec-illegal input]: judge.py:107 builds TCPConnector and then session.get(url=self.url). self.url is the Judge constructor argument (self.url=url; host=urlparse(url).netloc). Default get_judges() URLs are all DNS hostnames (httpbin.org, azenv.net, …) and cannot trigger the change. Custom judges flow Broker.init (self._judges=judges) → Checker → get_judges → Judge(j), so a caller can pass a non-canonical IPv4 URL such as http://127.1/. Before the request, check() does self._resolver.resolve(self.host) and returns on ResolveError; host_is_ip uses stdlib ipaddress, which rejects 127.1/2130706433/017700000001, so those names go to aiodns. resolve() itself was unresolvable, so a successful lookup (or getaddrinfo-style fallback) cannot be ruled out; if it succeeds, session.get(self.url) still uses the original non-canonical host and would hit InvalidUrlClientError. SMTP judges return before the connector.aiohttp.TCPConnector→ none: resolver.py:214 builds TCPConnector(family=family) and fetchescandidatesvia _try_endpoint. Resolver._ip_hosts is a class-level list of exactly seven well-known hostname URLs (api64.ipify.org, wtfismyip.com, api.ipify.org, ipinfo.io, ipv4.icanhazip.com, myexternalip.com, ifconfig.io); _probe_family comments refer to “7 candidates × 5s”, matching that list. None of those hosts are numeric IPv4 in any form. No self._ip_hosts assignment exists, so the list is not rewritten in-repo. The changed rejection of non-canonical IPv4 literals cannot fire on these URLs.
Findings:
aiohttp.TCPConnector(behavior_change, llm, confidence 1.00)- TCPConnector now rejects non-canonical numeric IPv4 host forms, raising InvalidUrlClientError instead of treating them as IP literals.
- Evidence:
Changed :class:'~aiohttp.TCPConnector' to reject legacy non-canonical numeric IPv4 host forms such as ''2130706433'', ''017700000001'' and ''127.1'' with :exc:'~aiohttp.InvalidUrlClientError'; only canonical dotted-quad IPv4 literals are now treated as IP address literals, while every other host is sent through the configured resolver - Source: https://github.com/aio-libs/aiohttp/releases/tag/V1
Run: 20261020T045436Z-494ce958b398
Evidence is static analysis plus release evidence available to depintel at run time. This advisory verdict is not a substitute for maintainer review.
🟢 Ready to merge
Lapisa checked propcache 0.2.0 → 0.5.4 against the interfaces this repository uses; no affected usage was found.
View evidence and analysis receipt
depintel verdict: safe
Package: propcache 0.2.0 -> 0.5.4
review 5af727651f5e · engine b5b0bc86
⚠️ DEGRADED REVIEW — anomaly: changelog is 13977 chars and the semantic lane DID NOT RUN (early-exit path — by design); prose of this size was judged by the deterministic lanes alone. Treat this verdict as weaker evidence than usual; this is a property of the update itself (not an outage), so no automatic re-review is scheduled; a new push to this PR triggers a fresh review.
Impact: NONE found — OK to merge on this evidence.
No touched changed API surface and no changelog red flags were found.
| Signal | Result |
|---|---|
| Version delta | minor |
| Repo usage scanned | yes (0 site(s)) |
| Usage ∩ changed API | 0 |
| Static API findings | 0 |
| Release-note findings (LLM) | 0 |
| Changelog red-flag terms | 10 |
| Package type | import library |
| Dependency scope | runtime (transitive via direct dep 'aiohttp') |
| CI on this PR | failing (11/16 checks green) |
🔴 CI is failing on this PR (5/16 checks) — newly failing with this change (green on the base commit): build (3.10, 2.3.2), build (3.11, 2.3.2), build (3.12, 2.3.2), build (3.13, 2.3.2), build (3.14, 2.3.2). Inspect the new failures before considering this update.
Basis: untouched surface, clean changelog lexicon, machine-verified evidence bar (delta-blind by law) [window history: upstream yanked 0.4.0 inside this upgrade window — breakage admitted and withdrawn upstream; target version postdates the withdrawal] [wheel matrix: declared wheel platform coverage shrank: lost 5: manylinux1_i686, manylinux2014_i686, manylinux_2_17_i686, manylinux_2_5_i686, musllinux_1_2_i686] [env-facet: REACHES declared runtime linux — lost coverage on linux/i686 (install face of THIS repo may change)] [coverage: static-analyzer blind-spot signals in target tree (c_extension x1 (propcache-0.5.4/src/propcache/_helpers_c.pyx), computed_all x1 (propcache-0.5.4/packaging/pep517_backend/_backend.py)) — the zero-intersection claim covers Python-visible surface only] [shadow:verify-2:full=safe]
Run: 20261020T045436Z-494ce958b398
Evidence is static analysis plus release evidence available to depintel at run time. This advisory verdict is not a substitute for maintainer review.
🟠 Review one behavior before merging
Decide with these point(s): 1 named removal(s) (unsafe) — none intersect scanned usage; dynamic/transitive use is the residual question. | Upstream dropped support: Python 3.9, experimental free-threaded build of Python 3.13, hypothesis — does your environment rely on any of these?
View evidence and analysis receipt
depintel verdict: caution
Package: yarl 1.18.0 -> 1.25.1
review 2ed78a581c0a · engine b5b0bc86
Impact: LOW — this repository never imports yarl directly (0 usage sites found); the 1 upstream removal(s) can only bite through transitive/build-time paths. Skim findings, then merge.
Decide with these point(s): 1 named removal(s) (unsafe) — none intersect scanned usage; dynamic/transitive use is the residual question. | Upstream dropped support: Python 3.9, experimental free-threaded build of Python 3.13, hypothesis — does your environment rely on any of these?
Verifier audit: Engine caution is consistent with its own record: usage_scan is a decisive zero and exposure was correctly skipped, but safe is blocked by a non-clean lexicon (1 blocking term after attribution), unaccounted findings the API-tree blind spot withheld from machine clearing, refused unused-dependency/kwarg certificates, and an env-facet that REACHES declared runtime linux after losing i686 wheel coverage. Runtime dep_scope so C22v2 does not apply; empty intersection plus named residual install/lexicon risk is caution, not safe/unknown/breaking.
| Signal | Result |
|---|---|
| Version delta | minor |
| Repo usage scanned | yes (0 site(s)) |
| Usage ∩ changed API | 0 |
| Static API findings | 1 |
| Release-note findings (LLM) | 6 |
| Changelog red-flag terms | 13 |
| Package type | import library |
| Dependency scope | runtime (transitive via direct dep 'aiohttp') |
| CI on this PR | failing (11/16 checks green) |
🔴 CI is failing on this PR (5/16 checks) — newly failing with this change (green on the base commit): build (3.10, 2.3.2), build (3.11, 2.3.2), build (3.12, 2.3.2), build (3.13, 2.3.2), build (3.14, 2.3.2). Inspect the new failures before considering this update.
Basis: safe requires empty touched-surface intersection and clean lexicon scan — held by: changelog red-flag terms: no longer (12 other term(s) cleared by repo floor/platform/attribution); unaccounted findings: yarl._query.SimpleQuery [attribute_value_change]; Started raising a :exc:ValueError exception rais [behavior_change]; Made Cython line tracing opt-in via the ``with-cyt [behavior_change]; Dropped Python 3.9 support; Python 3.10 is the min [support_change] (+5 more); analyzability blind spot: API tree not enumerable for this layout (machine clearing of the holders above is withheld) [window history: upstream yanked 1.18.1, 1.18.2, 1.24.0, 1.24.1 inside this upgrade window — breakage admitted and withdrawn upstream; target version postdates the withdrawal] [wheel matrix: declared wheel platform coverage shrank: lost 6: manylinux1_i686, manylinux2014_i686, manylinux_2_17_i686, manylinux_2_5_i686, musllinux_1_2_i686, win32] [env-facet: REACHES declared runtime linux — lost coverage on linux/i686 (install face of THIS repo may change)] [parent-absorption: change absorbed at layer 1: no direct parent (aiohttp) references the changed surface] [shadow:verify-2:full=caution] [shadow:shadow-verify-nemo:full=caution]
Findings:
unsafe(api_removal, lexicon, confidence 0.90)- changelog states unsafe removed/expired
- Evidence:
- Removed the unused ''unsafe'' option from the internal unquoting classes; the unquoting done by :class:'~yarl.URL' never depended on it -- by :user:'bdraco'. - Source: https://github.com/aio-libs/yarl/actions?query=branch:master
unspecified(support_change, llm, confidence 1.00)- Python 3.9 support was dropped, raising the minimum Python version to 3.10.
- Evidence:
Dropped Python 3.9 support; Python 3.10 is the minimal supported Python version
unspecified(support_change, llm, confidence 1.00)- Dropped support for the experimental free-threaded build of Python 3.13
unspecified(support_change, llm, confidence 0.30)- hypothesis is no longer installed in the wheel-build test environment, which may affect downstream builds that rely on it.
- Evidence:
Stopped installing ''hypothesis'' in the wheel-build test environment.
unspecified(behavior_change, llm, confidence 0.90)- Changed exception type from IndexError to ValueError for corrupted IPv6 URLs.
- Evidence:
Started raising a :exc:'ValueError' exception raised for corrupted IPv6 URL values.
yarl.URL.query(behavior_change, llm, confidence 0.90)- URL.query and related methods changed behavior to match urllib.parse.parse_qsl, fixing a regression where empty fields were returned and invalid percent-encoded UTF-8 was kept as-is, and no longer double encode those escapes.
- Evidence:
Fixed :attr:'URL.query <yarl.URL.query>' returning empty fields and keeping invalid percent-encoded UTF-8 as is, a regression in 1.19.0. It matches :func:'urllib.parse.parse_qsl' again, and so do the methods built on it, :meth:'~yarl.URL.update_query', :meth:'~yarl.URL.without_query_params' and :meth:'~yarl.URL.human_repr', which also no longer double encode those escapes - Source: https://github.com/aio-libs/yarl/releases/tag/V2
unspecified(behavior_change, llm, confidence 0.80)- Changed default behavior of Cython line tracing from enabled to opt-in.
- Evidence:
Made Cython line tracing opt-in via the ''with-cython-tracing'' build config setting
tuple.__new__(behavior_change, lexicon, confidence 0.70)- changelog states tuple.new behavior changed
- Evidence:
''__getstate__'' now returns the raw 5-tuple instead of a ''SplitResult'' built via ''tuple.__new__'', so pickling no longer touches ''SplitResult'' serialization at all. - Source: https://github.com/aio-libs/yarl/actions?query=branch:master
yarl._query.SimpleQuery(attribute_value_change, griffe, confidence 0.95)- yarl/_query.py:11: SimpleQuery: Attribute value was changed: Union[str, int, float] -> Union[str, SupportsInt, float]
Run: 20261020T045436Z-494ce958b398
Evidence is static analysis plus release evidence available to depintel at run time. This advisory verdict is not a substitute for maintainer review.
depintel-bot
Bot
added
lapisa:caution
|
Looks like aiohttp is up-to-date now, so this is no longer needed. |
Bumps aiohttp from 3.14.0 to 3.14.4.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Summary by cubic
Updates
aiohttpfrom 3.14.0 to 3.14.4 inpoetry.lock. This patch release includes upstream bug and security fixes; no code changes are required.Written for commit 3742377. Summary will update on new commits.