From 7ba8f6ac2315b85af9ede403502a9ba77fbd8efc Mon Sep 17 00:00:00 2001 From: Jeffrey Phillips Freeman Date: Thu, 2 Apr 2026 23:20:03 +0000 Subject: [PATCH] fix(deps): upgrade aiohttp to 3.13.4 to remediate CVE-2026-34513 open redirect Add explicit aiohttp>=3.13.4 dependency to pyproject.toml to remediate CVE-2026-34513, a high-severity open redirect vulnerability in aiohttp. An attacker could craft a malicious URL that, when processed by the application, redirects users to an arbitrary external site. This can be exploited for phishing attacks or to bypass security controls. The CleverAgents platform uses aiohttp as part of its async HTTP infrastructure (A2A server, tool source fetching, and agent communication layers). Adding an explicit minimum version constraint ensures the vulnerable version (3.13.3) cannot be installed even as a transitive dependency. ISSUES CLOSED: #1549 --- pyproject.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/pyproject.toml b/pyproject.toml index ad642ab01..f99b92672 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -47,6 +47,7 @@ dependencies = [ "jsonschema>=4.20.0", # JSON Schema validation for tool inputs/outputs "tomlkit>=0.13.0", # TOML writing with comment preservation for config CLI "tenacity>=8.2.0", # Retry framework for service layer resilience + "aiohttp>=3.13.4", # Security: CVE-2026-34513 open redirect mitigation ] [project.optional-dependencies] -- 2.52.0