chore(deps-dev): bump aiohttp from 3.13.5 to 3.14.0#1521
Closed
dependabot[bot] wants to merge 1 commit into
Closed
chore(deps-dev): bump aiohttp from 3.13.5 to 3.14.0#1521dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Microsoft GitHub Policy Service / GitOps/AdvancedSecurity
failed
Jul 10, 2026 in 0s
Dependency Review
Dependency review detected vulnerable
Details
Dependency review summary
We have found 8 vulnerable package(s).
Vulnerability
Vulnerabilities were filtered by minimum severity Moderate.
| Dependency | File Name | Version | Vulnerability | Severity |
|---|---|---|---|---|
| aiohttp | requirements-dev.txt | 3.14.0 | aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges | Moderate |
| aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines | Moderate | |||
| aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup | Moderate | |||
| aiohttp: HTTP/1 Pipelined Requests Queue Without Limit | Moderate | |||
| aiohttp: Incomplete websocket frame payloads bypass memory limits | Moderate | |||
| aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence | Low | |||
| aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect | Low | |||
| aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections | Low |
Loading