security(deps): aiohttp 3.14.1 CVE floor across lazy messaging paths + pin-drift guard (salvage #42334) - #56237
Merged
Merged
Conversation
…tography floor - aiohttp 3.13.4 -> 3.14.0 (messaging/slack/homeassistant/sms extras + lazy_deps platform.slack) — picks up CVE-2026-34993 (RCE via CookieJar.load deserialization) and CVE-2026-47265 (per-request cookie leak on cross-origin redirect). Both are fixed only in 3.14.0; there is no 3.13.x backport. - anthropic 0.86.0 -> 0.87.0 (anthropic extra) — CVE-2026-34450 / CVE-2026-34452. lazy_deps provider.anthropic was already 0.87.0; the extra pin had drifted back to the vulnerable 0.86.0, so this realigns it. - cryptography pinned explicitly at 46.0.7 in core deps — CVE-2026-39892, CVE-2026-34073. It only arrives transitively via PyJWT[crypto]; the explicit floor keeps the WeCom/Weixin crypto paths from drifting below the fix. uv.lock regenerated; only aiohttp / anthropic moved (cryptography already resolved to 46.0.7). Verified 3.14.0 satisfies discord.py 2.7.1 (aiohttp>=3.7.4,<4) and slack-sdk 3.40.1 (aiohttp>=3.7.3,<4).
Adds two checks to tests/test_packaging_metadata.py: 1. No package is exact-pinned to two different versions across pyproject.toml's [project.dependencies] / extras. 2. Every package pinned in BOTH the pyproject extras and the LAZY_DEPS allowlist in tools/lazy_deps.py uses the same version. This is the regression guard for the drift the rest of this PR fixes: the two pin sources are hand-maintained mirrors (lazy_deps even documents "update both this map AND the corresponding extra"), and they have silently diverged on aiohttp and anthropic. Run against the pre-fix tree, check (2) fails on `anthropic: pyproject=['0.86.0'] lazy_deps=['0.87.0']`. The lazy_deps side is parsed via AST (not imported) so the test stays free of tools/lazy_deps.py runtime imports; only exact `==` pins are compared.
scripts/release.py AUTHOR_MAP is greped by the Contributor Attribution Check to resolve a commit author's email -> GitHub username. Add huangsen365@gmail.com -> huangsen365 so this PR's commits pass the check. (This commit originally also carried a gateway race-test flake fix; that edit is now dropped because main independently hardened the same test with a superior server._sessions snapshot/restore isolation, making ours redundant.)
… + coverage guard The messaging extra and platform.slack pin aiohttp==3.14.0, but several lazy messaging features listed only their SDK and let aiohttp come in transitively. Each of those SDKs caps aiohttp loosely enough that a vulnerable already-installed aiohttp still satisfies the range, so the eager extras got the patched floor while the lazy paths did not: - discord.py (aiohttp>=3.7.4,<4) - mautrix / aiohttp-socks (aiohttp>=3,<4 / aiohttp>=3.10.0) [Matrix] - microsoft-teams-apps (aiohttp<4) [Teams] (Teams additionally shipped an explicit but *stale* aiohttp==3.13.4 in both the pyproject `teams` extra and platform.teams.) - tools/lazy_deps.py: add aiohttp==3.14.0 to platform.discord, platform.matrix; bump the stale platform.teams pin 3.13.4 -> 3.14.0. - pyproject.toml: add aiohttp==3.14.0 to the matrix extra; bump the teams extra 3.13.4 -> 3.14.0 (homeassistant/sms/messaging already at 3.14.0). - tests/test_packaging_metadata.py: test_security_pins_present_in_mirrored_lazy_features now covers platform.discord/slack/matrix/teams. The existing agree-guard only compares packages pinned in BOTH sources, so it can't catch a lazy feature that omits a pin entirely; this guard is an explicit coverage contract (security package -> lazy features that must carry it) and fails with 'platform.matrix: aiohttp=MISSING' if a floor is dropped again. - uv.lock: regenerated, zero drift (aiohttp 3.14.0).
3.14.1 is the current patched release on the 3.14 line; both CVE-2026-34993 (CookieJar.load RCE) and CVE-2026-47265 (per-request cookie leak on cross-origin redirect) are fixed as of 3.14.0, and 3.14.1 rolls up the subsequent point fixes. Re-locked uv.lock.
alt-glitch
added
type/security
kshitijk4poor
approved these changes
Jul 1, 2026
1 task
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes an active aiohttp vulnerability on the lazy messaging install paths and adds a chokepoint so this pin-drift class can't recur.
Salvage of #42334 (@huangsen365, first-time contributor). His four commits are preserved with authorship; one follow-up commit bumps the pin to the current patched point release (
3.14.1) and re-locks.Changes
3.13.4→3.14.1across all 6 pyproject extras (messaging,slack,matrix,homeassistant,sms,teams) and theLAZY_DEPSmessaging features.3.14.0fixed the CVEs;3.14.1is the current patched release on that line.platform.discordandplatform.matrixpull aiohttp transitively (viadiscord.py/mautrix+aiohttp-socks) but carried no explicit pin, so the lazy path could keep an already-installed vulnerable aiohttp satisfying the loose<4/>=3.10range. Now pinned to the patched floor directly.tests/test_packaging_metadata.py: pyproject-internal pin consistency, pyproject↔lazy_deps.pyagreement, and per-feature security-pin coverage (AST-parsed, exact pins only).cryptography==46.0.7explicit floor (previously transitive-only viaPyJWT[crypto]);anthropic==0.87.0(already current on main — kept for the contributor's commit intact).scripts/release.pyAUTHOR_MAP entry for the attribution check;uv.lockre-synced.Root cause
3.13.4is vulnerable to CVE-2026-34993 (CookieJar.load()deserialization → RCE) and CVE-2026-47265 (per-request cookies leaked after a cross-origin redirect — relevant to the OAuth-token-handling gateway). Both fixed only in3.14.0; no3.13.xbackport. Both confirmed in NVD/GHSA.Validation
3.13.4(vulnerable)3.14.1(patched)platform.discord/matrixaiohttp pinuv lock --checktests/test_packaging_metadata.pyInfographic