[9.4] fix(deps): bump aiohttp to 3.14.1 (#4237) - #4246
Merged
Conversation
## Part of elastic/security#12526 Bumps `aiohttp` `3.13.3` → `3.14.1` in both `app/connectors_service` and `libs/connectors_sdk`. This single bump remediates **21** `aiohttp` CVEs currently reported against the `main` pin (`3.13.3`) — every CVE fixed in aiohttp `3.13.4`, `3.14.0`, and `3.14.1`. The full list (with tracking issues) is in the Scanner A/B section below. connectors uses `aiohttp` only as an HTTP **client** (`aiohttp.ClientSession`) and never runs an aiohttp web server, so the server-side CVEs in this set are **Not Affected** in practice. The bump is applied proactively to clear the advisories and keep the dependency current. ### aiohttp 3.14 test compatibility (no runtime change) aiohttp 3.14 added a required `stream_writer` argument to `ClientResponse` (which breaks `aioresponses`, which has no released fix) and deprecated `BasicAuth` / the `auth=` parameter. To keep the suite green with **no runtime behavior change**: - A self-gating `aioresponses` shim in both test `conftest.py` files — injects a no-op `stream_writer` when the caller omits it; inert on aiohttp `<3.14` and once `aioresponses` ships a fix. - Two benign deprecation warnings (`BasicAuth`, `auth=`) added to `filterwarnings`, consistent with the existing third-party deprecation ignores in this repo. The `auth=` / `BasicAuth` → `encode_basic_auth()` migration is deferred to a follow-up before aiohttp 4.0. ## Checklists #### Pre-Review Checklist - [x] this PR does NOT contain credentials of any kind, such as API keys or username/passwords (double check `config.yml.example`) - [x] this PR has a meaningful title - [x] this PR links to all relevant github issues that it fixes or partially addresses - [x] this PR has a thorough description - [x] Covered the changes with automated tests - [x] Tested the changes locally - [x] Added a label for each target release version (example: `v7.13.2`, `v7.14.0`, `v8.0.0`) - [x] For bugfixes: backport safely to all minor branches still receiving patch releases #### Changes Requiring Extra Attention - [x] Security-related changes (encryption, TLS, SSRF, etc) ## Scanner A/B (aiohttp `3.13.3` → `3.14.1`) Before = `aiohttp==3.13.3` (current `main` pin) · After = `aiohttp==3.14.1` (this PR). `pip-audit`, `Trivy`, and `Snyk` were each run against both pins. | Tool | Before (`3.13.3`) | After (`3.14.1`) | |------|-------------------|------------------| | pip-audit | 21 reported | 0 — clear | | Trivy | 21 reported | 0 — clear | | Snyk | 21 reported | 0 — clear | All **21** CVEs / issues remediated by this PR — reported on `3.13.3` by all three tools, clear on `3.14.1`: | CVE | Issue | Fixed in aiohttp | Before | After | |-----|-------|------------------|--------|-------| | CVE-2026-22815 | elastic/security#12501 | 3.13.4 | reported | clear | | CVE-2026-34513 | elastic/security#12507 | 3.13.4 | reported | clear | | CVE-2026-34514 | elastic/security#12508 | 3.13.4 | reported | clear | | CVE-2026-34515 | elastic/security#12509 | 3.13.4 | reported | clear | | CVE-2026-34516 | elastic/security#12510 | 3.13.4 | reported | clear | | CVE-2026-34517 | elastic/security#12511 | 3.13.4 | reported | clear | | CVE-2026-34518 | elastic/security#12512 | 3.13.4 | reported | clear | | CVE-2026-34519 | elastic/security#12513 | 3.13.4 | reported | clear | | CVE-2026-34520 | elastic/security#12514 | 3.13.4 | reported | clear | | CVE-2026-34525 | elastic/security#12515 | 3.13.4 | reported | clear | | CVE-2026-34993 | elastic/security#12516 | 3.14.0 | reported | clear | | CVE-2026-47265 | elastic/security#12519 | 3.14.0 | reported | clear | | CVE-2026-50269 | elastic/security#12537 | 3.14.0 | reported | clear | | CVE-2026-54273 | elastic/security#12526 | 3.14.1 | reported | clear | | CVE-2026-54274 | elastic/security#12527 | 3.14.1 | reported | clear | | CVE-2026-54275 | elastic/security#12528 | 3.14.1 | reported | clear | | CVE-2026-54276 | elastic/security#12529 | 3.14.1 | reported | clear | | CVE-2026-54277 | elastic/security#12530 | 3.14.1 | reported | clear | | CVE-2026-54278 | elastic/security#12531 | 3.14.1 | reported | clear | | CVE-2026-54279 | elastic/security#12532 | 3.14.1 | reported | clear | | CVE-2026-54280 | elastic/security#12533 | 3.14.1 | reported | clear | <sub>The 8 CVEs fixed in aiohttp `3.13.3` (`CVE-2025-69223`…`CVE-2025-69230`, elastic/security#12492–#12499) are already remediated on `main` and are out of scope for this PR.</sub> ## Release Note Bump `aiohttp` to `3.14.1` to remediate 21 reported CVEs. --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
entsearchmachine
approved these changes
Jul 21, 2026
9 tasks
Jan-Kazlouski-elastic
added a commit
that referenced
this pull request
Jul 21, 2026
Backports #4237 to `8.19`. ## What Bumps `aiohttp` `3.13.3` → `3.14.1` in `requirements/framework.txt`, remediating **21** reported `aiohttp` CVEs (every CVE fixed across aiohttp `3.13.4`, `3.14.0`, `3.14.1`). connectors uses `aiohttp` only as an HTTP **client** (`aiohttp.ClientSession`) and never runs an aiohttp web server, so the server-side CVEs in this set are **Not Affected** in practice; the bump is applied proactively to clear the advisories. This is the missing `8.19` line for #4237 — the `9.5`/`9.4`/`9.3` backports already merged (#4245/#4246/#4247), but no `8.19` backport was ever opened despite the `v8.19.20` label. ## aiohttp 3.14 test compatibility (no runtime change) aiohttp 3.14 made `stream_writer` a required kwarg of `ClientResponse` (which `aioresponses` omits) and deprecated `BasicAuth` / the `auth=` parameter. To keep the suite green with **no runtime behavior change**: - A self-gating `aioresponses` shim in `tests/conftest.py` — injects a no-op `stream_writer` when the caller omits it; inert on aiohttp `<3.14` and once `aioresponses` ships a fix. - Two benign deprecation warnings (`BasicAuth`, `auth=`) added to `pytest.ini` `filterwarnings`, consistent with existing third-party deprecation ignores. `NOTICE.txt` regenerated via `make install`. ## Testing `make clean install autoformat lint test PYTHON=python3.11` — lint clean, `NOTICE.txt` regenerated, and the full suite passes (2437 passed). The only non-green signals were the aggressive local `--fail-slow=1s` threshold flagging an otherwise-passing test and time/order-dependent flakes unrelated to this change. ## Release Note Bump `aiohttp` to `3.14.1` to remediate 21 reported CVEs. Part of elastic/security#12526 Made with [Cursor](https://cursor.com) Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backports the following commits to 9.4: