From e789b2374aec2d06deff4b902a0aaa96760f5147 Mon Sep 17 00:00:00 2001 From: maziggy Date: Tue, 9 Jun 2026 13:40:03 +0200 Subject: [PATCH] chore(deps): pin aiohttp >=3.14.0 for CVE-2026-34993 + CVE-2026-47265 pywebpush brings aiohttp in transitively with no version bound, so the resolver kept installing 3.13.5. Both CVEs are fixed in 3.14.0; direct floor pin here, same shape as the existing idna / urllib3 / starlette transitive pins. Our usage in services/external_camera.py is unaffected by 3.14.0 (ClientSession, ClientTimeout, ClientError, iter_chunked all unchanged); 29 external_camera tests pass on 3.14.1; pip-audit clean. --- requirements.txt | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/requirements.txt b/requirements.txt index 550ea9fdb..614d37fb8 100644 --- a/requirements.txt +++ b/requirements.txt @@ -101,6 +101,14 @@ urllib3>=2.7.0 # directly to stop the resolver from picking the vulnerable build. starlette>=1.0.1 +# Transitive of pywebpush (unpinned `aiohttp` requirement). aiohttp 3.13.5 +# has CVE-2026-34993 and CVE-2026-47265, both fixed in 3.14.0. pywebpush +# doesn't declare an upper bound either way, so without this pin the +# resolver keeps installing the vulnerable 3.13.x line. Our direct usage +# in services/external_camera.py (ClientSession, ClientTimeout, ClientError, +# iter_chunked) is unaffected by 3.14.0. +aiohttp>=3.14.0 + # Plate Detection (optional - enables build plate empty detection) opencv-python-headless>=4.8.0 numpy>=1.24.0