chore(deps): bump aiohttp from 3.13.3 to 3.14.3 in /envs/qed_math_env

[dependabot]

Bumps aiohttp from 3.13.3 to 3.14.3.

Changelog

Sourced from aiohttp's changelog.

3.14.3 (2026-07-22)

Bug fixes

• Fixed the client dropping only the first Authorization, Cookie and Proxy-Authorization header when a redirect crossed an origin -- by :user:arshsmith1.

  Related issues and pull requests on GitHub: :issue:13180.

• Fixed error message construction in the C HTTP parser -- by :user:bdraco.

  Related issues and pull requests on GitHub: :issue:13222.

---

3.14.2 (2026-07-20)

Bug fixes

• Fixed :py:attr:~aiohttp.web.StreamResponse.last_modified rounding a :class:datetime.datetime with a fractional second down.

  Related issues and pull requests on GitHub: :issue:5303.

• Fixed resolving localhost on Windows to fall back without AI_ADDRCONFIG when the first lookup fails, so localhost still works without an active network.

  Related issues and pull requests on GitHub: :issue:5357.

... (truncated)

Commits

• 5e392ce Release v3.14.3 (#13225)
• 49f65d5 [PR #13222/f4866933 backport][3.14] Build C parser error message from bounded...
• 240099e [PR #13180/ee53d655 backport][3.14] drop every copy of credential headers on ...
• d93f30a Bump version (#13202)
• c1b9212 Release v3.14.2 (#13201)
• 380d4b5 [PR #13054/ed8b040c backport][3.14] escape backslashes in digest auth quoted-...
• e1e1bee Make llhttp method array size dynamic (#13174) (#13196)
• aa4cf29 [PR #13170/2b906869 backport][3.14] Fix StreamResponse.last_modified rounding...
• 71b57b4 [PR #13172/a57747ed backport][3.14] Fix C parser folding fragment into query_...
• 64a03fb [PR #13169/1adc0cd7 backport][3.14] Upgrade http:// to https:// in README.rst...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Note

Low Risk
Dependency lock update with no application code changes; risk is limited to transitive HTTP client behavior in the math env.

Overview
Updates envs/qed_math_env/uv.lock only: bumps aiohttp from 3.13.3 to 3.14.3 (minor release with client redirect/credential-header fixes, HTTP parser fixes, and related 3.14.x patches per upstream changelog).

The lock refresh also records typing-extensions as an aiohttp dependency on Python < 3.13, expands pinned wheels (e.g. win_arm64, mobile targets), and simplifies secretstorage markers so cryptography and jeepney are no longer gated by platform/Python version in the lock metadata.

^{Reviewed by Cursor Bugbot for commit 7406456. Bugbot is set up for automated code reviews on this repo. Configure here.}

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[cursor]

Alignment Review Report

Automated dependabot bump — aiohttp 3.13.3 → 3.14.3 in envs/qed_math_env (single file, lock-only). Reviewed with the two-tier model.

Automated Checks

• Lint: PASS / N/A — uv.lock & TOML are not linted, and this PR changes zero .py files. .claude/hooks/lint.sh does exit non-zero, but only on ~25 pre-existing formatting candidates in unrelated envs (chat_env, coding_tools_env, opencode_env, pi_env, repl_env, …); qed_math_env is not among them, and CI never ruff-checks envs/**.
• Debug code: CLEAN — check-debug.sh scans src/ only; this PR touches no src/ file. All hook hits are pre-existing (console.print CLI output, doc-example print()s).

Bump verification

• Transitive → lock-only is correct: aiohttp is not pinned in qed_math_env/pyproject.toml (it comes in via datasets → fsspec[http] → aiohttp); no other pin exists, so uv.lock is the only correct place to change and pyproject.toml is rightly untouched.
• Hashes real / compatible: sdist aiohttp-3.14.3.tar.gz sha256 9491196…7844bc + size 7971213 match PyPI exactly; requires_python >=3.10 satisfies the env; not yanked; 3.14.3 has no open advisories.
• Security-positive ✅: 3.13.x → 3.14.x pulls in fixes for CVE-2026-34993 (arbitrary code execution via CookieJar.load() on untrusted input, fixed 3.14.0) and the CVE-2026-54273…54280 cluster incl. zip-bomb DoS CVE-2026-54278 (fixed 3.14.1).
• “Born-clean” lock: already fully on pypi.org/simple (0 HF-mirror refs) and already revision = 3 — so there is no index-source flip and no revision bump in this diff (the usual dependabot lock side-effects don’t apply here).
• Benign side-effect: the re-resolve added aiohttp’s conditional typing-extensions dep and normalized secretstorage’s cryptography/jeepney markers to unconditional — no resolved versions change on any real platform.

Open RFCs Context

All RFCs are In Review (000–005) or Draft (010). None govern packaging / dependency management / the PyPI index, so none are implicated by a lock bump.

Tier 1: Fixes Required

• None.

Tier 2: Alignment Discussion

Principle conflicts: None — no Gym API, reward, client/server, MCP/WebSocket, container, or credential surface is touched.

RFC conflicts: None.

Process note (recurring, non-blocking):

ALIGNMENT FLAG: dependabot exclude-paths bypass

• At stake: dependency-update policy in .github/dependabot.yml
• The concern: the uv updater is configured with directory: "/" + exclude-paths: ["envs/**"], yet this native dependabot/uv/envs/qed_math_env/… PR edits under envs/**. The uv ecosystem doesn’t appear to honor exclude-paths (the aggregate codex/dependabot-envs-* roll-ups are the intended channel). Benign for this PR; noting it as a policy question, not a blocker.
• Suggested reviewer: @burtenshaw (author of .github/dependabot.yml, incl. the exclude-paths lines)

Summary

• 0 mechanical issues to fix
• 1 non-blocking process point for human review (dependabot exclude-paths bypass)
• 0 RFC conflicts

Clean, security-positive, born-clean transitive lock bump — no alignment concerns.

  

_{Sent by Cursor Automation: Pre-review}

[cursor]

aiohttp 3.13.3 → 3.14.3 — transitive via datasets → fsspec[http] (only fsspec depends on it in this lock), so a lock-only change with pyproject.toml untouched is correct.

Security-positive bump: 3.14.x fixes CVE-2026-34993 (RCE via CookieJar.load() on untrusted input, fixed 3.14.0) and the CVE-2026-54273…54280 cluster incl. zip-bomb DoS CVE-2026-54278 (fixed 3.14.1).

Verified against PyPI: sdist sha256 9491196…7844bc + size 7971213 match; requires_python >=3.10 ✓; not yanked.

[cursor]

Benign re-resolution side-effect (not part of the aiohttp bump itself): the resolver normalized secretstorage’s cryptography/jeepney markers from a complex conditional to unconditional. secretstorage only installs on Linux (sys_platform == 'linux' at its use-site), so the effective dependency set is unchanged on real platforms — cosmetic marker cleanup, no action needed.

[burtenshaw]

Closing in favor of aggregate env Dependabot PR #1015.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.