v7.3.1

Security

• Floor brotli at >=1.2.1 (GHSA-9v8h-qqgm-4m35, CVE-2026-111497,
  CVSS v4 9.2). aiohttp[speedups] only requires Brotli>=1.2, so
  this floor is what keeps a fresh resolve off 1.2.0.
• aiohttp stays ^3.12.13 and certifi stays ^2026.6.17.
  A fresh resolve currently selects aiohttp 3.14.5 (advisories fixed in
  3.14.4: GHSA-5wr8-gcqf-gqf3, GHSA-9xw5-w5jj-pvcg, GHSA-2g87-pp6c-29x5)
  and certifi 2026.10.23 (GHSA-6q48-6c7w-9gw2, fixed in 2026.10.19).

Changed

• poetry.lock is no longer tracked. CI resolves dependencies from
  pyproject.toml on each run and scans that resolution.