[Snyk] Security upgrade aiohttp from 3.8.6 to 3.13.4

[revan-zhang]

Snyk has created this PR to fix 10 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

• python/requirements-optional.txt

⚠️ Warning

web3 6.20.4 requires aiohttp, which is not installed.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.
• Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling
🦉 Information Exposure

---

---

Note

Low Risk
Low risk dependency-list change that only adds a pinned aiohttp version; main impact is potential install/compatibility issues for optional Python environments.

Overview
Pins aiohttp>=3.13.4 in python/requirements-optional.txt to address Snyk-reported vulnerabilities, adding it as an explicit optional dependency (even though it is not directly required).

^{Written by Cursor Bugbot for commit eadfd64. This will update automatically on new commits. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​aiohttp@​3.13.5

View full report

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[revan-zhang]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Missing Python version marker for aiohttp dependency

Medium Severity

The newly added aiohttp>=3.13.4 requires Python >= 3.9, but this project supports Python >= 3.6 (per setup.py) and ^3.7 (per pyproject.toml). The dependency is missing a Python version environment marker like ; python_version>='3.9', which other entries in this same file already use (e.g., rlp). Installing optional dependencies on Python 3.7 or 3.8 will fail to resolve aiohttp.