build(deps): make the aiohttp floor a compatibility bound, not a security one

README.md

@@ -10,13 +10,13 @@ Simple, unofficial library with some example scripts to access data from the [Sp
 ### Requirements
 
 - Python 3.11 or later
-- `aiohttp` 3.14.3 or later
+- `aiohttp` 3.13.0 or later
 
-The `aiohttp` floor is a security requirement rather than a feature one. Releases
-below 3.14.3 carry known advisories in the HTTP parsers, the most serious being an
-out-of-bounds read in the C response parser that an upstream server can trigger with
-a malformed chunked response ([CVE-2026-69244](https://github.com/advisories/GHSA-cq5v-8q36-5273)).
-If you pin `aiohttp` in your own project, pin it at or above 3.14.3.
+The `aiohttp` bound is a compatibility floor, not a security one — which
+advisories matter depends on your application, so pinning is your call. For
+reference: releases below 3.14.3 carry known HTTP-parser advisories, the most
+serious being [CVE-2026-69244](https://github.com/advisories/GHSA-cq5v-8q36-5273).
+Installing without a pin already gives you the newest `aiohttp`.
 
 ## Usage
 

pyproject.toml

@@ -9,12 +9,9 @@ repository = 'https://github.com/Olen/Spond'
 
 [tool.poetry.dependencies]
 python = ">=3.11"
-# Floor is a security boundary, not a feature requirement: everything below
-# 3.14.3 carries known advisories in the HTTP parsers, up to and including a
-# high-severity out-of-bounds read (CVE-2026-69244). As a library we publish
-# this range to downstream installs, so it must not resolve to a vulnerable
-# aiohttp. Don't lower it without checking the advisories first.
-aiohttp = ">=3.14.3"
+# Compatibility floor, not a security one: 3.13.0 is the oldest aiohttp
+# supporting Python 3.14. Security pinning is left to consumers (see README).
+aiohttp = ">=3.13.0"
 
 [tool.poetry.group.dev.dependencies]
 # Constraint on `python` is required: pdoc's transitive `markdown2` declares