From a544f2f835eb1a56e77e79bf2a7b7d9b898c4534 Mon Sep 17 00:00:00 2001 From: Johnny Xmas Date: Tue, 7 Jul 2026 15:30:20 -0600 Subject: [PATCH] Bump aiohttp to 3.14.1 to fix Dependabot alerts Resolves 8 open Dependabot alerts (all aiohttp <= 3.14.0), including the HTTP/1 pipelined request queue, C parser max_line_size bypass, TLS hostname override, websocket frame memory limits, DigestAuth cross-origin credential leak, mid-body disconnect resource leak, host-only cookie promotion, and compressed body client_max_size bypass. Stays within discord.py's aiohttp>=3.7.4,<4 constraint. --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 62b51c0..deb4625 100644 --- a/requirements.txt +++ b/requirements.txt @@ -2,7 +2,7 @@ discord.py==2.7.1 APScheduler==3.11.2 icalendar==7.1.2 requests==2.34.2 -aiohttp==3.14.0 +aiohttp==3.14.1 feedparser==6.0.12 pytz==2026.2 python-dateutil==2.9.0.post0