From f0ff4bce699fe29b4a7569585b121d9bdbe8fb11 Mon Sep 17 00:00:00 2001 From: Jeffrey Phillips Freeman Date: Fri, 3 Apr 2026 00:32:00 +0000 Subject: [PATCH] fix(deps): upgrade aiohttp to 3.13.4 to remediate CVE-2026-34515 open redirect Add explicit aiohttp>=3.13.4 dependency constraint to pyproject.toml to remediate CVE-2026-34515, a high-severity open redirect vulnerability in aiohttp that affects the A2A server HTTP transport, MCP tool source fetching, and agent communication layers. The uv.lock already resolves aiohttp to 3.13.5 which satisfies the >=3.13.4 constraint. Adding the explicit constraint ensures vulnerable versions (<3.13.4) cannot be installed even if upstream transitive dependency constraints are loosened. ISSUES CLOSED: #1544 --- pyproject.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/pyproject.toml b/pyproject.toml index ad642ab01..bc29cd5f4 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -47,6 +47,7 @@ dependencies = [ "jsonschema>=4.20.0", # JSON Schema validation for tool inputs/outputs "tomlkit>=0.13.0", # TOML writing with comment preservation for config CLI "tenacity>=8.2.0", # Retry framework for service layer resilience + "aiohttp>=3.13.4", # CVE-2026-34515 mitigation: open redirect vulnerability ] [project.optional-dependencies] -- 2.52.0