fix(deps): upgrade aiohttp to 3.13.4 to remediate CVE-2026-34515 open redirect #1999

Merged

freemo merged 1 commits from fix/dependency-security-aiohttp-cve-2026-34515 into master

2026-04-03 01:08:35 +00:00

Author	SHA1	Message	Date
freemo	f0ff4bce69	fix(deps): upgrade aiohttp to 3.13.4 to remediate CVE-2026-34515 open redirect CI / benchmark-publish (pull_request) Has been skipped Details CI / build (pull_request) Successful in 17s Details CI / lint (pull_request) Failing after 20s Details CI / helm (pull_request) Successful in 23s Details CI / typecheck (pull_request) Failing after 50s Details CI / security (pull_request) Failing after 50s Details CI / coverage (pull_request) Has been skipped Details CI / benchmark-regression (pull_request) Has been skipped Details CI / unit_tests (pull_request) Failing after 1m48s Details CI / docker (pull_request) Has been skipped Details CI / quality (pull_request) Successful in 3m41s Details CI / e2e_tests (pull_request) Failing after 15m4s Details CI / integration_tests (pull_request) Failing after 20m55s Details CI / status-check (pull_request) Failing after 1s Details Add explicit aiohttp>=3.13.4 dependency constraint to pyproject.toml to remediate CVE-2026-34515, a high-severity open redirect vulnerability in aiohttp that affects the A2A server HTTP transport, MCP tool source fetching, and agent communication layers. The uv.lock already resolves aiohttp to 3.13.5 which satisfies the >=3.13.4 constraint. Adding the explicit constraint ensures vulnerable versions (<3.13.4) cannot be installed even if upstream transitive dependency constraints are loosened. ISSUES CLOSED: #1544	2026-04-03 00:32:00 +00:00