diff --git a/changelog.d/1914-aiohttp.fixed.md b/changelog.d/1914-aiohttp.fixed.md
new file mode 100644
index 0000000000..517ace3441
--- /dev/null
+++ b/changelog.d/1914-aiohttp.fixed.md
@@ -0,0 +1 @@
+- Pinned `aiohttp>=3.13,<3.14` in `requirements/base.txt`. aiohttp 3.14.0 removed `aiohttp.streams.AsyncStreamReaderMixin`, which the pinned `vcrpy==8.1.1` aiohttp stub imports at module load — a fresh dependency resolution in CI picked up 3.14.0 and aborted the entire pytest collection with `AttributeError`. The cap should be lifted alongside a `vcrpy` bump that supports the aiohttp 3.14 stream API.
diff --git a/requirements/base.txt b/requirements/base.txt
index f455a4e087..21336b38d5 100644
--- a/requirements/base.txt
+++ b/requirements/base.txt
@@ -12,6 +12,7 @@ typing-extensions==4.*  # https://github.com/python/typing_extensions
 requests>=2.34.2,<3  # https://requests.readthedocs.io/en/latest/
 httpx>=0.28.1,<1  # https://github.com/encode/httpx - async HTTP for agent tools
 brotli>=1.2.0  # decoder for httpx Content-Encoding: br responses (e.g. OpenAI API, VCR cassettes). Floor raised to 1.2.0 to pick up the upstream security fix that bounds decompressor output via Decompressor.output_buffer_limit, preventing memory exhaustion from crafted br-encoded payloads.
+aiohttp>=3.13,<3.14  # transitive via llama-index-core; cap below 3.14 because aiohttp 3.14.0 removed aiohttp.streams.AsyncStreamReaderMixin, which the pinned vcrpy==8.1.1 aiohttp stub imports at module load (AttributeError on import → whole pytest suite fails). Lift this cap together with a vcrpy bump that supports aiohttp 3.14+.
 
 
 # Django
@@ -41,7 +42,7 @@ drf-extra-fields==3.7.0  # https://github.com/Hipo/drf-extra-fields
 pypdf>=6.12.2,<7  # https://github.com/py-pdf/pypdf
 plasmapdf==0.1.3  # https://github.com/Jsv4/plasmapdf
 pdf2image>=1.17.0
-openai>=2.38.0,<3  # https://github.com/openai/openai-python (pydantic-ai 1.x requires >=2.11.0)
+openai>=2.41.0,<3  # https://github.com/openai/openai-python (pydantic-ai 1.x requires >=2.11.0)
 # Bumping pydantic-ai is a deliberate decision: this codebase relies on the
 # precedence rule that ``instructions=`` (not ``system_prompt=``) is the only
 # way to deliver a system instruction when ``message_history`` is non-empty