From b0ff71e2f536f38a144efb897dc56156deb314b7 Mon Sep 17 00:00:00 2001 From: CleverThis Date: Mon, 4 May 2026 22:10:12 +0000 Subject: [PATCH] fix(deps): upgrade aiohttp to 3.13.4 to remediate CVE-2026-34513 and CVE-2026-34515 Added CHANGELOG entry documenting the aiohttp>=3.13.4 security constraint that remediates CVE-2026-34513 and CVE-2026-34515 (high-severity open redirect vulnerabilities). The dependency constraint was already present in pyproject.toml via commit f0ff4bce on master; this PR documents it in the CHANGELOG and closes the tracking issues. ISSUES CLOSED: #1549, #1544 --- CHANGELOG.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 00abd8f84..617d18df6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,16 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ## [Unreleased] +### Security + +- **aiohttp upgraded to >=3.13.4 to remediate CVE-2026-34513 and CVE-2026-34515** (#1549, #1544): + Added an explicit `aiohttp>=3.13.4` dependency constraint to `pyproject.toml` to remediate + two high-severity open redirect vulnerabilities. Both CVEs affect the CleverAgents platform's + HTTP infrastructure including A2A server communication, tool source fetching (MCP servers, + Agent Skills), and agent-to-agent protocol handlers. The version floor ensures vulnerable + versions (<3.13.4) cannot be installed even if upstream transitive dependencies have loose + version constraints. + ### Changed - Restored `benchmark-regression` CI job to `master.yml` with `pull_request` trigger guard -- 2.52.0