fix(deps): take the aiohttp security fix (3.14.0 -> 3.14.1)#20
Merged
Conversation
Dependabot's security run fails outright, so the advisory never turned into a
PR:
Handled error whilst updating aiohttp: dependency_file_not_resolvable
× No solution found ... Because there is no version of aiohttp==3.14.1
"No version" is misleading -- 3.14.1 exists, but this repo's supply-chain
cooldown hid it. uv says so itself:
hint: `aiohttp` was filtered by `exclude-newer` to only include packages
uploaded before 2026-06-07T00:00:00Z. The requested version, v3.14.1, was
published at 2026-06-07T21:05:37Z.
The fix landed 21 hours past the cutoff, so every resolution kept the vulnerable
3.14.0 and the updater could not satisfy its own request.
Per the convention documented on the setting ("when merging a Dependabot uv
update, bump this to that day's date and re-run `uv lock`"), move exclude-newer
to 2026-07-22 and pull aiohttp forward. Note the bump alone is not enough --
uv is conservative and keeps the locked version -- so aiohttp is upgraded
explicitly.
Verified: `uv sync --locked --all-extras` succeeds and `pytest` passes
(345 passed, 2 deselected). aiohttp is the only package whose version changes.
The failing resolution was reported for the `python_full_version >= '3.14' and
sys_platform == 'win32'` split, even though CI only runs ubuntu/macos. That
split resolves again with the newer cutoff, so no environments restriction is
added here; if it resurfaces, `tool.uv.environments` is the lever.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
症状
Dependabotチェックが失敗し、aiohttp のセキュリティ勧告が PR にならないまま握り潰されていた。真因: 供給鎖クールダウンが修正版を隠していた
"no version" は誤解を招く表現で、3.14.1 は存在する。uv 自身がヒントで指摘している:
修正版が cutoff の 21時間後に公開されたため、解決は常に脆弱な 3.14.0 を掴み、更新側は自分の要求を満たせず落ちていた。
対応
設定に書かれた運用規約（"when merging a Dependabot uv update, bump this to that day's date and re-run
uv lock"）に従い、exclude-newerを 2026-07-22 へ進めて aiohttp を取り込む。cutoff の更新だけでは不十分な点に注意 — uv は保守的に既存ロック版を維持するため、aiohttp は明示的に上げている。
検証
uv sync --locked --all-extras（CIのguard）pytestwin32 split について
失敗は
python_full_version >= '3.14' and sys_platform == 'win32'の split で報告されていたが、CI のマトリクスは ubuntu/macos のみで Windows は一度もテストしていない。この split は新しい cutoff で解決するようになったため、今回はtool.uv.environmentsによる環境制限は入れていない。再発したらそれが対処の手段になる。