chore(deps): update aiohttp to ~=3.13.3 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
aiohttp	~= 3.11.18 → ~=3.13.3

GitHub Vulnerability Alerts

CVE-2025-53643

Summary

The Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request.

Impact

If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.

---

Patch: aio-libs/aiohttp@e8d774f

CVE-2025-69223

Summary

A zip bomb can be used to execute a DoS against the aiohttp server.

Impact

An attacker may be able to send a compressed request that when decompressed by aiohttp could exhaust the host's memory.

---

Patch: aio-libs/aiohttp@2b920c3

CVE-2025-69224

Summary

The Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters.

Impact

If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.

---

Patch: aio-libs/aiohttp@32677f2

CVE-2025-69226

Summary

Path normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the
existence of absolute path components.

Impact

If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components.

---

Patch: aio-libs/aiohttp@f2a86fd

CVE-2025-69225

Summary

The parser allows non-ASCII decimals to be present in the Range header.

Impact

There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability.

---

Patch: aio-libs/aiohttp@c7b7a04

CVE-2025-69228

Summary

A request can be crafted in such a way that an aiohttp server's memory fills up uncontrollably during processing.

Impact

If an application includes a handler that uses the Request.post() method, an attacker may be able to freeze the server by exhausting the memory.

---

Patch: aio-libs/aiohttp@b7dbd35

CVE-2025-69227

Summary

When assert statements are bypassed, an infinite loop can occur, resulting in a DoS attack when processing a POST body.

Impact

If optimisations are enabled (-O or PYTHONOPTIMIZE=1), and the application includes a handler that uses the Request.post() method, then an attacker may be able to execute a DoS attack with a specially crafted message.

---

Patch: aio-libs/aiohttp@bc1319e

CVE-2025-69229

Summary

Handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks.

Impact

If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time.

---

Patch: aio-libs/aiohttp@dc3170b
Patch: aio-libs/aiohttp@4ed97a4

CVE-2025-69230

Summary

Reading multiple invalid cookies can lead to a logging storm.

Impact

If the cookies attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs using a specially crafted Cookie header.

---

Patch: aio-libs/aiohttp@64629a0

---

Release Notes

aio-libs/aiohttp (aiohttp)

v3.13.3

Compare Source

===================

This release contains fixes for several vulnerabilities. It is advised to
upgrade as soon as possible.

Bug fixes

• Fixed proxy authorization headers not being passed when reusing a connection, which caused 407 (Proxy authentication required) errors
  -- by :user:GLeurquin.

  Related issues and pull requests on GitHub:
  :issue:2596.

• Fixed multipart reading failing when encountering an empty body part -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:11857.

• Fixed a case where the parser wasn't raising an exception for a websocket continuation frame when there was no initial frame in context.

  Related issues and pull requests on GitHub:
  :issue:11862.

Removals and backward incompatible breaking changes

• Brotli and brotlicffi minimum version is now 1.2.
  Decompression now has a default maximum output size of 32MiB per decompress call -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:11898.

Packaging updates and notes for downstreams

• Moved dependency metadata from :file:setup.cfg to :file:pyproject.toml per :pep:621
  -- by :user:cdce8p.

  Related issues and pull requests on GitHub:
  :issue:11643.

Contributor-facing changes

• Removed unused update-pre-commit github action workflow -- by :user:Cycloctane.

  Related issues and pull requests on GitHub:
  :issue:11689.

Miscellaneous internal changes

• Optimized web server performance when access logging is disabled by reducing time syscalls -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:10713.

• Added regression test for cached logging status -- by :user:meehand.

  Related issues and pull requests on GitHub:
  :issue:11778.

---

v3.13.2: 3.13.2

Compare Source

Bug fixes

• Fixed cookie parser to continue parsing subsequent cookies when encountering a malformed cookie that fails regex validation, such as Google's g_state cookie with unescaped quotes -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  #​11632.

• Fixed loading netrc credentials from the default :file:~/.netrc (:file:~/_netrc on Windows) location when the :envvar:NETRC environment variable is not set -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  #​11713, #​11714.

• Fixed WebSocket compressed sends to be cancellation safe. Tasks are now shielded during compression to prevent compressor state corruption. This ensures that the stateful compressor remains consistent even when send operations are cancelled -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  #​11725.

---

v3.13.1

Compare Source

===================

Features

• Make configuration options in AppRunner also available in run_app()
  -- by :user:Cycloctane.

  Related issues and pull requests on GitHub:
  :issue:11633.

Bug fixes

• Switched to backports.zstd for Python <3.14 and fixed zstd decompression for chunked zstd streams -- by :user:ZhaoMJ.

  Note: Users who installed zstandard for support on Python <3.14 will now need to install
  backports.zstd instead (installing aiohttp[speedups] will do this automatically).

  Related issues and pull requests on GitHub:
  :issue:11623.

• Updated Content-Type header parsing to return application/octet-stream when header contains invalid syntax.
  See :rfc:9110#section-8.3-5.

  -- by :user:sgaist.

  Related issues and pull requests on GitHub:
  :issue:10889.

• Fixed Python 3.14 support when built without zstd support -- by :user:JacobHenner.

  Related issues and pull requests on GitHub:
  :issue:11603.

• Fixed blocking I/O in the event loop when using netrc authentication by moving netrc file lookup to an executor -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:11634.

• Fixed routing to a sub-application added via .add_domain() not working
  if the same path exists on the parent app. -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:11673.

Packaging updates and notes for downstreams

• Moved core packaging metadata from :file:setup.cfg to :file:pyproject.toml per :pep:621
  -- by :user:cdce8p.

  Related issues and pull requests on GitHub:
  :issue:9951.

---

v3.13.0

Compare Source

===================

Features

• Added support for Python 3.14.

  Related issues and pull requests on GitHub:
  :issue:10851, :issue:10872.

• Added support for free-threading in Python 3.14+ -- by :user:kumaraditya303.

  Related issues and pull requests on GitHub:
  :issue:11466, :issue:11464.

• Added support for Zstandard (aka Zstd) compression
  -- by :user:KGuillaume-chaps.

  Related issues and pull requests on GitHub:
  :issue:11161.

• Added StreamReader.total_raw_bytes to check the number of bytes downloaded
  -- by :user:robpats.

  Related issues and pull requests on GitHub:
  :issue:11483.

Bug fixes

• Fixed pytest plugin to not use deprecated :py:mod:asyncio policy APIs.

  Related issues and pull requests on GitHub:
  :issue:10851.

• Updated Content-Disposition header parsing to handle trailing semicolons and empty parts
  -- by :user:PLPeeters.

  Related issues and pull requests on GitHub:
  :issue:11243.

• Fixed saved CookieJar failing to be loaded if cookies have partitioned flag when
  http.cookie does not have partitioned cookies supports. -- by :user:Cycloctane.

  Related issues and pull requests on GitHub:
  :issue:11523.

Improved documentation

• Added Wireup to third-party libraries -- by :user:maldoinc.

  Related issues and pull requests on GitHub:
  :issue:11233.

Packaging updates and notes for downstreams

• The blockbuster test dependency is now optional; the corresponding test fixture is disabled when it is unavailable
  -- by :user:musicinybrain.

  Related issues and pull requests on GitHub:
  :issue:11363.

• Added riscv64 build to releases -- by :user:eshattow.

  Related issues and pull requests on GitHub:
  :issue:11425.

Contributor-facing changes

• Fixed test_send_compress_text failing when alternative zlib implementation
  is used. (zlib-ng in python 3.14 windows build) -- by :user:Cycloctane.

  Related issues and pull requests on GitHub:
  :issue:11546.

---

v3.12.15

Compare Source

====================

Bug fixes

• Fixed :class:~aiohttp.DigestAuthMiddleware to preserve the algorithm case from the server's challenge in the authorization response. This improves compatibility with servers that perform case-sensitive algorithm matching (e.g., servers expecting algorithm=MD5-sess instead of algorithm=MD5-SESS)
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:11352.

Improved documentation

• Remove outdated contents of aiohttp-devtools and aiohttp-swagger
  from Web_advanced docs.
  -- by :user:Cycloctane

  Related issues and pull requests on GitHub:
  :issue:11347.

Packaging updates and notes for downstreams

• Started including the llhttp :file:LICENSE file in wheels by adding vendor/llhttp/LICENSE to license-files in :file:setup.cfg -- by :user:threexc.

  Related issues and pull requests on GitHub:
  :issue:11226.

Contributor-facing changes

• Updated a regex in test_aiohttp_request_coroutine for Python 3.14.

  Related issues and pull requests on GitHub:
  :issue:11271.

---

v3.12.14

Compare Source

====================

Bug fixes

• Fixed file uploads failing with HTTP 422 errors when encountering 307/308 redirects, and 301/302 redirects for non-POST methods, by preserving the request body when appropriate per :rfc:9110#section-15.4.3-3.1 -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:11270.

• Fixed :py:meth:ClientSession.close() <aiohttp.ClientSession.close> hanging indefinitely when using HTTPS requests through HTTP proxies -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:11273.

• Bumped minimum version of aiosignal to 1.4+ to resolve typing issues -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:11280.

Features

• Added initial trailer parsing logic to Python HTTP parser -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:11269.

Improved documentation

• Clarified exceptions raised by WebSocketResponse.send_frame et al.
  -- by :user:DoctorJohn.

  Related issues and pull requests on GitHub:
  :issue:11234.

---

v3.12.13

Compare Source

====================

Bug fixes

• Fixed auto-created :py:class:~aiohttp.TCPConnector not using the session's event loop when :py:class:~aiohttp.ClientSession is created without an explicit connector -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:11147.

---

v3.12.12

Compare Source

====================

Bug fixes

• Fixed cookie unquoting to properly handle octal escape sequences in cookie values (e.g., \012 for newline) by vendoring the correct _unquote implementation from Python's http.cookies module -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:11173.

• Fixed Cookie header parsing to treat attribute names as regular cookies per :rfc:6265#section-5.4 -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:11178.

---

v3.12.11

Compare Source

====================

Features

• Improved SSL connection handling by changing the default ssl_shutdown_timeout
  from 0.1 to 0 seconds. SSL connections now use Python's default graceful
  shutdown during normal operation but are aborted immediately when the connector
  is closed, providing optimal behavior for both cases. Also added support for
  ssl_shutdown_timeout=0 on all Python versions. Previously, this value was
  rejected on Python 3.11+ and ignored on earlier versions. Non-zero values on
  Python < 3.11 now trigger a RuntimeWarning -- by :user:bdraco.

  The ssl_shutdown_timeout parameter is now deprecated and will be removed in
  aiohttp 4.0 as there is no clear use case for changing the default.

  Related issues and pull requests on GitHub:
  :issue:11148.

Deprecations (removal in next major release)

• Improved SSL connection handling by changing the default ssl_shutdown_timeout
  from 0.1 to 0 seconds. SSL connections now use Python's default graceful
  shutdown during normal operation but are aborted immediately when the connector
  is closed, providing optimal behavior for both cases. Also added support for
  ssl_shutdown_timeout=0 on all Python versions. Previously, this value was
  rejected on Python 3.11+ and ignored on earlier versions. Non-zero values on
  Python < 3.11 now trigger a RuntimeWarning -- by :user:bdraco.

  The ssl_shutdown_timeout parameter is now deprecated and will be removed in
  aiohttp 4.0 as there is no clear use case for changing the default.

  Related issues and pull requests on GitHub:
  :issue:11148.

---

v3.12.10

Compare Source

====================

Bug fixes

• Fixed leak of aiodns.DNSResolver when :py:class:~aiohttp.TCPConnector is closed and no resolver was passed when creating the connector -- by :user:Tasssadar.

  This was a regression introduced in version 3.12.0 (:pr:10897).

  Related issues and pull requests on GitHub:
  :issue:11150.

---

v3.12.9

Compare Source

===================

Bug fixes

• Fixed IOBasePayload and TextIOPayload reading entire files into memory when streaming large files -- by :user:bdraco.

  When using file-like objects with the aiohttp client, the entire file would be read into memory if the file size was provided in the Content-Length header. This could cause out-of-memory errors when uploading large files. The payload classes now correctly read data in chunks of READ_SIZE (64KB) regardless of the total content length.

  Related issues and pull requests on GitHub:
  :issue:11138.

---

v3.12.8

Compare Source

===================

Features

• Added preemptive digest authentication to :class:~aiohttp.DigestAuthMiddleware -- by :user:bdraco.

  The middleware now reuses authentication credentials for subsequent requests to the same
  protection space, improving efficiency by avoiding extra authentication round trips.
  This behavior matches how web browsers handle digest authentication and follows
  :rfc:7616#section-3.6.

  Preemptive authentication is enabled by default but can be disabled by passing
  preemptive=False to the middleware constructor.

  Related issues and pull requests on GitHub:
  :issue:11128, :issue:11129.

---

v3.12.7

Compare Source

===================

.. warning::

This release fixes an issue where the quote_cookie parameter was not being properly
respected for shared cookies (domain="", path=""). If your server does not handle quoted
cookies correctly, you may need to disable cookie quoting by setting quote_cookie=False
when creating your :class:~aiohttp.ClientSession or :class:~aiohttp.CookieJar.
See :ref:aiohttp-client-cookie-quoting-routine for details.

Bug fixes

• Fixed cookie parsing to be more lenient when handling cookies with special characters
  in names or values. Cookies with characters like {, }, and / in names are now
  accepted instead of causing a :exc:~http.cookies.CookieError and 500 errors. Additionally,
  cookies with mismatched quotes in values are now parsed correctly, and quoted cookie
  values are now handled consistently whether or not they include special attributes
  like Domain. Also fixed :class:~aiohttp.CookieJar to ensure shared cookies (domain="", path="")
  respect the quote_cookie parameter, making cookie quoting behavior consistent for
  all cookies -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:2683, :issue:5397, :issue:7993, :issue:11112.

• Fixed an issue where cookies with duplicate names but different domains or paths
  were lost when updating the cookie jar. The :class:~aiohttp.ClientSession
  cookie jar now correctly stores all cookies even if they have the same name but
  different domain or path, following the :rfc:6265#section-5.3 storage model -- by :user:bdraco.

  Note that :attr:ClientResponse.cookies <aiohttp.ClientResponse.cookies> returns
  a :class:~http.cookies.SimpleCookie which uses the cookie name as a key, so
  only the last cookie with each name is accessible via this interface. All cookies
  can be accessed via :meth:ClientResponse.headers.getall('Set-Cookie') <multidict.MultiDictProxy.getall> if needed.

  Related issues and pull requests on GitHub:
  :issue:4486, :issue:11105, :issue:11106.

Miscellaneous internal changes

• Avoided creating closed futures in ResponseHandler that will never be awaited -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:11107.

• Downgraded the logging level for connector close errors from ERROR to DEBUG, as these are expected behavior with TLS 1.3 connections -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:11114.

---

v3.12.6

Compare Source

===================

Bug fixes

• Fixed spurious "Future exception was never retrieved" warnings for connection lost errors when the connector is not closed -- by :user:bdraco.

  When connections are lost, the exception is now marked as retrieved since it is always propagated through other means, preventing unnecessary warnings in logs.

  Related issues and pull requests on GitHub:
  :issue:11100.

---

v3.12.4

Compare Source

===================

Bug fixes

• Fixed connector not waiting for connections to close before returning from :meth:~aiohttp.BaseConnector.close (partial backport of :pr:3733) -- by :user:atemate and :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:1925, :issue:11074.

---

v3.12.3

Compare Source

===================

Bug fixes

• Fixed memory leak in :py:meth:~aiohttp.CookieJar.filter_cookies that caused unbounded memory growth
  when making requests to different URL paths -- by :user:bdraco and :user:Cycloctane.

  Related issues and pull requests on GitHub:
  :issue:11052, :issue:11054.

---

v3.12.2

Compare Source

===================

Bug fixes

• Fixed Content-Length header not being set to 0 for non-GET requests with None body -- by :user:bdraco.

  Non-GET requests (POST, PUT, PATCH, DELETE) with None as the body now correctly set the Content-Length header to 0, matching the behavior of requests with empty bytes (b""). This regression was introduced in aiohttp 3.12.1.

  Related issues and pull requests on GitHub:
  :issue:11035.

---

v3.12.1

Compare Source

====================

Bug fixes

• Fixed :class:~aiohttp.DigestAuthMiddleware to preserve the algorithm case from the server's challenge in the authorization response. This improves compatibility with servers that perform case-sensitive algorithm matching (e.g., servers expecting algorithm=MD5-sess instead of algorithm=MD5-SESS)
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:11352.

Improved documentation

• Remove outdated contents of aiohttp-devtools and aiohttp-swagger
  from Web_advanced docs.
  -- by :user:Cycloctane

  Related issues and pull requests on GitHub:
  :issue:11347.

Packaging updates and notes for downstreams

• Started including the llhttp :file:LICENSE file in wheels by adding vendor/llhttp/LICENSE to license-files in :file:setup.cfg -- by :user:threexc.

  Related issues and pull requests on GitHub:
  :issue:11226.

Contributor-facing changes

• Updated a regex in test_aiohttp_request_coroutine for Python 3.14.

  Related issues and pull requests on GitHub:
  :issue:11271.

---

v3.12.0

Compare Source

===================

Bug fixes

• Fixed :py:attr:~aiohttp.web.WebSocketResponse.prepared property to correctly reflect the prepared state, especially during timeout scenarios -- by :user:bdraco

  Related issues and pull requests on GitHub:
  :issue:6009, :issue:10988.

• Response is now always True, instead of using MutableMapping behaviour (False when map is empty)

  Related issues and pull requests on GitHub:
  :issue:10119.

• Fixed connection reuse for file-like data payloads by ensuring buffer
  truncation respects content-length boundaries and preventing premature
  connection closure race -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:10325, :issue:10915, :issue:10941, :issue:10943.

• Fixed pytest plugin to not use deprecated :py:mod:asyncio policy APIs.

  Related issues and pull requests on GitHub:
  :issue:10851.

• Fixed :py:class:~aiohttp.resolver.AsyncResolver not using the loop argument in versions 3.x where it should still be supported -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:10951.

Features

• Added a comprehensive HTTP Digest Authentication client middleware (DigestAuthMiddleware)
  that implements RFC 7616. The middleware supports all standard hash algorithms
  (MD5, SHA, SHA-256, SHA-512) with session variants, handles both 'auth' and
  'auth-int' quality of protection options, and automatically manages the
  authentication flow by intercepting 401 responses and retrying with proper
  credentials -- by :user:feus4177, :user:TimMenninger, and :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:2213, :issue:10725.

• Added client middleware support -- by :user:bdraco and :user:Dreamsorcerer.

  This change allows users to add middleware to the client session and requests, enabling features like
  authentication, logging, and request/response modification without modifying the core
  request logic. Additionally, the session attribute was added to ClientRequest,
  allowing middleware to access the session for making additional requests.

  Related issues and pull requests on GitHub:
  :issue:9732, :issue:10902, :issue:10945, :issue:10952, :issue:10959, :issue:10968.

• Allow user setting zlib compression backend -- by :user:TimMenninger

  This change allows the user to call :func:aiohttp.set_zlib_backend() with the
  zlib compression module of their choice. Default behavior continues to use
  the builtin zlib library.

  Related issues and pull requests on GitHub:
  :issue:9798.

• Added support for overriding the base URL with an absolute one in client sessions
  -- by :user:vivodi.

  Related issues and pull requests on GitHub:
  :issue:10074.

• Added host parameter to aiohttp_server fixture -- by :user:christianwbrock.

  Related issues and pull requests on GitHub:
  :issue:10120.

• Detect blocking calls in coroutines using BlockBuster -- by :user:cbornet.

  Related issues and pull requests on GitHub:
  :issue:10433.

• Added socket_factory to :py:class:aiohttp.TCPConnector to allow specifying custom socket options
  -- by :user:TimMenninger.

  Related issues and pull requests on GitHub:
  :issue:10474, :issue:10520, :issue:10961, :issue:10962.

• Started building armv7l manylinux wheels -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:10797.

• Implemented shared DNS resolver management to fix excessive resolver object creation
  when using multiple client sessions. The new _DNSResolverManager singleton ensures
  only one DNSResolver object is created for default configurations, significantly
  reducing resource usage and improving performance for applications using multiple
  client sessions simultaneously -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:10847, :issue:10923, :issue:10946.

• Upgraded to LLHTTP 9.3.0 -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:10972.

• Optimized small HTTP requests/responses by coalescing headers and body into a single TCP packet -- by :user:bdraco.

  This change enhances network efficiency by reducing the number of packets sent for small HTTP payloads, improving latency and reducing overhead. Most importantly, this fixes compatibility with memory-constrained IoT devices that can only perform a single read operation and expect HTTP requests in one packet. The optimization uses zero-copy writelines when coalescing data and works with both regular and chunked transfer encoding.

  When aiohttp uses client middleware to communicate with an aiohttp server, connection reuse is more likely to occur since complete responses arrive in a single packet for small payloads.

  This aligns aiohttp with other popular HTTP clients that already coalesce small requests.

  Related issues and pull requests on GitHub:
  :issue:10991.

Improved documentation

• Improved documentation for middleware by adding warnings and examples about
  request body stream consumption. The documentation now clearly explains that
  request body streams can only be read once and provides best practices for
  sharing parsed request data between middleware and handlers -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:2914.

Packaging updates and notes for downstreams

• Removed non SPDX-license description from setup.cfg -- by :user:devanshu-ziphq.

  Related issues and pull requests on GitHub:
  :issue:10662.

• Added support for building against system llhttp library -- by :user:mgorny.

  This change adds support for :envvar:AIOHTTP_USE_SYSTEM_DEPS environment variable that
  can be used to build aiohttp against the system install of the llhttp library rather
  than the vendored one.

  Related issues and pull requests on GitHub:
  :issue:10759.

• aiodns is now installed on Windows with speedups extra -- by :user:bdraco.

  As of aiodns 3.3.0, SelectorEventLoop is no longer required when using pycares 4.7.0 or later.

  Related issues and pull requests on GitHub:
  :issue:10823.

• Fixed compatibility issue with Cython 3.1.1 -- by :user:bdraco

  Related issues and pull requests on GitHub:
  :issue:10877.

Contributor-facing changes

• Sped up tests by disabling blockbuster fixture for test_static_file_huge and test_static_file_huge_cancel tests -- by :user:dikos1337.

  Related issues and pull requests on GitHub:
  :issue:9705, :issue:10761.

• Updated tests to avoid using deprecated :py:mod:asyncio policy APIs and
  make it compatible with Python 3.14.

  Related issues and pull requests on GitHub:
  :issue:10851.

• Added Winloop to test suite to support in the future -- by :user:Vizonex.

  Related issues and pull requests on GitHub:
  :issue:10922.

Miscellaneous internal changes

• Added support for the partitioned attribute in the set_cookie method.

  Related issues and pull requests on GitHub:
  :issue:9870.

• Setting :attr:aiohttp.web.StreamResponse.last_modified to an unsupported type will now raise :exc:TypeError instead of silently failing -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:10146.

---

---

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Paris, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.