fix(security): raise aiohttp floor to 3.14.4

BL
9d ago
+100-57

Summary

  • Raise the aiohttp constraint floor from ^3.14.1 to ^3.14.4 in pyproject.toml, and from >=3.14.1 to >=3.14.4 in setup.py.
  • Correct the floor comment. It still said ^3.13.5 fixed the HIGH issues, while the constraint allowed 3.14.1–3.14.3.
  • Refresh only the Poetry content hash. poetry.lock stays on aiohttp 3.14.5, yarl 1.25.1, and multidict 6.9.1.

poetry install and the Docker image already install 3.14.5 from the lock. This change is for scanners and resolvers that honor the floor instead of the lock. Snyk is called out in the existing comment as scanning that floor.

Why 3.14.4

OSV lists 101 aiohttp PyPI advisories. None of them is fixed in a version newer than 3.14.4. Eight are fixed in 3.14.4, and 3.14.1–3.14.3 are still affected. Three of those are:

  • GHSA-2g87-pp6c-29x5 — unbounded memory/CPU. OSV: HIGH. aiohttp's GitHub advisory: medium.
  • GHSA-9xw5-w5jj-pvcg — multipart file-descriptor exhaustion. OSV: HIGH. aiohttp's GitHub advisory: medium.
  • GHSA-5wr8-gcqf-gqf3 — no initial request/header timeout. OSV: HIGH. aiohttp's GitHub advisory: low.

OSV's HIGH comes from the CVSS 4.0 vector. The GitHub labels are the ones the aiohttp maintainers set on the advisory.

PyPI’s latest release is 3.14.5 (not yanked). Its changelog is a WebSocket RSV1 bugfix and a test tweak, not another security fix, so the floor is 3.14.4 and the lock stays on 3.14.5. aiohttp 3.14.5 already requires yarl>=1.25.1,<2, which is what the lock has.

^3.14.4 allows 3.14.4, 3.14.5, and 3.15.0, and rejects 3.14.3 and 4.0.0. setup.py stays an open >=3.14.4, matching the previous setuptools line, which also had no upper bound. CI and Docker install through Poetry.

Test plan

  • poetry check --lock
  • poetry lock changed only the content hash; poetry install --dry-run kept aiohttp 3.14.5
  • Specifier check: 3.13.5 and 3.14.1–3.14.3 are outside the new floor; 3.14.4 and 3.14.5 are inside
  • ruff check . and ruff format --check .
  • pytest tests/ --cov=proxybroker --cov-fail-under=60 — 294 passed, coverage 65%

Summary by cubic

Raises the aiohttp constraint floor to 3.14.4 in pyproject.toml and setup.py so floor-based scanners stop flagging the October 2026 advisories affecting 3.14.1–3.14.3. The lock stays on 3.14.5; only the Poetry content hash refreshes.

  • Adds Python 3.15 to the CI matrix, classifiers, README, and docs; the published image and executable build stay on 3.14, and the test workflow token now gets only contents: read.
  • Aligns docs/requirements.txt and environment.yml floors with setup.py and fixes the stale ^3.13.5 comment, citing both OSV HIGH and aiohttp's medium/medium/low ratings.
  • test_basic_find_workflow now stubs the external-IP probe and judge dialing and awaits find() and the None sentinel instead of polling a live network probe.

Summary by CodeRabbit

  • Security
    • Raised the minimum required aiohttp version to 3.14.4; the dependency lock remains on 3.14.5.
  • Compatibility
    • Added Python 3.15 to the supported version matrix and tests. Published images and executable/publishing workflows remain on Python 3.14.
  • Documentation
    • Updated the project documentation and changelog with Python 3.15 support, aiohttp requirements, and updated minimum versions for other dependencies. Documentation also notes the fixes covered by the aiohttp version floor.