[sebd0]

Summary

aiohttp 3.14.3 -> 3.14.5 in uv.lock. Fixes eight aiohttp advisories covering request smuggling in the pure-Python parser, missing initial request/header timeout, unbounded memory/CPU use, file descriptor exhaustion in multipart requests, connector pool exhaustion and cookie scope/Secure handling. yarl moves with it because aiohttp 3.14.5 requires yarl>=1.25.1.

Changes

Package	From	To	Advisories
aiohttp	3.14.3	3.14.5	GHSA-2g87-pp6c-29x5, CVE-2026-111063, CVE-2026-111064, CVE-2026-111065, CVE-2026-111066, CVE-2026-111748, CVE-2026-111749, CVE-2026-111750
yarl	1.24.2	1.25.1	none, required by aiohttp 3.14.5

Lockfile-only change, no code changes.

Testing

• uv lock --upgrade-package aiohttp: resolved, updated aiohttp and yarl only
• uv lock --check: passes
• uv sync --dry-run: passes, resolves 26 packages
• Lock diff against main: only aiohttp (and yarl) changed.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. To trigger a review, include coderabbit-review in the PR description. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 643631ef-a191-4972-9f54-fd23b10c7728

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}