chore(deps): bump aiohttp from 3.14.0 to 3.14.3 in /envs/finrl_env

[dependabot]

Bumps aiohttp from 3.14.0 to 3.14.3.

Changelog

Sourced from aiohttp's changelog.

3.14.3 (2026-07-22)

Bug fixes

• Fixed the client dropping only the first Authorization, Cookie and Proxy-Authorization header when a redirect crossed an origin -- by :user:arshsmith1.

  Related issues and pull requests on GitHub: :issue:13180.

• Fixed error message construction in the C HTTP parser -- by :user:bdraco.

  Related issues and pull requests on GitHub: :issue:13222.

---

3.14.2 (2026-07-20)

Bug fixes

• Fixed :py:attr:~aiohttp.web.StreamResponse.last_modified rounding a :class:datetime.datetime with a fractional second down.

  Related issues and pull requests on GitHub: :issue:5303.

• Fixed resolving localhost on Windows to fall back without AI_ADDRCONFIG when the first lookup fails, so localhost still works without an active network.

  Related issues and pull requests on GitHub: :issue:5357.

... (truncated)

Commits

• 5e392ce Release v3.14.3 (#13225)
• 49f65d5 [PR #13222/f4866933 backport][3.14] Build C parser error message from bounded...
• 240099e [PR #13180/ee53d655 backport][3.14] drop every copy of credential headers on ...
• d93f30a Bump version (#13202)
• c1b9212 Release v3.14.2 (#13201)
• 380d4b5 [PR #13054/ed8b040c backport][3.14] escape backslashes in digest auth quoted-...
• e1e1bee Make llhttp method array size dynamic (#13174) (#13196)
• aa4cf29 [PR #13170/2b906869 backport][3.14] Fix StreamResponse.last_modified rounding...
• 71b57b4 [PR #13172/a57747ed backport][3.14] Fix C parser folding fragment into query_...
• 64a03fb [PR #13169/1adc0cd7 backport][3.14] Upgrade http:// to https:// in README.rst...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Note

Low Risk
Lockfile-only patch bump of a transitive HTTP library with no application code changes; minor platform-marker churn in the same lock is worth a quick glance on Windows CUDA setups.

Overview
Updates envs/finrl_env/uv.lock so transitive aiohttp moves from 3.14.0 to 3.14.3 (patch release; not declared directly in pyproject.toml). The lock refresh also rewrites cuda-toolkit optional NVIDIA package markers (from Linux/Windows-specific expressions to platform_machine == 'aarch64' or 'x86_64') and drops greenlet s390x wheel entries.

aiohttp 3.14.1–3.14.3 are bugfix-only for this env: notable fixes include stripping all copies of credential headers on cross-origin redirects (not just the first), C HTTP parser error handling, digest-auth escaping, and assorted client/server edge cases.

^{Reviewed by Cursor Bugbot for commit c4f506b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[cursor]

Alignment Review Report

Scope: this PR is a Dependabot lockfile-only change — the single modified file is envs/finrl_env/uv.lock. aiohttp is a transitive dependency of finrl_env (not declared in its pyproject.toml), pulled via finrl/alpaca-trade-api.

Automated Checks

• Lint: N/A to this diff. lint.sh runs usort/ruff format + ruff check over src/ tests/ envs/. It flags pre-existing formatting drift in ~25 unrelated env files (e.g. chat_env, opencode_env, pi_env, repl_env, textarena_env). None of those are this PR's file, finrl_env is not among them, and TOML lockfiles aren't linted. So the failures are pre-existing repo state, not introduced here.
• Debug code: CLEAN for this PR. check-debug.sh only surfaces pre-existing print/TODO lines under src/openenv/core/containers/* — nothing in the changed file.

Open RFCs Context

Open RFCs: 000, 001, 002, 003, 005 (In Review), 010 (Draft), plus 004 (Rubrics). They cover core abstractions, env spec, the MCP/Gym dual boundary, reward rubrics, agentic harnesses, and world-modeling. None govern per-environment dependency pinning or lockfiles, so none are relevant to this change.

Tier 1: Fixes Required

• None introduced by this PR. It adds zero Python; the pre-existing lint/debug findings above are outside the changed file and should not be bundled into a Dependabot lockfile bump.

Tier 2: Alignment Discussion

Principle Conflicts

None identified. A lockfile dependency bump does not touch the Gymnasium API surface, client↔server separation, rewards-in-environment, the MCP agent boundary, or Pydantic/type-safety invariants.

RFC Conflicts

None identified.

Observations (non-blocking)

1. Churn beyond the title. The re-lock also rewrote the cuda-toolkit optional-dependency markers (all nvidia-* extras) and dropped the greenlet s390x wheels. This is normal uv re-resolution churn, but the diff is broader than "bump aiohttp" (inline note left on the marker section).
2. Marker semantics changed for the nvidia CUDA extras — from (... 'x86_64' and sys_platform == 'linux') or (... 'AMD64' and sys_platform == 'win32') to platform_machine == 'aarch64' or platform_machine == 'x86_64'. Net effect: Windows CUDA (AMD64/win32) is no longer covered, and the new marker would also match x86_64 on non-Linux (e.g. Intel macOS) where these nvidia wheels don't exist. Low practical risk for finrl_env, but worth a glance if anyone installs CUDA extras on Windows/Intel-Mac. (Matches the Bugbot note on the PR.)
3. Security positive. aiohttp 3.14.1–3.14.3 are bugfix-only and include a security-relevant fix: stripping all copies of Authorization/Cookie/Proxy-Authorization headers on cross-origin redirects (previously only the first). Good to take.

Summary

• 0 mechanical issues to fix (in this PR's diff)
• 0 alignment points for human review
• 0 RFC conflicts
• 1 low-risk lockfile-churn item to glance at (nvidia CUDA marker rewrite) — suggested reviewer @burtenshaw (primary finrl_env maintainer; secondary @sergiopaniego)

No alignment or invariant concerns — clean from a two-tier review perspective.

  

_{Sent by Cursor Automation: Pre-review}

[cursor]

Lock churn beyond the aiohttp bump. These cuda-toolkit extras markers (and the other nvidia-* blocks below) changed from (platform_machine == 'x86_64' and sys_platform == 'linux') or (platform_machine == 'AMD64' and sys_platform == 'win32') to platform_machine == 'aarch64' or platform_machine == 'x86_64'.

Net effect:

• Windows CUDA (AMD64 + win32) is no longer covered.
• The new marker now also matches x86_64 on non-Linux (e.g. Intel macOS), where these nvidia wheels don't exist.

Auto-generated by uv's re-resolve and low-risk for finrl_env, but worth a glance if CUDA extras get installed on Windows/Intel-Mac. The greenlet s390x wheels were likewise dropped in this same re-lock.

[cursor]

Alignment Review Report

Scope: this PR is a Dependabot lockfile-only change — the single modified file is envs/finrl_env/uv.lock. aiohttp is a transitive dependency of finrl_env (not declared in its pyproject.toml), pulled via finrl/alpaca-trade-api.

Automated Checks

• Lint: N/A to this diff. lint.sh runs usort/ruff format + ruff check over src/ tests/ envs/. It flags pre-existing formatting drift in ~25 unrelated env files (e.g. chat_env, opencode_env, pi_env, repl_env, textarena_env) — none are this PR's file, finrl_env is not among them, and TOML lockfiles aren't linted. Pre-existing repo state, not introduced here.
• Debug code: CLEAN for this PR. check-debug.sh only surfaces pre-existing print/TODO lines under src/openenv/core/containers/* — nothing in the changed file.
• Lock integrity: PASS (verified). uv lock --check --project envs/finrl_env resolves 185 packages with no changes required — the lockfile (including the marker rewrite noted below) is internally consistent with pyproject.toml. The new aiohttp 3.14.3 artifacts were checked against PyPI: sdist 9491…44bc / 7971213 B and a sampled cp312-win_amd64 wheel 33a2d7c2…a75a / 476845 B match the lock exactly, no files yanked, and requires-python >=3.10 is satisfied by finrl_env's >=3.10.

Open RFCs Context

Open RFCs: 000, 001, 002, 003, 005 (In Review), 010 (Draft), plus 004 (Rubrics). They cover core abstractions, env spec, the MCP/Gym dual boundary, reward rubrics, agentic harnesses, and world-modeling. None govern per-environment dependency pinning or lockfiles, so none are relevant to this change.

Tier 1: Fixes Required

• None introduced by this PR. It adds zero Python; the pre-existing lint/debug findings above are outside the changed file and should not be bundled into a Dependabot lockfile bump.

Tier 2: Alignment Discussion

Principle Conflicts

None identified. A lockfile dependency bump does not touch the Gymnasium API surface, client↔server separation, rewards-in-environment, the MCP agent boundary, or Pydantic/type-safety invariants.

RFC Conflicts

None identified.

Observations (non-blocking)

1. Churn beyond the title. The re-lock also rewrote the cuda-toolkit optional-dependency markers (all nvidia-* extras) and dropped the greenlet s390x wheels. Normal uv re-resolution churn, but the diff is broader than "bump aiohttp" (inline note on the marker section).

2. Marker semantics changed for the nvidia CUDA extras — from (... 'x86_64' and sys_platform == 'linux') or (... 'AMD64' and sys_platform == 'win32') to platform_machine == 'aarch64' or platform_machine == 'x86_64'. Net effect: Windows CUDA (AMD64/win32) is no longer covered, and the new marker would also match x86_64 on non-Linux (e.g. Intel macOS) where these nvidia wheels don't exist. Low practical risk for finrl_env, but worth a glance if anyone installs CUDA extras on Windows/Intel-Mac. (Matches the Bugbot note.)

3. Security: strong positive (verified against PyPI/OSV). This is more than a bugfix bump — aiohttp 3.14.0 carries 11 distinct CVEs, all remediated across 3.14.1–3.14.3, and 3.14.3 has no remaining known advisories:

   • Fixed in 3.14.1 (8): CVE-2026-54273 (pipelined-request DoS), 54274 (WebSocket incomplete-frame memory bypass), 54275 (TLS SNI server_hostname bypass on connection reuse), 54276 (DigestAuth credentials sent after a cross-origin redirect), 54277 (C-parser max_line_size bypass), 54278 (decompression bomb during cleanup), 54279 (host-only cookie leak to subdomains), 54280 (payload not closed on mid-write client disconnect).
   • Fixed in 3.14.2 (2): CVE-2026-59881 (decompresses RSV1 frames without permessage-deflate), 69243 (request smuggling via WebSocket upgrade).
   • Fixed in 3.14.3 (1): CVE-2026-69244 (out-of-bounds heap read in the C response parser's error path).

   3.14.3 additionally strips all copies of Authorization/Cookie/Proxy-Authorization headers on cross-origin redirects (changelog). Clear take.

Summary

• 0 mechanical issues to fix (in this PR's diff)
• 0 alignment points for human review
• 0 RFC conflicts
• 1 low-risk lockfile-churn item to glance at (nvidia CUDA marker rewrite) — suggested reviewer @burtenshaw (primary finrl_env maintainer; secondary @sergiopaniego)
• Verified: lock consistent (uv lock --check OK, 185 pkgs), hashes match PyPI, 11 CVEs remediated — recommend taking the bump.

Clean from a two-tier review perspective.

  

_{Sent by Cursor Automation: Pre-review}

[cursor]

Lock churn beyond the aiohttp bump. These cuda-toolkit extras markers (and the other nvidia-* blocks below) changed from (platform_machine == 'x86_64' and sys_platform == 'linux') or (platform_machine == 'AMD64' and sys_platform == 'win32') to platform_machine == 'aarch64' or platform_machine == 'x86_64'.

Net effect:

• Windows CUDA (AMD64 + win32) is no longer covered.
• The new marker now also matches x86_64 on non-Linux (e.g. Intel macOS), where these nvidia wheels don't exist.

Auto-generated by uv's re-resolve and low-risk for finrl_env (uv lock --check still passes), but worth a glance if CUDA extras get installed on Windows/Intel-Mac. The greenlet s390x wheels were likewise dropped in this same re-lock.

[burtenshaw]

Closing in favor of aggregate env Dependabot PR #1015.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.