dependabot[bot] 05811b8c14 Bump aiohttp from 3.14.0 to 3.14.1 in /backend (#1748) ...

Bumps [aiohttp](https://github.com/aio-libs/aiohttp) from 3.14.0 to
3.14.1.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst">aiohttp's
changelog</a>.</em></p>
<blockquote>
<h1>3.14.1 (2026-06-07)</h1>
<h2>Bug fixes</h2>
<ul>
<li>
<p>Fixed a race condition in
:py:class:<code>~aiohttp.TCPConnector</code> where closing the connector
while a DNS resolution was in-flight could raise
:py:exc:<code>AttributeError</code> instead of
:py:exc:<code>~aiohttp.ClientConnectionError</code> -- by
:user:<code>goingforstudying-ctrl</code>.</p>
<p><em>Related issues and pull requests on GitHub:</em>
:issue:<code>12497</code>.</p>
</li>
<li>
<p>Fixed <code>CancelledError</code> not closing a connection -- by
:user:<code>aiolibsbot</code>.</p>
<p><em>Related issues and pull requests on GitHub:</em>
:issue:<code>12795</code>.</p>
</li>
<li>
<p>Tightened up some websocket parser checks -- by
:user:<code>Dreamsorcerer</code>.</p>
<p><em>Related issues and pull requests on GitHub:</em>
:issue:<code>12817</code>.</p>
</li>
<li>
<p>Fixed :class:<code>~aiohttp.CookieJar</code> dropping the host-only
flag of cookies when persisted with
:meth:<code>~aiohttp.CookieJar.save</code> and reloaded with
:meth:<code>~aiohttp.CookieJar.load</code>, so a cookie set without a
<code>Domain</code> attribute is again scoped to the exact host that set
it after a reload; the absolute expiration deadline is now persisted as
well, so a reloaded cookie keeps its original lifetime instead of being
rescheduled from the load time.
:meth:<code>~aiohttp.CookieJar.load</code> now replaces the jar contents
rather than merging onto prior state, and loaded cookies pass through
the same acceptance rules as
:meth:<code>~aiohttp.CookieJar.update_cookies</code>, so a cookie for an
IP-address host is dropped when loaded into a jar created without
<code>unsafe=True</code> -- by :user:<code>bdraco</code>.</p>
<p><em>Related issues and pull requests on GitHub:</em>
:issue:<code>12824</code>.</p>
</li>
<li>
<p>Scoped :class:<code>~aiohttp.DigestAuthMiddleware</code> credentials
to the origin of the first request it handles, so a redirect to a
different origin no longer triggers a digest response computed from the
configured credentials; a challenge from another origin is only answered
when that origin falls within a protection space advertised by the
anchor origin through the RFC 7616 <code>domain</code> directive -- by
:user:<code>bdraco</code>.</p>
<p><em>Related issues and pull requests on GitHub:</em>
:issue:<code>12825</code>.</p>
</li>
<li>
<p>Fixed the C HTTP parser not enforcing <code>max_line_size</code> on a
request target or response reason phrase that is split across multiple
reads; each fragment was checked on its own, so an accumulated line
could exceed the limit without raising <code>LineTooLong</code>. The
accumulated length is now checked, matching the pure-Python parser -- by
:user:<code>bdraco</code>.</p>
<p><em>Related issues and pull requests on GitHub:</em></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="9c35d03aa5"><code>9c35d03</code></a>
Release v3.14.1 (<a
href="https://redirect.github.com/aio-libs/aiohttp/issues/12864">#12864</a>)</li>
<li><a
href="38b956c617"><code>38b956c</code></a>
[PR <a
href="https://redirect.github.com/aio-libs/aiohttp/issues/12861">#12861</a>/59684b5c
backport][3.14] Revert &quot;Drop list compression (<a
href="https://redirect.github.com/aio-libs/aiohttp/issues/12857">#12857</a>)&quot;
(...</li>
<li><a
href="8f3100960f"><code>8f31009</code></a>
[PR <a
href="https://redirect.github.com/aio-libs/aiohttp/issues/12857">#12857</a>/69dff14d
backport][3.14] Drop list compression (<a
href="https://redirect.github.com/aio-libs/aiohttp/issues/12858">#12858</a>)</li>
<li><a
href="dfdfa9d5aa"><code>dfdfa9d</code></a>
[PR <a
href="https://redirect.github.com/aio-libs/aiohttp/issues/12830">#12830</a>/93a2b1c3
backport][3.14] Bound pipelined request queue per connect...</li>
<li><a
href="0e9cedd995"><code>0e9cedd</code></a>
[PR <a
href="https://redirect.github.com/aio-libs/aiohttp/issues/12827">#12827</a>/ccf218ab
backport][3.14] Numeric ipv4 resolver bypass (<a
href="https://redirect.github.com/aio-libs/aiohttp/issues/12849">#12849</a>)</li>
<li><a
href="a762eda524"><code>a762eda</code></a>
[PR <a
href="https://redirect.github.com/aio-libs/aiohttp/issues/12831">#12831</a>/1ac92dae
backport][3.14] Payload close on disconnect (<a
href="https://redirect.github.com/aio-libs/aiohttp/issues/12843">#12843</a>)</li>
<li><a
href="a329a7aaca"><code>a329a7a</code></a>
[PR <a
href="https://redirect.github.com/aio-libs/aiohttp/issues/12824">#12824</a>/60b85e98
backport][3.14] Preserve host-only cookie scope across Co...</li>
<li><a
href="4f7480e474"><code>4f7480e</code></a>
[PR <a
href="https://redirect.github.com/aio-libs/aiohttp/issues/12828">#12828</a>/13b635d7
backport][3.14] Bounded unread compressed drain (<a
href="https://redirect.github.com/aio-libs/aiohttp/issues/12845">#12845</a>)</li>
<li><a
href="5ab61bb4cd"><code>5ab61bb</code></a>
[PR <a
href="https://redirect.github.com/aio-libs/aiohttp/issues/12826">#12826</a>/36df6c13
backport][3.14] Enforce max_line_size on fragmented reque...</li>
<li><a
href="3912667ae5"><code>3912667</code></a>
[3.14] Add test that env proxy auth is scoped to the redirect-selected
proxy ...</li>
<li>Additional commits viewable in <a
href="https://github.com/aio-libs/aiohttp/compare/v3.14.0...v3.14.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=aiohttp&package-manager=uv&previous-version=3.14.0&new-version=3.14.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/evroon/bracket/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

2026-07-28 12:04:35 +00:00

345 KiB

Raw Permalink Blame History

View Raw