From 6d07228f43962048818b901bc0d374088b669e7d Mon Sep 17 00:00:00 2001 From: olen Date: Sat, 15 Aug 2026 20:18:59 +0200 Subject: [PATCH] build(deps): require aiohttp >=3.14.3 for security advisories MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The dependency floor was >=3.8.5, which permitted downstream installs to resolve to aiohttp versions carrying 14 known advisories in the HTTP parsers — including a high-severity out-of-bounds heap read in the C response parser (CVE-2026-69244). Because this project ships as a library with no committed lockfile, the declared range is the only version signal downstream consumers receive. An open-ended floor also gives Dependabot's security updater nothing to patch: the range already allowed the fixed version, so no PR was ever raised and the alerts accumulated unaddressed. Raise the floor to the first version clear of all outstanding advisories and document the constraint so it isn't lowered inadvertently. Co-Authored-By: Claude Opus 5 (1M context) --- pyproject.toml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index f625499f..f2420416 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -9,7 +9,12 @@ repository = 'https://github.com/Olen/Spond' [tool.poetry.dependencies] python = ">=3.11" -aiohttp = ">=3.8.5" +# Floor is a security boundary, not a feature requirement: everything below +# 3.14.3 carries known advisories in the HTTP parsers, up to and including a +# high-severity out-of-bounds read (CVE-2026-69244). As a library we publish +# this range to downstream installs, so it must not resolve to a vulnerable +# aiohttp. Don't lower it without checking the advisories first. +aiohttp = ">=3.14.3" [tool.poetry.group.dev.dependencies] # Constraint on `python` is required: pdoc's transitive `markdown2` declares