build(deps): bump aiohttp from 3.14.1 to 3.14.3 - #3576
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0c6a930256
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| [[package]] | ||
| name = "aiohttp" | ||
| version = "3.14.1" | ||
| version = "3.14.3" |
There was a problem hiding this comment.
Given the documented Rye/pip setup paths, this bump only affects uv-based installs: both requirements.lock:15 and requirements-dev.lock:15 still pin aiohttp==3.14.1, while contributor setup and CI install through rye sync --all-features or pip install -r requirements-dev.lock (CONTRIBUTING.md:19, CONTRIBUTING.md:37, .github/workflows/ci.yml:47). In those environments the PR will continue installing and testing the old aiohttp version, so the dependency update does not actually take effect unless the Rye lockfiles are regenerated as well.
Useful? React with 👍 / 👎.
Bumps [aiohttp](https://github.com/aio-libs/aiohttp) from 3.14.1 to 3.14.3. - [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst) - [Commits](aio-libs/aiohttp@v3.14.1...v3.14.3) --- updated-dependencies: - dependency-name: aiohttp dependency-version: 3.14.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
0c6a930 to
d6046b2
Compare
jbeckwith-oai
left a comment
jbeckwith-oai
left a comment
There was a problem hiding this comment.
[P2] Raise the shipped aiohttp floor to the patched release
This change updates only uv.lock. The published aiohttp extra still allows aiohttp>=3.14.1, and requirements.lock / requirements-dev.lock (which Rye-backed CI installs) still resolve 3.14.1. GHSA-cq5v-8q36-5273 affects aiohttp <=3.14.2 and is fixed in 3.14.3; a malformed server response can trigger an out-of-bounds heap read and client DoS. Please raise the optional-dependency floor to >=3.14.3, update the two hard-coded validation expectations, and regenerate all relevant lockfiles so both downstream users and CI use the patched release.
[P1] Preserve the release-please marker
The lock refresh removes # x-release-please-version from the root openai package version. uv.lock is configured as a release-please extra-file, and that marker is what lets the generic updater find the version. Restore the comment so future release PRs continue updating the lockfile version.
Everything else checked out: the 119 locked aiohttp artifacts exactly match PyPI, supported Python/platform coverage is complete, aiohttp 3.14.3 is compatible with the SDK adapter in targeted tests and a live local request smoke test, and the release has had an 11-day cooling-off period.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d6046b2ba1
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| [[package]] | ||
| name = "openai" | ||
| version = "2.53.0" # x-release-please-version | ||
| version = "2.53.0" |
There was a problem hiding this comment.
Removing # x-release-please-version here breaks the release automation path I checked: .github/workflows/create-releases.yml runs Release Please with release-please-config.json, and that config lists uv.lock under extra-files. Since uv.lock is not a TOML file that Release Please can target by a configured jsonpath, the inline marker is what tells the generic updater which version to rewrite; without it, the next automated release PR can update src/openai/_version.py while leaving the editable openai package entry in uv.lock stale.
Useful? React with 👍 / 👎.
1 participant
Bumps aiohttp from 3.14.1 to 3.14.3.
Changelog
Sourced from aiohttp's changelog.
... (truncated)
Commits
5e392ceRelease v3.14.3 (#13225)49f65d5[PR #13222/f4866933 backport][3.14] Build C parser error message from bounded...240099e[PR #13180/ee53d655 backport][3.14] drop every copy of credential headers on ...d93f30aBump version (#13202)c1b9212Release v3.14.2 (#13201)380d4b5[PR #13054/ed8b040c backport][3.14] escape backslashes in digest auth quoted-...e1e1beeMake llhttp method array size dynamic (#13174) (#13196)aa4cf29[PR #13170/2b906869 backport][3.14] Fix StreamResponse.last_modified rounding...71b57b4[PR #13172/a57747ed backport][3.14] Fix C parser folding fragment into query_...64a03fb[PR #13169/1adc0cd7 backport][3.14] Upgrade http:// to https:// in README.rst...