From 616590cdc0445a6d9d0ea09a40d5f0a67f4bcaa5 Mon Sep 17 00:00:00 2001 From: TPTBusiness Date: Fri, 17 Apr 2026 22:02:07 +0200 Subject: [PATCH] fix(deps): pin aiohttp>=3.13.4 to patch 4 CVEs Explicitly require aiohttp>=3.13.4 to ensure the patched version is installed regardless of what mlflow, langchain-community, or litellm resolve as their transitive dependency. Fixes Dependabot alerts #64, #67, #68, #73: - CVE-2026-22815: unlimited trailer headers (memory exhaustion) - CVE-2026-34515: UNC SSRF / NTLMv2 credential theft on Windows - CVE-2026-34516: multipart header size bypass (DoS) - CVE-2026-34525: duplicate Host header acceptance Co-Authored-By: Claude Sonnet 4.6 --- requirements.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/requirements.txt b/requirements.txt index f958ad7b..6b93d288 100644 --- a/requirements.txt +++ b/requirements.txt @@ -9,6 +9,7 @@ fire fuzzywuzzy openai litellm>=1.73 # to support `from litellm import get_valid_models` +aiohttp>=3.13.4 # CVE-2026-22815, CVE-2026-34515, CVE-2026-34516, CVE-2026-34525 azure.identity pyarrow rich