chore(deps): bump aiohttp from 3.14.0 to 3.14.3 in /envs/openapp_env - #1052
chore(deps): bump aiohttp from 3.14.0 to 3.14.3 in /envs/openapp_env#1052dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [aiohttp](https://github.com/aio-libs/aiohttp) from 3.14.0 to 3.14.3. - [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst) - [Commits](aio-libs/aiohttp@v3.14.0...v3.14.3) --- updated-dependencies: - dependency-name: aiohttp dependency-version: 3.14.3 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
python:uv
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
Scope: Dependabot transitive-dependency bump — aiohttp 3.14.0 → 3.14.3 in envs/openapp_env. Exactly one file changed: envs/openapp_env/uv.lock (+89 / −89). No source, pyproject.toml, Dockerfile, openenv.yaml, or API changes. aiohttp is a transitive dependency only — it is not declared in openapp_env/pyproject.toml and appears nowhere in the env's code (it enters via the browsergym/playwright stack).
Automated Checks
- Lint: PASS (for this PR's scope).
bash .claude/hooks/lint.shexits non-zero, but every flagged file is pre-existingruff formatdrift in unrelated environments (opencode_env,pi_env,chat_env,coding_tools_env,jupyter_env,repl_env,terminus_env,textarena_env,agent_world_model_env). None are inopenapp_env, and this PR modifies zero.pyfiles, so it introduces no lint/format regressions. - Debug code: CLEAN (for this PR).
check-debug.shonly reports pre-existingprint/TODOoccurrences undersrc/; this PR touches no source. - Lockfile validity (extra check): PASS.
uv lock --checkinenvs/openapp_envresolved 163 packages and exited 0 — the updated lock is consistent withpyproject.toml.
Open RFCs Context
All RFCs are pre-1.0 design docs in In Review (000, 001, 002, 003, 005) or Draft (010) status, covering project phases, abstractions, env spec, MCP, rubrics/harnesses, and echo token-world-modeling. None relate to dependency management or lockfiles, so none are relevant to this bump.
Tier 1: Fixes Required
- None.
Informational (not a required fix): Beyond the aiohttp entry, the lock diff also contains collateral marker normalizations for CUDA / nvidia-* / tifffile packages (e.g. dropping sys_platform == 'linux' and python_full_version qualifiers). This is the expected byproduct of regenerating the lock with a newer uv (marker simplification), and uv lock --check passing confirms the lock is internally consistent. Flagging only so reviewers are aware the diff is not strictly limited to aiohttp.
Tier 2: Alignment Discussion
Principle Conflicts
None identified. A transitive dependency version bump in one env's lockfile does not touch the Gymnasium API surface (reset/step/state), client–server separation, rewards-in-environment, the MCP/WebSocket boundary, or Pydantic wire types.
RFC Conflicts
None identified.
Summary
- 0 mechanical issues to fix
- 0 alignment points for human review
- 0 RFC conflicts to discuss
- 1 informational note (collateral
uvmarker normalization in the lockfile)
Patch-level bump of a transitive HTTP dependency; lockfile validated and consistent. No blocking issues found by this alignment review.
Sent by Cursor Automation: Pre-review
There was a problem hiding this comment.
Alignment Review Report
Scope: Native Dependabot bump of a transitive dependency — aiohttp 3.14.0 → 3.14.3 — in envs/openapp_env. Exactly one file changed: envs/openapp_env/uv.lock (+89 / −89). No source, pyproject.toml, Dockerfile, openenv.yaml, or API changes. aiohttp is not declared in openapp_env/pyproject.toml and appears nowhere in the env's code (it enters via the browsergym/playwright stack), so a lock-only change is the correct shape.
Automated Checks
- Lint: PASS (for this PR's scope).
bash .claude/hooks/lint.shexits non-zero, but every flagged file is pre-existingruff formatdrift in unrelated envs (opencode_env,pi_env,chat_env,coding_tools_env,jupyter_env,repl_env,terminus_env,textarena_env,agent_world_model_env). None are inopenapp_env, and this PR modifies zero.pyfiles → no lint/format regression. (CI's lint job only coverssrc/+tests/;.lock/TOML are not linted at all.) - Debug code: CLEAN.
check-debug.shscanssrc/only and reports pre-existing hits; this PR touches no source. - Lockfile validity: PASS.
uv lock --checkinenvs/openapp_envresolved 163 packages, exit 0 — the lock is consistent withpyproject.toml. - Hash / integrity: VERIFIED. aiohttp
3.14.3sdist9491…44bcand the cp312 x86_64 wheel5439…db42matchpypi.orgexactly;yanked: false;requires_python >=3.10⊆ the env's>=3.11,<3.14. - Lock provenance: BORN-CLEAN.
revision = 3on both sides (no revision bump), 0 HF-mirror refs on both sides (no index-source flip), 163→163 packages (0 add/remove), and the onlyfiles.pythonhosted.orglines that changed are aiohttp's. Norequires-distre-sync.
Security (positive signal)
This bump clears a large batch of known advisories. aiohttp 3.14.0 carries 22 advisories on PyPI; all are fixed by 3.14.3 (16 fixed in 3.14.1, 3 in 3.14.2, and 3 only in 3.14.3 — e.g. GHSA-cq5v-8q36-5273, PYSEC-2026-3545). 3.14.3 itself has no known vulnerabilities. Bumping to exactly 3.14.3 (not an earlier patch) is what clears the 3.14.3-only items. Net: security-positive.
Open RFCs Context
All RFCs are pre-1.0 design docs in In Review (000, 001, 002, 003, 005, 008) or Draft (010) status, covering project phases, abstractions, env spec, MCP, rubrics/harnesses, auto-validation, and echo token-world-modeling. None cover dependency management / lockfiles / PyPI, so none are relevant to this bump.
Tier 1: Fixes Required
- None.
Informational (not a required fix): Beyond aiohttp, the lock also contains collateral marker normalizations on the CUDA / nvidia-* / tifffile entries (e.g. dropping redundant sys_platform == 'linux' / python_full_version qualifiers). This is a byproduct of regenerating the lock with a newer uv's marker simplification — resolved versions, the package set, and artifact hashes are all unchanged and uv lock --check passes, so it's benign representational churn. Flagged only so the diff's breadth isn't read as a resolution change.
Tier 2: Alignment Discussion
Principle Conflicts
None identified. A transitive dependency version bump in one env's lockfile does not touch the Gymnasium API surface (reset/step/state), client–server separation, rewards-in-environment, the MCP/WebSocket boundary, or Pydantic wire types.
RFC Conflicts
None identified.
Process note (recurring on native dependabot/uv/envs/** PRs)
FLAG: Dependabot exclude-paths bypass.
- Config at stake:
.github/dependabot.yml. - The concern: the
uvupdater is configured withexclude-paths: ["envs/**"](lines 8-9), yet this nativedependabot/uv/envs/openapp_env/…PR still editsenvs/openapp_env/uv.lock.exclude-pathsis a valid key but theuvecosystem doesn't appear to honor it (a known platform limitation); the intended path for env bumps is the aggregatecodex/dependabot-envs-*roll-ups. Not a code issue — surfacing so the team can decide whether to adjust config or expectations. (The separategithub-actionsupdater has noexclude-pathsand is correctly in-scope.) - Suggested reviewer: @burtenshaw (author of
.github/dependabot.yml).
Summary
- 0 mechanical issues to fix
- 0 principle/alignment conflicts
- 0 RFC conflicts
- 1 recurring process note (dependabot
exclude-pathsbypass on native env PRs) + 1 informational lock note (benignuvmarker normalization)
Verified, born-clean, hash-checked, and security-positive transitive patch bump. No blocking issues from this alignment review.
Sent by Cursor Automation: Pre-review
| [[package]] | ||
| name = "aiohttp" | ||
| version = "3.14.0" | ||
| version = "3.14.3" |
There was a problem hiding this comment.
aiohttp 3.14.0 → 3.14.3 — security-positive. 3.14.0 carries 22 known advisories on PyPI; all are fixed by 3.14.3 (3 are fixed only in 3.14.3, e.g. GHSA-cq5v-8q36-5273 / PYSEC-2026-3545), and 3.14.3 has no known vulns. sdist 9491…44bc and the cp312 x86_64 wheel 5439…db42 both verified against pypi.org; yanked: false; requires_python >=3.10 fits the env's >=3.11,<3.14. Transitive-only (via browsergym/playwright), so the lock-only change is correct.
| source = { registry = "https://pypi.org/simple" } | ||
| dependencies = [ | ||
| { name = "cuda-pathfinder", marker = "sys_platform != 'emscripten' and sys_platform != 'win32'" }, | ||
| { name = "cuda-pathfinder" }, |
There was a problem hiding this comment.
Collateral to the aiohttp re-lock: markers on the CUDA / nvidia-* / tifffile entries were normalized (here cuda-pathfinder lost its sys_platform != 'emscripten'/'win32' qualifier). This is uv's marker simplification on lock regeneration — resolved versions, the package set (163→163), and artifact hashes are unchanged and uv lock --check passes, so it's benign. Noted only so the diff's breadth isn't read as a resolution change.
|
Closing in favor of aggregate env Dependabot PR #1015. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps aiohttp from 3.14.0 to 3.14.3.
Changelog
Sourced from aiohttp's changelog.
... (truncated)
Commits
5e392ceRelease v3.14.3 (#13225)49f65d5[PR #13222/f4866933 backport][3.14] Build C parser error message from bounded...240099e[PR #13180/ee53d655 backport][3.14] drop every copy of credential headers on ...d93f30aBump version (#13202)c1b9212Release v3.14.2 (#13201)380d4b5[PR #13054/ed8b040c backport][3.14] escape backslashes in digest auth quoted-...e1e1beeMake llhttp method array size dynamic (#13174) (#13196)aa4cf29[PR #13170/2b906869 backport][3.14] Fix StreamResponse.last_modified rounding...71b57b4[PR #13172/a57747ed backport][3.14] Fix C parser folding fragment into query_...64a03fb[PR #13169/1adc0cd7 backport][3.14] Upgrade http:// to https:// in README.rst...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Lockfile-only patch bump of a common HTTP client; collateral marker changes are resolver metadata, not new direct dependencies or app logic.
Overview
Updates
envs/openapp_env/uv.locksoaiohttpmoves from 3.14.0 to 3.14.3 (patch release with client redirect/credential-header fixes, C parser error handling, and related 3.14.x fixes). No application source changes—only the lockfile.The same lock refresh also adjusts uv dependency markers for several transitive packages (e.g. CUDA/NVIDIA wheels and
tifffile’snumpyedge), without changing pinned versions beyondaiohttp.Reviewed by Cursor Bugbot for commit c7e913f. Bugbot is set up for automated code reviews on this repo. Configure here.