chore(deps): bump aiohttp from 3.13.3 to 3.14.3 in /envs/qed_math_env - #1040
chore(deps): bump aiohttp from 3.13.3 to 3.14.3 in /envs/qed_math_env#1040dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [aiohttp](https://github.com/aio-libs/aiohttp) from 3.13.3 to 3.14.3. - [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst) - [Commits](aio-libs/aiohttp@v3.13.3...v3.14.3) --- updated-dependencies: - dependency-name: aiohttp dependency-version: 3.14.3 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
python:uv
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
Automated dependabot bump — aiohttp 3.13.3 → 3.14.3 in envs/qed_math_env (single file, lock-only). Reviewed with the two-tier model.
Automated Checks
- Lint: PASS / N/A —
uv.lock& TOML are not linted, and this PR changes zero.pyfiles..claude/hooks/lint.shdoes exit non-zero, but only on ~25 pre-existing formatting candidates in unrelated envs (chat_env,coding_tools_env,opencode_env,pi_env,repl_env, …);qed_math_envis not among them, and CI neverruff-checksenvs/**. - Debug code: CLEAN —
check-debug.shscanssrc/only; this PR touches nosrc/file. All hook hits are pre-existing (console.printCLI output, doc-exampleprint()s).
Bump verification
- Transitive → lock-only is correct: aiohttp is not pinned in
qed_math_env/pyproject.toml(it comes in viadatasets→fsspec[http]→ aiohttp); no other pin exists, souv.lockis the only correct place to change andpyproject.tomlis rightly untouched. - Hashes real / compatible: sdist
aiohttp-3.14.3.tar.gzsha2569491196…7844bc+ size7971213match PyPI exactly;requires_python >=3.10satisfies the env; not yanked; 3.14.3 has no open advisories. - Security-positive ✅: 3.13.x → 3.14.x pulls in fixes for CVE-2026-34993 (arbitrary code execution via
CookieJar.load()on untrusted input, fixed 3.14.0) and the CVE-2026-54273…54280 cluster incl. zip-bomb DoS CVE-2026-54278 (fixed 3.14.1). - “Born-clean” lock: already fully on
pypi.org/simple(0 HF-mirror refs) and alreadyrevision = 3— so there is no index-source flip and no revision bump in this diff (the usual dependabot lock side-effects don’t apply here). - Benign side-effect: the re-resolve added aiohttp’s conditional
typing-extensionsdep and normalizedsecretstorage’scryptography/jeepneymarkers to unconditional — no resolved versions change on any real platform.
Open RFCs Context
All RFCs are In Review (000–005) or Draft (010). None govern packaging / dependency management / the PyPI index, so none are implicated by a lock bump.
Tier 1: Fixes Required
- None.
Tier 2: Alignment Discussion
Principle conflicts: None — no Gym API, reward, client/server, MCP/WebSocket, container, or credential surface is touched.
RFC conflicts: None.
Process note (recurring, non-blocking):
ALIGNMENT FLAG: dependabot exclude-paths bypass
- At stake: dependency-update policy in
.github/dependabot.yml - The concern: the
uvupdater is configured withdirectory: "/"+exclude-paths: ["envs/**"], yet this nativedependabot/uv/envs/qed_math_env/…PR edits underenvs/**. Theuvecosystem doesn’t appear to honorexclude-paths(the aggregatecodex/dependabot-envs-*roll-ups are the intended channel). Benign for this PR; noting it as a policy question, not a blocker. - Suggested reviewer: @burtenshaw (author of
.github/dependabot.yml, incl. theexclude-pathslines)
Summary
- 0 mechanical issues to fix
- 1 non-blocking process point for human review (dependabot
exclude-pathsbypass) - 0 RFC conflicts
Clean, security-positive, born-clean transitive lock bump — no alignment concerns.
Sent by Cursor Automation: Pre-review
| [[package]] | ||
| name = "aiohttp" | ||
| version = "3.13.3" | ||
| version = "3.14.3" |
There was a problem hiding this comment.
aiohttp 3.13.3 → 3.14.3 — transitive via datasets → fsspec[http] (only fsspec depends on it in this lock), so a lock-only change with pyproject.toml untouched is correct.
Security-positive bump: 3.14.x fixes CVE-2026-34993 (RCE via CookieJar.load() on untrusted input, fixed 3.14.0) and the CVE-2026-54273…54280 cluster incl. zip-bomb DoS CVE-2026-54278 (fixed 3.14.1).
Verified against PyPI: sdist sha256 9491196…7844bc + size 7971213 match; requires_python >=3.10 ✓; not yanked.
| dependencies = [ | ||
| { name = "cryptography", marker = "(python_full_version < '3.11' and sys_platform == 'emscripten') or (python_full_version < '3.11' and sys_platform == 'win32') or (sys_platform != 'emscripten' and sys_platform != 'win32')" }, | ||
| { name = "jeepney", marker = "(python_full_version < '3.11' and sys_platform == 'emscripten') or (python_full_version < '3.11' and sys_platform == 'win32') or (sys_platform != 'emscripten' and sys_platform != 'win32')" }, | ||
| { name = "cryptography" }, |
There was a problem hiding this comment.
Benign re-resolution side-effect (not part of the aiohttp bump itself): the resolver normalized secretstorage’s cryptography/jeepney markers from a complex conditional to unconditional. secretstorage only installs on Linux (sys_platform == 'linux' at its use-site), so the effective dependency set is unchanged on real platforms — cosmetic marker cleanup, no action needed.
|
Closing in favor of aggregate env Dependabot PR #1015. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps aiohttp from 3.13.3 to 3.14.3.
Changelog
Sourced from aiohttp's changelog.
... (truncated)
Commits
5e392ceRelease v3.14.3 (#13225)49f65d5[PR #13222/f4866933 backport][3.14] Build C parser error message from bounded...240099e[PR #13180/ee53d655 backport][3.14] drop every copy of credential headers on ...d93f30aBump version (#13202)c1b9212Release v3.14.2 (#13201)380d4b5[PR #13054/ed8b040c backport][3.14] escape backslashes in digest auth quoted-...e1e1beeMake llhttp method array size dynamic (#13174) (#13196)aa4cf29[PR #13170/2b906869 backport][3.14] Fix StreamResponse.last_modified rounding...71b57b4[PR #13172/a57747ed backport][3.14] Fix C parser folding fragment into query_...64a03fb[PR #13169/1adc0cd7 backport][3.14] Upgrade http:// to https:// in README.rst...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Dependency lock update with no application code changes; risk is limited to transitive HTTP client behavior in the math env.
Overview
Updates
envs/qed_math_env/uv.lockonly: bumps aiohttp from 3.13.3 to 3.14.3 (minor release with client redirect/credential-header fixes, HTTP parser fixes, and related 3.14.x patches per upstream changelog).The lock refresh also records typing-extensions as an aiohttp dependency on Python < 3.13, expands pinned wheels (e.g. win_arm64, mobile targets), and simplifies
secretstoragemarkers socryptographyandjeepneyare no longer gated by platform/Python version in the lock metadata.Reviewed by Cursor Bugbot for commit 7406456. Bugbot is set up for automated code reviews on this repo. Configure here.