[Snyk] Security upgrade aiohttp from 3.7.4 to 3.14.3

[sestinj]

Snyk has created this PR to fix 1 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

• manual-testing-sandbox/requirements.txt

⚠️ Warning

typer 0.3.2 has requirement click<7.2.0,>=7.1.1, but you have click 8.1.8.
thinc 8.0.17 requires preshed, which is not installed.
thinc 8.0.17 requires murmurhash, which is not installed.
thinc 8.0.17 requires cymem, which is not installed.
spacy 3.1.2 requires preshed, which is not installed.
spacy 3.1.2 requires murmurhash, which is not installed.
spacy 3.1.2 requires cymem, which is not installed.
qtconsole 5.4.4 requires pyzmq, which is not installed.
notebook 6.5.7 requires pyzmq, which is not installed.
jupyter-server 1.24.0 requires pyzmq, which is not installed.
jupyter-console 6.6.3 requires pyzmq, which is not installed.
jupyter-client 7.4.9 requires pyzmq, which is not installed.
ipykernel 6.16.2 requires pyzmq, which is not installed.
exceptiongroup 1.3.1 has requirement typing-extensions>=4.6.0; python_version < "3.13", but you have typing-extensions 3.10.0.2.

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.
• Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Use After Free

[sestinj]

This upgrade from aiohttp 3.7.4 to 3.14.3 spans multiple minor versions and introduces significant breaking changes, deprecations, and new environment requirements. Careful review and testing are required.

Key Breaking Changes:

• Python Version Support Dropped: This is the most significant change. The target version 3.14.3 requires Python 3.10+. [9] Support for Python 3.6, 3.7, 3.8, and 3.9 was dropped in intermediate versions. [1, 2] Your environment must be running a compatible Python version.
• BaseRequest.host Behavior Change (v3.14.0): The server no longer uses blocking socket.getfqdn() as a fallback for the Host header. The fallback is now the local socket address. Code that relied on the FQDN being returned must be updated. [1, 5]
• AsyncStreamReaderMixin Removed (v3.14.0): The internal aiohttp.streams.AsyncStreamReaderMixin was removed. This can break third-party libraries like older versions of vcrpy that depended on it. [7]
• CookieJar.load() Behavior Change (v3.13.0): CookieJar.load() now replaces the jar's contents instead of merging. Cookies for IP-address hosts will be dropped unless the jar is created with unsafe=True. [5]
• normalize_path_middleware Redirect (v3.8.0): The middleware now uses a 308 Permanent Redirect instead of a 301 Moved Permanently. [4]

Deprecations for v4.0:

• BasicAuth and auth parameter: The BasicAuth helper and the auth/proxy_auth parameters in client requests are deprecated. You should migrate to using aiohttp.helpers.encode_basic_auth() and setting the Authorization header manually. [1, 5]
• pytest_plugin: The built-in pytest plugin is deprecated. Users should switch to the standalone pytest-aiohttp package. [1, 5]

Recommendation:

1. Verify Python Version: Ensure your production environment is running Python 3.10 or newer.
2. Review Code: Check for usage of the auth parameter, BaseRequest.host fallbacks, and CookieJar.load() for potential issues.
3. Check Dependencies: Verify that other libraries in your project (like vcrpy) are compatible with aiohttp >= 3.14.
4. Test Thoroughly: Due to the number of changes, especially around security fixes and parser behavior, thorough testing of your application's client and server interactions is critical.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.