mirror of
https://github.com/evroon/bracket.git
synced 2026-07-31 10:16:46 -04:00
05811b8c14
Bumps [aiohttp](https://github.com/aio-libs/aiohttp) from 3.14.0 to 3.14.1. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst">aiohttp's changelog</a>.</em></p> <blockquote> <h1>3.14.1 (2026-06-07)</h1> <h2>Bug fixes</h2> <ul> <li> <p>Fixed a race condition in :py:class:<code>~aiohttp.TCPConnector</code> where closing the connector while a DNS resolution was in-flight could raise :py:exc:<code>AttributeError</code> instead of :py:exc:<code>~aiohttp.ClientConnectionError</code> -- by :user:<code>goingforstudying-ctrl</code>.</p> <p><em>Related issues and pull requests on GitHub:</em> :issue:<code>12497</code>.</p> </li> <li> <p>Fixed <code>CancelledError</code> not closing a connection -- by :user:<code>aiolibsbot</code>.</p> <p><em>Related issues and pull requests on GitHub:</em> :issue:<code>12795</code>.</p> </li> <li> <p>Tightened up some websocket parser checks -- by :user:<code>Dreamsorcerer</code>.</p> <p><em>Related issues and pull requests on GitHub:</em> :issue:<code>12817</code>.</p> </li> <li> <p>Fixed :class:<code>~aiohttp.CookieJar</code> dropping the host-only flag of cookies when persisted with :meth:<code>~aiohttp.CookieJar.save</code> and reloaded with :meth:<code>~aiohttp.CookieJar.load</code>, so a cookie set without a <code>Domain</code> attribute is again scoped to the exact host that set it after a reload; the absolute expiration deadline is now persisted as well, so a reloaded cookie keeps its original lifetime instead of being rescheduled from the load time. :meth:<code>~aiohttp.CookieJar.load</code> now replaces the jar contents rather than merging onto prior state, and loaded cookies pass through the same acceptance rules as :meth:<code>~aiohttp.CookieJar.update_cookies</code>, so a cookie for an IP-address host is dropped when loaded into a jar created without <code>unsafe=True</code> -- by :user:<code>bdraco</code>.</p> <p><em>Related issues and pull requests on GitHub:</em> :issue:<code>12824</code>.</p> </li> <li> <p>Scoped :class:<code>~aiohttp.DigestAuthMiddleware</code> credentials to the origin of the first request it handles, so a redirect to a different origin no longer triggers a digest response computed from the configured credentials; a challenge from another origin is only answered when that origin falls within a protection space advertised by the anchor origin through the RFC 7616 <code>domain</code> directive -- by :user:<code>bdraco</code>.</p> <p><em>Related issues and pull requests on GitHub:</em> :issue:<code>12825</code>.</p> </li> <li> <p>Fixed the C HTTP parser not enforcing <code>max_line_size</code> on a request target or response reason phrase that is split across multiple reads; each fragment was checked on its own, so an accumulated line could exceed the limit without raising <code>LineTooLong</code>. The accumulated length is now checked, matching the pure-Python parser -- by :user:<code>bdraco</code>.</p> <p><em>Related issues and pull requests on GitHub:</em></p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="9c35d03aa5"><code>9c35d03</code></a> Release v3.14.1 (<a href="https://redirect.github.com/aio-libs/aiohttp/issues/12864">#12864</a>)</li> <li><a href="38b956c617"><code>38b956c</code></a> [PR <a href="https://redirect.github.com/aio-libs/aiohttp/issues/12861">#12861</a>/59684b5c backport][3.14] Revert "Drop list compression (<a href="https://redirect.github.com/aio-libs/aiohttp/issues/12857">#12857</a>)" (...</li> <li><a href="8f3100960f"><code>8f31009</code></a> [PR <a href="https://redirect.github.com/aio-libs/aiohttp/issues/12857">#12857</a>/69dff14d backport][3.14] Drop list compression (<a href="https://redirect.github.com/aio-libs/aiohttp/issues/12858">#12858</a>)</li> <li><a href="dfdfa9d5aa"><code>dfdfa9d</code></a> [PR <a href="https://redirect.github.com/aio-libs/aiohttp/issues/12830">#12830</a>/93a2b1c3 backport][3.14] Bound pipelined request queue per connect...</li> <li><a href="0e9cedd995"><code>0e9cedd</code></a> [PR <a href="https://redirect.github.com/aio-libs/aiohttp/issues/12827">#12827</a>/ccf218ab backport][3.14] Numeric ipv4 resolver bypass (<a href="https://redirect.github.com/aio-libs/aiohttp/issues/12849">#12849</a>)</li> <li><a href="a762eda524"><code>a762eda</code></a> [PR <a href="https://redirect.github.com/aio-libs/aiohttp/issues/12831">#12831</a>/1ac92dae backport][3.14] Payload close on disconnect (<a href="https://redirect.github.com/aio-libs/aiohttp/issues/12843">#12843</a>)</li> <li><a href="a329a7aaca"><code>a329a7a</code></a> [PR <a href="https://redirect.github.com/aio-libs/aiohttp/issues/12824">#12824</a>/60b85e98 backport][3.14] Preserve host-only cookie scope across Co...</li> <li><a href="4f7480e474"><code>4f7480e</code></a> [PR <a href="https://redirect.github.com/aio-libs/aiohttp/issues/12828">#12828</a>/13b635d7 backport][3.14] Bounded unread compressed drain (<a href="https://redirect.github.com/aio-libs/aiohttp/issues/12845">#12845</a>)</li> <li><a href="5ab61bb4cd"><code>5ab61bb</code></a> [PR <a href="https://redirect.github.com/aio-libs/aiohttp/issues/12826">#12826</a>/36df6c13 backport][3.14] Enforce max_line_size on fragmented reque...</li> <li><a href="3912667ae5"><code>3912667</code></a> [3.14] Add test that env proxy auth is scoped to the redirect-selected proxy ...</li> <li>Additional commits viewable in <a href="https://github.com/aio-libs/aiohttp/compare/v3.14.0...v3.14.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/evroon/bracket/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>