Update dependency aiohttp to v3.14.3

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
aiohttp	==3.14.1 → ==3.14.3

---

Release Notes

aio-libs/aiohttp (aiohttp)

v3.14.3

Compare Source

===================

Bug fixes

• Fixed the client dropping only the first Authorization, Cookie and
  Proxy-Authorization header when a redirect crossed an origin -- by :user:arshsmith1.

  Related issues and pull requests on GitHub:
  :issue:13180.

• Fixed error message construction in the C HTTP parser -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:13222.

---

v3.14.2

Compare Source

===================

Bug fixes

• Fixed :py:attr:~aiohttp.web.StreamResponse.last_modified rounding a
  :class:datetime.datetime with a fractional second down.

  Related issues and pull requests on GitHub:
  :issue:5303.

• Fixed resolving localhost on Windows to fall back without AI_ADDRCONFIG
  when the first lookup fails, so localhost still works without an active
  network.

  Related issues and pull requests on GitHub:
  :issue:5357.

• Rejected multipart body parts whose Content-Length header is not a
  plain sequence of digits (e.g. +5, -1, 1_0), matching the
  strictness of the main request parser per :rfc:9110#section-8.6
  -- by :user:dxbjavid.

  Related issues and pull requests on GitHub:
  :issue:12794.

• Fixed GunicornWebWorker endlessly reloading when app fails during startup -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12879.

• Fixed some inconsistent case sensitivity on request methods -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12931.

• Fixed IndexError: string index out of range in parse_content_disposition
  when a header parameter has an empty value (e.g. filename=).
  -- by :user:JSap0914.

  Related issues and pull requests on GitHub:
  :issue:12948.

• Fixed the sock_read timeout being re-armed on a keep-alive connection after
  it had been returned to the pool. An idle pooled connection could be left with a
  pending read timeout that fired and poisoned it, so the next request reusing the
  connection failed immediately with :exc:aiohttp.SocketTimeoutError. The read
  timeout is now only rescheduled when resuming a transport that was actually
  paused -- by :user:daragok.

  Related issues and pull requests on GitHub:
  :issue:12953, :issue:12954.

• Fixed the client decompressing frames when permessage-deflate was not negotiated -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12976.

• Fixed DigestAuthMiddleware raising an IndexError on empty domain -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12983.

• Fixed :class:~aiohttp.DigestAuthMiddleware corrupting the Digest
  challenge when a WWW-Authenticate response offered more than one
  authentication scheme -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12984.

• Fixed client not closing cleanly after an exception -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12985.

• Fixed control frames breaking fragmented WebSocket messages -- by :user:arshsmith1.

  Related issues and pull requests on GitHub:
  :issue:12988.

• Fixed parse_content_disposition rejecting otherwise-valid
  Content-Disposition header values that contain optional whitespace (OWS)
  around the disposition type (e.g. "form-data ; name=\"field\"").
  The disposition type is now stripped before token validation, consistent with
  how parameter keys are already handled -- by :user:JSap0914.

  Related issues and pull requests on GitHub:
  :issue:12996.

• Fixed an :exc:IndexError in the pure-Python HTTP parser -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13001.

• Fixed parsing optional whitespace in Content-Disposition -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13002.

• Fixed request body not being read on rejected WebSocket upgrades -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13016.

• Fixed :exc:LookupError (and an unguarded :exc:UnicodeDecodeError) escaping
  Content-Disposition parsing when a multipart part supplies an extended
  parameter with an unknown charset
  -- by :user:arshsmith1.

  Related issues and pull requests on GitHub:
  :issue:13042.

• Fixed escape_quotes in the Digest authentication middleware not escaping
  backslashes, so a WWW-Authenticate challenge value containing a backslash
  could break out of its quoted-string in the generated Authorization header
  -- by :user:dxbjavid.

  Related issues and pull requests on GitHub:
  :issue:13054.

• Fixed Python parser not rejecting a bare LF in the request line -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13136.

• Fixed the C HTTP parser folding the fragment into the query string for an
  origin-form request target with an empty query (e.g. /path?#frag),
  which diverged from the pure-Python parser -- by :user:GiulioDER.

  Related issues and pull requests on GitHub:
  :issue:13171.

• Fixed the C parser reporting newer HTTP methods such as QUERY as <unknown>;
  the method table is now derived from the vendored llhttp instead of a hand-maintained count
  -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13174.

Packaging updates and notes for downstreams

• Upgraded llhttp to v9.4.2 -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12956.

Contributor-facing changes

• Added admin documentation on incident response and on running reproducer code
  safely, covering security vulnerability handling and supply-chain, account, and
  CI/infrastructure compromise -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12914.

---

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.29%. Comparing base (ecf7fc0) to head (37b7396).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #241   +/-   ##
=======================================
  Coverage   85.29%   85.29%           
=======================================
  Files           8        8           
  Lines         775      775           
=======================================
  Hits          661      661           
  Misses        114      114           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.