fix(deps): bump aiohttp to 3.14.1 by Jan-Kazlouski-elastic · Pull Request #4237 · elastic/connectors

Jan-Kazlouski-elastic · 2026-07-20T18:59:53Z

Part of https://github.com/elastic/security/issues/12526

Bumps aiohttp 3.13.3 → 3.14.1 in both app/connectors_service and libs/connectors_sdk. This single bump remediates 21 aiohttp CVEs currently reported against the main pin (3.13.3) — every CVE fixed in aiohttp 3.13.4, 3.14.0, and 3.14.1. The full list (with tracking issues) is in the Scanner A/B section below.

connectors uses aiohttp only as an HTTP client (aiohttp.ClientSession) and never runs an aiohttp web server, so the server-side CVEs in this set are Not Affected in practice. The bump is applied proactively to clear the advisories and keep the dependency current.

aiohttp 3.14 test compatibility (no runtime change)

aiohttp 3.14 added a required stream_writer argument to ClientResponse (which breaks aioresponses, which has no released fix) and deprecated BasicAuth / the auth= parameter. To keep the suite green with no runtime behavior change:

A self-gating aioresponses shim in both test conftest.py files — injects a no-op stream_writer when the caller omits it; inert on aiohttp <3.14 and once aioresponses ships a fix.
Two benign deprecation warnings (BasicAuth, auth=) added to filterwarnings, consistent with the existing third-party deprecation ignores in this repo.

The auth= / BasicAuth → encode_basic_auth() migration is deferred to a follow-up before aiohttp 4.0.

Checklists

Pre-Review Checklist

this PR does NOT contain credentials of any kind, such as API keys or username/passwords (double check config.yml.example)
this PR has a meaningful title
this PR links to all relevant github issues that it fixes or partially addresses
this PR has a thorough description
Covered the changes with automated tests
Tested the changes locally
Added a label for each target release version (example: v7.13.2, v7.14.0, v8.0.0)
For bugfixes: backport safely to all minor branches still receiving patch releases

Changes Requiring Extra Attention

Security-related changes (encryption, TLS, SSRF, etc)

Scanner A/B (aiohttp `3.13.3` → `3.14.1`)

Before = aiohttp==3.13.3 (current main pin) · After = aiohttp==3.14.1 (this PR). pip-audit, Trivy, and Snyk were each run against both pins.

Tool	Before (`3.13.3`)	After (`3.14.1`)
pip-audit	21 reported	0 — clear
Trivy	21 reported	0 — clear
Snyk	21 reported	0 — clear

All 21 CVEs / issues remediated by this PR — reported on 3.13.3 by all three tools, clear on 3.14.1:

CVE	Issue	Fixed in aiohttp	Before	After
CVE-2026-22815	elastic/security#12501	3.13.4	reported	clear
CVE-2026-34513	elastic/security#12507	3.13.4	reported	clear
CVE-2026-34514	elastic/security#12508	3.13.4	reported	clear
CVE-2026-34515	elastic/security#12509	3.13.4	reported	clear
CVE-2026-34516	elastic/security#12510	3.13.4	reported	clear
CVE-2026-34517	elastic/security#12511	3.13.4	reported	clear
CVE-2026-34518	elastic/security#12512	3.13.4	reported	clear
CVE-2026-34519	elastic/security#12513	3.13.4	reported	clear
CVE-2026-34520	elastic/security#12514	3.13.4	reported	clear
CVE-2026-34525	elastic/security#12515	3.13.4	reported	clear
CVE-2026-34993	elastic/security#12516	3.14.0	reported	clear
CVE-2026-47265	elastic/security#12519	3.14.0	reported	clear
CVE-2026-50269	elastic/security#12537	3.14.0	reported	clear
CVE-2026-54273	elastic/security#12526	3.14.1	reported	clear
CVE-2026-54274	elastic/security#12527	3.14.1	reported	clear
CVE-2026-54275	elastic/security#12528	3.14.1	reported	clear
CVE-2026-54276	elastic/security#12529	3.14.1	reported	clear
CVE-2026-54277	elastic/security#12530	3.14.1	reported	clear
CVE-2026-54278	elastic/security#12531	3.14.1	reported	clear
CVE-2026-54279	elastic/security#12532	3.14.1	reported	clear
CVE-2026-54280	elastic/security#12533	3.14.1	reported	clear

_{The 8 CVEs fixed in aiohttp 3.13.3 (CVE-2025-69223…CVE-2025-69230, elastic/security#12492–#12499) are already remediated on main and are out of scope for this PR.}

Release Note

Bump aiohttp to 3.14.1 to remediate 21 reported CVEs.

aiohttp < 3.14.1 queued HTTP/1 pipelined requests without a limit, allowing a DoS via excessive memory use; 3.14.1 caps the queue. aiohttp 3.14 also added a required stream_writer arg to ClientResponse (breaking aioresponses, which has no released fix) and deprecated BasicAuth / the auth= parameter. Add a self-gating aioresponses shim in the test conftests and ignore the two benign deprecation warnings so the suite stays green; no runtime behavior change. The auth API migration is deferred to a follow-up before aiohttp 4.0. Closes elastic/security#12526 Co-authored-by: Cursor <cursoragent@cursor.com>

erikcurrin-elastic

lgtm. Make sure we run a couple tests

Jan-Kazlouski-elastic · 2026-07-21T06:08:46Z

Best-effort regression testing (bump is behavior-safe)

Unit suites on aiohttp==3.14.1: app 2292 passed, SDK 342 passed (0 functional failures).

Runtime client parity — real local HTTP server driven with aiohttp.ClientSession using the patterns connectors relies on, run on both pins:

Check	3.13.3	3.14.1
GET `auth=BasicAuth` → 200 + header delivered	PASS	PASS
`ClientSession(auth=...)` / explicit `Authorization`	PASS	PASS
`response.json()` / `json(content_type=None)`	PASS	PASS
streaming `iter_chunked` read	PASS	PASS
PUT with body (content-extraction pattern)	PASS	PASS
Total	10/10	10/10

Identical behavior across the bump. The only 3.14.1 difference is deprecation warnings on BasicAuth/auth= — they still authenticate correctly (handled in-tree via the conftest shim + warning ignores).

github-actions · 2026-07-21T06:52:40Z

💔 Failed to create backport PR(s)

Status	Branch	Result
✅	9.5	#4245
✅	9.4	#4246
❌	8.19	Commit could not be cherrypicked due to conflicts
✅	9.3	#4247

Successful backport PRs will be merged automatically after passing CI.

To backport manually run:
backport --pr 4237 --autoMerge --autoMergeMethod squash

Backports the following commits to 9.3: - fix(deps): bump aiohttp to 3.14.1 (#4237) Co-authored-by: Jan-Kazlouski-elastic <jan.kazlouski@elastic.co> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

Backports the following commits to 9.5: - fix(deps): bump aiohttp to 3.14.1 (#4237) Co-authored-by: Jan-Kazlouski-elastic <jan.kazlouski@elastic.co> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

Backports the following commits to 9.4: - fix(deps): bump aiohttp to 3.14.1 (#4237) Co-authored-by: Jan-Kazlouski-elastic <jan.kazlouski@elastic.co> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

Backports #4237 to `8.19`. ## What Bumps `aiohttp` `3.13.3` → `3.14.1` in `requirements/framework.txt`, remediating **21** reported `aiohttp` CVEs (every CVE fixed across aiohttp `3.13.4`, `3.14.0`, `3.14.1`). connectors uses `aiohttp` only as an HTTP **client** (`aiohttp.ClientSession`) and never runs an aiohttp web server, so the server-side CVEs in this set are **Not Affected** in practice; the bump is applied proactively to clear the advisories. This is the missing `8.19` line for #4237 — the `9.5`/`9.4`/`9.3` backports already merged (#4245/#4246/#4247), but no `8.19` backport was ever opened despite the `v8.19.20` label. ## aiohttp 3.14 test compatibility (no runtime change) aiohttp 3.14 made `stream_writer` a required kwarg of `ClientResponse` (which `aioresponses` omits) and deprecated `BasicAuth` / the `auth=` parameter. To keep the suite green with **no runtime behavior change**: - A self-gating `aioresponses` shim in `tests/conftest.py` — injects a no-op `stream_writer` when the caller omits it; inert on aiohttp `<3.14` and once `aioresponses` ships a fix. - Two benign deprecation warnings (`BasicAuth`, `auth=`) added to `pytest.ini` `filterwarnings`, consistent with existing third-party deprecation ignores. `NOTICE.txt` regenerated via `make install`. ## Testing `make clean install autoformat lint test PYTHON=python3.11` — lint clean, `NOTICE.txt` regenerated, and the full suite passes (2437 passed). The only non-green signals were the aggressive local `--fail-slow=1s` threshold flagging an otherwise-passing test and time/order-dependent flakes unrelated to this change. ## Release Note Bump `aiohttp` to `3.14.1` to remediate 21 reported CVEs. Part of elastic/security#12526 Made with [Cursor](https://cursor.com) Co-authored-by: Cursor <cursoragent@cursor.com>

Jan-Kazlouski-elastic requested a review from a team as a code owner July 20, 2026 18:59

Jan-Kazlouski-elastic added auto-backport ci:packaging v9.5.0 v9.3.8 v9.4.4 v9.6.0 v8.19.19 labels Jul 20, 2026

Jan-Kazlouski-elastic changed the title ~~fix(deps): bump aiohttp to 3.14.1 to remediate 21 CVEs~~ fix(deps): bump aiohttp to 3.14.1 Jul 20, 2026

Update NOTICE.txt

fed564f

Jan-Kazlouski-elastic added v9.4.5 v8.19.20 v9.3.8.1 and removed v9.3.8 v9.4.4 v8.19.19 labels Jul 20, 2026

Jan-Kazlouski-elastic requested review from artem-shelkovnikov and erikcurrin-elastic July 20, 2026 19:44

Jan-Kazlouski-elastic self-assigned this Jul 20, 2026

erikcurrin-elastic approved these changes Jul 20, 2026

View reviewed changes

Jan-Kazlouski-elastic enabled auto-merge (squash) July 21, 2026 06:10

Merge branch 'main' into jan-kazlouski/12526-cve-2026-54273-fix

8ffa444

Jan-Kazlouski-elastic merged commit d48c358 into main Jul 21, 2026
4 checks passed

Jan-Kazlouski-elastic deleted the jan-kazlouski/12526-cve-2026-54273-fix branch July 21, 2026 06:51

This was referenced Jul 21, 2026

[9.5] fix(deps): bump aiohttp to 3.14.1 (#4237) #4245

Merged

[9.4] fix(deps): bump aiohttp to 3.14.1 (#4237) #4246

Merged

[9.3] fix(deps): bump aiohttp to 3.14.1 (#4237) #4247

Merged

Jan-Kazlouski-elastic mentioned this pull request Jul 21, 2026

[8.19] fix(deps): bump aiohttp to 3.14.1 (#4237) #4248

Merged

Navigation Menu

Uh oh!

fix(deps): bump aiohttp to 3.14.1 - #4237

fix(deps): bump aiohttp to 3.14.1#4237
Jan-Kazlouski-elastic merged 3 commits into
mainfrom
jan-kazlouski/12526-cve-2026-54273-fix

Jan-Kazlouski-elastic commented Jul 20, 2026

Uh oh!

erikcurrin-elastic left a comment

Uh oh!

Jan-Kazlouski-elastic commented Jul 21, 2026

Uh oh!

Uh oh!

github-actions Bot commented Jul 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Jan-Kazlouski-elastic commented Jul 20, 2026

Part of https://github.com/elastic/security/issues/12526

aiohttp 3.14 test compatibility (no runtime change)

Checklists

Pre-Review Checklist

Changes Requiring Extra Attention

Scanner A/B (aiohttp 3.13.3 → 3.14.1)

Release Note

Uh oh!

erikcurrin-elastic left a comment

Choose a reason for hiding this comment

Uh oh!

Jan-Kazlouski-elastic commented Jul 21, 2026

Best-effort regression testing (bump is behavior-safe)

Uh oh!

Uh oh!

github-actions Bot commented Jul 21, 2026

💔 Failed to create backport PR(s)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Scanner A/B (aiohttp `3.13.3` → `3.14.1`)