[PR] Bump aiohttp from 3.14.3 to 3.14.4 [caldera]

["katsugtgz (via GitHub)" <gi...@apache.org>]

katsugtgz opened a new pull request, #3423:
URL: https://github.com/apache/caldera/pull/3423

   Updates `aiohttp` to 3.14.4 to address GHSA-5wr8-gcqf-gqf3, GHSA-2g87-pp6c-29x5, and GHSA-494j-54xm-rwp3.
   
   Evidence:
   - `requirements.txt` referenced `aiohttp==3.14.3`
   - osv-scanner reported GHSA-5wr8-gcqf-gqf3, GHSA-2g87-pp6c-29x5, and GHSA-494j-54xm-rwp3 for aiohttp 3.14.3 before the update
   - updated version: `aiohttp==3.14.4`
   
   Validation:
   - osv-scanner no longer reports any advisory for aiohttp after the update
   - `python -m pytest --asyncio-mode=auto tests` on Python 3.12: 554 passed. The 8 errors in `tests/web_server/test_core_endpoints.py` also occur on the base pin (aiohttp 3.14.3) in a local environment without the sandcat/ssl plugin builds, so they are unrelated to this change.
   
   Scope: dependency pin update only.
   
   Note: osv-scanner reports separate advisories for other pins in this file (asyncssh 2.23.1, idna 3.9.0, pillow 9.5.0). Not addressed here.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@caldera.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org