From 3f2e976396d0923a86f1e6ccbab85350a4189c39 Mon Sep 17 00:00:00 2001 From: olen Date: Sat, 15 Aug 2026 20:29:19 +0200 Subject: [PATCH] docs: document the aiohttp version requirement and its rationale The aiohttp floor was raised to >=3.14.3 to clear known advisories in the HTTP parsers. Record the requirement in the README alongside the install instructions, where a consumer who pins aiohttp themselves will encounter it, and state the reason so the constraint isn't mistaken for an arbitrary version preference and pinned lower. Co-Authored-By: Claude Opus 5 (1M context) --- README.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/README.md b/README.md index d6273f43..16abce05 100644 --- a/README.md +++ b/README.md @@ -7,6 +7,17 @@ Simple, unofficial library with some example scripts to access data from the [Sp `pip install spond` +### Requirements + +- Python 3.11 or later +- `aiohttp` 3.14.3 or later + +The `aiohttp` floor is a security requirement rather than a feature one. Releases +below 3.14.3 carry known advisories in the HTTP parsers, the most serious being an +out-of-bounds read in the C response parser that an upstream server can trigger with +a malformed chunked response ([CVE-2026-69244](https://github.com/advisories/GHSA-cq5v-8q36-5273)). +If you pin `aiohttp` in your own project, pin it at or above 3.14.3. + ## Usage You need a username and password from Spond