update aiohttp>=3.14.3 (CVE-2026-69244)

[masenf]

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 0879cbd9-2438-4a33-9581-28837dc59641

📥 Commits

Reviewing files that changed from the base of the PR and between d21b7bb and db5e7ef.

⛔ Files ignored due to path filters (2)

• docs/app/uv.lock is excluded by !**/*.lock
• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• pyproject.toml

---

📝 Walkthrough

Walkthrough

The development dependency requirement for aiohttp changes from >=3.9 to >=3.14.3 in pyproject.toml.

Changes

Development dependency update

Layer / File(s)	Summary
Raise aiohttp minimum version pyproject.toml	The development dependency now requires aiohttp version 3.14.3 or newer.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: alek99, farhanaliraza, adhami3310

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the aiohttp dependency update and its security motivation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch masenf/aiohttp

---

_{Comment @coderabbitai help to get the list of available commands.}

[masenf]

lower bound update only, dev env was already locked on this version so should be zero observable change here

[greptile-apps]

Greptile Summary

The PR raises the minimum development dependency on aiohttp from 3.9 to 3.14.3 across the project manifest and synchronized lockfiles.

• Updates the aiohttp development requirement in pyproject.toml.
• Synchronizes dependency metadata in the root and documentation-app lockfiles.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
pyproject.toml	Raises the minimum supported aiohttp development dependency to 3.14.3.
uv.lock	Synchronizes the root lockfile's development requirement metadata with the updated manifest.
docs/app/uv.lock	Synchronizes the documentation app lockfile's development requirement metadata with the updated manifest.

_{Reviews (2): Last reviewed commit: "Merge remote-tracking branch 'origin/mai..." | Re-trigger Greptile}

[codspeed-hq]

Merging this PR will not alter performance

✅ 109 untouched benchmarks
⏩ 2 skipped benchmarks¹

---

_{Comparing masenf/aiohttp (83267cd) with main (37c3d91)}

Footnotes

1. 2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[cubic-dev-ai]

No issues found across 3 files

<sub>Tip: cubic could auto-approve low-risk PRs like this, if it thinks it's safe to merge. Learn more

Re-trigger cubic</sub>