fix: ensure BodyPartReader.read() returns bytes, not bytearray

BodyPartReader.read() accumulated data in a bytearray buffer and
returned it directly, violating the documented return type of bytes.
Both the plain and decode=True code paths were affected.

Convert the internal bytearray to bytes before returning so the
API contract matches the documentation and type hints.

Fixes #12404

Author: CrepuscularIRIS

CHANGES/12404.bugfix.rst

@@ -0,0 +1,3 @@
+Fixed ``BodyPartReader.read()`` and ``BodyPartReader.read(decode=True)`` returning
+``bytearray`` instead of ``bytes``, violating the documented API contract.
+-- by :user:`CrepuscularIRIS`.

aiohttp/multipart.py

@@ -322,8 +322,8 @@ async def read(self, *, decode: bool = False) -> bytes:
                 decoded_data.extend(d)
                 if len(decoded_data) > self._client_max_size:
                     raise self._max_size_error_cls(self._client_max_size)
-            return decoded_data
-        return data
+            return bytes(decoded_data)
+        return bytes(data)
 
     async def read_chunk(self, size: int = chunk_size) -> bytes:
         """Reads body part content chunk of the specified size.

tests/test_multipart.py

@@ -185,6 +185,25 @@ async def test_read(self) -> None:
             assert b"Hello, world!" == result
             assert obj.at_eof()
 
+    async def test_read_returns_bytes_not_bytearray(self) -> None:
+        # Regression test for https://github.com/aio-libs/aiohttp/issues/12404
+        # read() must return bytes (not bytearray) to honour the documented API contract.
+        with Stream(b"Hello, world!\r\n--:") as stream:
+            d = CIMultiDictProxy[str](CIMultiDict())
+            obj = aiohttp.BodyPartReader(BOUNDARY, d, stream)
+            result = await obj.read()
+            assert isinstance(result, bytes), f"Expected bytes, got {type(result).__name__}"
+
+    async def test_read_decode_returns_bytes_not_bytearray(self) -> None:
+        # Regression test for https://github.com/aio-libs/aiohttp/issues/12404
+        # read(decode=True) must return bytes (not bytearray) even when no
+        # Content-Transfer-Encoding / Content-Encoding header is present.
+        with Stream(b"Hello, world!\r\n--:") as stream:
+            d = CIMultiDictProxy[str](CIMultiDict())
+            obj = aiohttp.BodyPartReader(BOUNDARY, d, stream)
+            result = await obj.read(decode=True)
+            assert isinstance(result, bytes), f"Expected bytes, got {type(result).__name__}"
+
     async def test_read_chunk_at_eof(self) -> None:
         with Stream(b"--:") as stream:
             d = CIMultiDictProxy[str](CIMultiDict())