Update dependency aiohttp to v3.14.4 - #21

v3.14.4

Compare Source

===================

Features

• Added :class:aiohttp.UploadTracker for observing a client request's upload progress -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13579.

• Switched application/x-www-form-urlencoded parsing in
  :meth:~aiohttp.web.BaseRequest.post to the faster :func:yarl.query_to_pairs
  parser and added the client_max_fields argument to
  :class:~aiohttp.web.Application (default 1000) to cap the number of form
  fields accepted by :meth:~aiohttp.web.BaseRequest.post. Forms with more
  than 1000 fields now receive a 413 response unless the cap is raised;
  0 disables it -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:13738.

• Added constants to aiohttp.hdrs for widely used headers: those that
  browsers send on every request (Sec-Fetch-*, Sec-CH-UA*,
  Sec-GPC, Upgrade-Insecure-Requests, Priority), W3C trace context
  (traceparent, tracestate, baggage), response security, reporting
  and caching headers, the remaining RFC 9110 and RFC 9530 fields,
  Content-ID and common de facto proxy and application headers, and
  grouped the constants by where the header is defined. The C parser returns
  these names as the shared :class:~multidict.istr constants instead of new
  :class:str objects, which made parsing a typical browser request about
  9% cheaper -- by :user:asvetlov.

  Related issues and pull requests on GitHub:
  :issue:13886.

Bug fixes

• Remove overlapping slots in RequestHandler,
  fix broken slots inheritance in :py:class:~aiohttp.web.StreamResponse.

  Related issues and pull requests on GitHub:
  :issue:6547.

• Fixed a segmentation fault in the C HTTP parser on Python 3.12 and newer when payload decompression raised an error while pending decompressed data was being drained, as seen with brotlicffi 1.2 -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:13203, :issue:13249.

• Rejected control characters in the request target in the pure-Python HTTP parser,
  matching the llhttp-backed parser, which already refuses them
  -- by :user:arshsmith1.

  Related issues and pull requests on GitHub:
  :issue:13212.

• Stripped the trailing whitespace from header values in the C HTTP parser,
  so that it matches the pure-Python parser and :rfc:9110#section-5.5
  -- by :user:LuShadowX.

  Related issues and pull requests on GitHub:
  :issue:13246.

• Fixed the WebSocket reader rejecting a compressed data frame with close code 1002 when a control frame arrived before the first data frame (regression in 3.14.2) -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13274.

• Fixed internally retried requests sending a truncated body when the request
  data was a file object.

  Related issues and pull requests on GitHub:
  :issue:13329, :issue:13330.

• Fixed event loop state possibly being corrupted on Python 3.12+ -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13346.

• Fixed the HTTP parser raising :exc:~aiohttp.ClientPayloadError when a fully received Content-Length body was pending completion -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13348.

• Bounded the per-read object overhead the WebSocket reader retains while reassembling a frame delivered across many small reads; the reads are joined once when the frame completes, and folded into a single buffer if they exceed a fragment cap, so a frame dribbled in tiny reads cannot pin unbounded per-read overhead -- by :user:Dreamsorcerer and :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:13352, :issue:13488.

• Fixed requests pipelined behind a request whose upgrade the handler declined
  going unanswered once there were more of them than the per-connection queue
  holds. With the pure-Python parser the same requests were also served more
  than once -- by :user:rodrigobnogueira.

  Related issues and pull requests on GitHub:
  :issue:13356.

• Reduced CPU consumption when encountering many concatenated members in a compressed payload and rejected large amounts of members -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13362.

• Fixed excessive memory consumption with small WebSocket messages -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13393.

• Fixed an integer overflow on too large messages -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13415.

• Switched multipart handling to use spooled temporary files to reduce number of file descriptors needed -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13426.

• Fixed a limit on message tail after an upgrade request -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13501.

• Fixed some edge case handling in multipart parts using base 64 encoding -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13509.

• Fixed Cython 3.3.0 failing to compile the WebSocket reader: dropped the
  Final[...] annotation from ALLOWED_CLOSE_CODES and the int
  annotation from the local start_pos in WebSocketReader._feed_data,
  both of which conflicted with declarations in reader_c.pxd under
  Cython 3.3.0 -- by :user:Georgefifth.

  Related issues and pull requests on GitHub:
  :issue:13520.

• Fixed the WebSocket reader accepting a new data frame injected between the
  fragments of an in-progress message; per :rfc:6455#section-5.4 every frame
  after the first fragment and before the FIN must be a continuation, and
  such a stream is now rejected as a protocol error -- by :user:arshsmith1.

  Related issues and pull requests on GitHub:
  :issue:13553.

• Fixed a connection being eligible for reuse after its request was cancelled
  or failed while waiting for a 100 Continue response or finalizing the
  body; the request headers were already sent, so reusing the connection
  corrupted the next request on it -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13579.

• Fixed BaseRequest.http_range not accepting case-insensitive range units -- by :user:Manny7717.

  Related issues and pull requests on GitHub:
  :issue:13580, :issue:13581.

• Fixed CookieJar.update_cookies() to copy user-passed mutable Morsel objects -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13637.

• Fixed unbounded memory growth on a client WebSocket connection. A frame
  protocol error detaches the reader but leaves the connection upgraded, so a
  peer could stream unlimited data into an internal buffer when the application
  never called :meth:~aiohttp.ClientWebSocketResponse.receive; that data is
  now discarded, since nothing can parse it. Data arriving before the reader is
  installed is bounded by read_bufsize, which now applies to this buffer as
  well as to :attr:~aiohttp.ClientResponse.content
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:13655, :issue:13743.

• Fixed pure-Python request parser not reading a body in a HEAD request -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13671.

• Fixed host-only cookie state being lost on expiration -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13674.

• Fixed a possible OverflowError on cookies and a connection not being closed properly -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13677.

• The first-request deadline now also closes connections whose first request body stalls, while a body that is still arriving extends the deadline instead of being interrupted -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13681.

• Fixed idle connections not being closed if no request was received -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13681.

• Fixed :meth:~aiohttp.web.Application.add_domain not routing a request to
  its domain application when the Host header carried a port and the
  domain was registered without one, or, for a wildcard domain, uppercase
  letters -- by :user:rodrigobnogueira.

  Related issues and pull requests on GitHub:
  :issue:13693.

• Added empty __slots__ to AbstractRouteDef so that RouteDef and
  StaticDef instances no longer carry an unused __dict__.

  Related issues and pull requests on GitHub:
  :issue:13716.

• Fixed BaseConnector(keepalive_timeout=None) crashing on the second request to the same host with TypeError: '<=' not supported between instances of 'float' and 'NoneType' -- by :user:ishan-1010.

  Related issues and pull requests on GitHub:
  :issue:13756, :issue:13757.

• Fixed a crash in :meth:~aiohttp.BodyPartReader.read_chunk on a body part
  with an explicit Content-Length: 0: the part fell through to the
  streaming read strategy, whose minimum chunk size assertion then failed for
  chunk sizes below the boundary length. Such parts now yield an immediate
  empty chunk, like any other part with a known length
  -- by :user:istoolsfox.

  Related issues and pull requests on GitHub:
  :issue:13758, :issue:13760.

• Fixed Set-Cookie parsing treating unrecognized attributes as additional
  cookies. Each Set-Cookie header now sets exactly one cookie and
  unrecognized attributes are ignored, per :rfc:6265#section-5.2, preventing
  a malicious server from creating an attacker-selected number of cookie
  objects (and correspondingly large outgoing Cookie headers) from a
  bounded amount of response data. DummyCookieJar, and CookieJar in
  safe mode for IP-address origins, no longer parse Set-Cookie headers at
  all -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13800.

• Fixed the web server trusting the scheme of an absolute-form request-target -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13821.

• Fixed CookieJar.filter_cookies() sending shared cookies (cookies without a Domain attribute) marked Secure over unencrypted connections -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13830.

• Fixed per-request cookies (the cookies argument of a request method) marked Secure not being sent to origins listed in CookieJar's treat_as_secure_origin -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13833.

• Fixed the connection to an HTTP proxy staying open until garbage collection, and being reported as Unclosed connection, when sending the CONNECT request for an HTTPS tunnel failed -- by :user:Garbsener.

  Related issues and pull requests on GitHub:
  :issue:13841.

• Resolved a redirect Location with the scheme of the current URL but
  without //, such as http:/path or http:path, against the
  current URL, as browsers do, instead of treating it as an absolute URL
  without a host
  -- by :user:asvetlov.

  Related issues and pull requests on GitHub:
  :issue:13855.

• Rejected absolute-form request targets without // or with an empty
  host, such as http:/example.com/ or http:///example.com/, before
  parsing them with yarl, which reads a host from them in its WHATWG mode;
  RFC 9110 requires a host for http and https. The invalid URL test
  data no longer uses http:///example.com, which such a yarl version
  parses as http://example.com/, as browsers do
  -- by :user:asvetlov.

  Related issues and pull requests on GitHub:
  :issue:13858.

• Fixed :py:meth:~aiohttp.StreamReader.readuntil not finding a multi-byte
  separator whose bytes arrived in different chunks, which made it return data
  past the separator -- by :user:andrewstellman.

  Related issues and pull requests on GitHub:
  :issue:13870.

• Fixed mixed-case Content-Encoding values (for example Gzip)
  being accepted by the parser but failing decompression, a regression
  from the CVE-2025-69224 hardening -- by :user:muhammad-a-dev.

  Related issues and pull requests on GitHub:
  :issue:13894.

• Added limits to client cookie parsing, :class:~aiohttp.CookieJar storage and
  generated Cookie headers, with Firefox-style eviction, and fixed a replaced cookie
  keeping the previous cookie's expiry when the new cookie has none
  -- by :user:iamibi and :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:13930.

• Improved performance in domain matching with Application.add_domain() -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13943.

Deprecations (removal in next major release)

• Deprecated ClientResponse.output_size and ClientResponse.upload_complete;
  use aiohttp.UploadTracker instead -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13579.

Removals and backward incompatible breaking changes

• The WebSocket receive queue now only holds a weak reference to the WebSocketReader while parsing is stalled; code constructing a reader directly and passing it to set_parser() must keep its own strong reference to it, or frames the reader stopped short of parsing are lost with it -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13393.

• Removed the internal writer proxy used for upload progress accounting.
  AbstractStreamWriter gained an optional on_body_write callback that
  write() / write_eof() implementations must invoke with each accepted
  body chunk's byte length; custom writer implementations that do not call it
  will report Payload.bytes_written as 0 -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13436.

• Increased minimum yarl version to 1.25.1 -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:13734.

• Changed Set-Cookie parsing to create exactly one cookie per field, as RFC 6265
  and browsers do. Later name=value pairs and unknown attributes no longer create
  extra cookies, a leading pair such as Path=/ or $Version=1 is the cookie itself,
  and legacy $Path and $Domain attributes are ignored -- by :user:iamibi.

  Related issues and pull requests on GitHub:
  :issue:13930.

Improved documentation

• Documented valid request URL forms when using :class:~aiohttp.UnixConnector, including base_url with an HTTP host -- by :user:muhammad-a-dev.

  Related issues and pull requests on GitHub:
  :issue:11324, :issue:13781.

• Corrected the documented signature of :meth:~aiohttp.StreamReader.read_nowait,
  whose n parameter defaults to -1 rather than the None that was
  previously documented -- by :user:LALITH0110.

  Related issues and pull requests on GitHub:
  :issue:13295.

• Added interlock-cb, an aiohttp client circuit breaker middleware, to the
  third-party libraries page -- by :user:bagowix.

  Related issues and pull requests on GitHub:
  :issue:13336.

• Documented that max_redirects=0 means no limit and that allow_redirects=False disables redirects -- by :user:monasco.

  Related issues and pull requests on GitHub:
  :issue:13658.

• Corrected the documented signature of :py:meth:~aiohttp.StreamReader.readuntil, which
  showed a str separator although the method takes bytes, and documented its
  keyword-only max_size argument -- by :user:hxperl.

  Related issues and pull requests on GitHub:
  :issue:13686.

• Replaced most of the sphinx.ext.extlinks-based roles in the documentation
  with :pypi:sphinx-issues, which ships the
  :issue:, :pr:, :commit: and :user: roles out of the box.
  Pull request references are now captioned #N instead of PR #N, and
  commit references as abbreviated, @-prefixed hashes
  -- by :user:aiolibsbot.

  Related issues and pull requests on GitHub:
  :issue:13752.

• Fixed the Content-ID example in the multipart docs, which used a
  constant missing from aiohttp.hdrs and a value that is not a valid
  message ID -- by :user:asvetlov.

  Related issues and pull requests on GitHub:
  :issue:13886.

Packaging updates and notes for downstreams

• Started publishing an additional pure-Python wheel alongside the existing
  per-platform binary wheels and the sdist -- by :user:webknjaz.

  This gives users on platforms without a working C compiler, or without a
  matching pre-built wheel, an installable fallback that does not require
  compilation.

  Related issues and pull requests on GitHub:
  :issue:7632, :issue:13388.

• Removed the aiohttp/_websocket/reader_c.py symlink from the source tree; the aiohttp._websocket.reader_c extension is now compiled directly from reader_py.py using cython --module-name, so distributions no longer include a reader_c.py file that showed up as an uncovered module in coverage reports -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:13457.

• Adopted :pep:639 license metadata -- the license is now declared as the
  SPDX expression Apache-2.0 AND MIT and license-files moved to the
  [project] table, which raises the build-time requirement to
  setuptools >= 77.0. Built distributions now carry
  License-Expression instead of the legacy License field
  -- by :user:aiolibsbot.

  Related issues and pull requests on GitHub:
  :issue:13891.

Contributor-facing changes

• The CI/CD is now in sync with the rest of the projects in terms of where
  the cibuildwheel workflow lives -- by :user:webknjaz.

  Related commits on GitHub:
  :commit:59c0123d.

• Moved the pytest configuration from :file:setup.cfg to a dedicated
  :file:pytest.ini that follows the layout shared with propcache and
  other aio-libs projects. Compared to the old configuration,
  minversion is raised from 3.8.2 to 8.4; pytest-xdist
  (--numprocesses=auto) and pytest-cov (--cov,
  --cov-context=test, --no-cov-on-fail) are enabled by default
  again, so pass --numprocesses=0 and/or --no-cov to opt out, as
  the :file:Makefile targets and CI jobs now do where needed;
  --doctest-modules, --strict-markers and
  faulthandler_timeout = 30 are enabled; -v is no longer added;
  empty parameter sets are marked xfail instead of skipped;
  --junitxml reports use xunit1 with captured output and
  call-only durations; and norecursedirs skips more directories,
  including :file:tests/isolated/
  -- by :user:aiolibsbot.

  Related issues and pull requests on GitHub:
  :issue:12620, :issue:12621.

• Added check that change fragment matches PR number -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12788.

• CI now builds the sdist (and a pure-Python wheel) once, in a new
  build-pure-python-dists job, and shares that build across test,
  autobahn, benchmark, build-wheels, test-mobile and the
  sdist-based half of linting, instead of every one of those jobs
  checking out the repository and running make cythonize on its own
  -- by :user:webknjaz.

  Linting is also now split into lint-from-git (the
  :file:requirements/runtime-deps.in sync check and docs spell-checking,
  which need real Git history) and lint-from-sdist (mypy,
  slotscheck, the changelog fragment check, and twine check, which
  build from the shared artifact instead), since an sdist tarball never
  contains :file:.git.

  Related issues and pull requests on GitHub:
  :issue:13363, :issue:13388.

• Synchronized the coverage.py configuration (:file:.coveragerc.toml and
  :file:.coveragerc-cython.toml) with the pattern already established in
  :external+yarl:doc:yarl <index>, :external+multidict:doc:multidict <index>, frozenlist and other sibling projects
  -- by :user:webknjaz.

  Both files now anchor package discovery through source_pkgs instead of
  relying on a same-named directory happening to exist relative to the
  working directory, and add a [paths] mapping so coverage recorded
  against an installed copy of aiohttp still combines correctly with
  coverage recorded from the Git checkout. CI now lets pytest-cov write
  coverage.xml directly via --cov-report=xml instead of a separate
  coverage xml step, and the Autobahn testsuite's subprocess-based
  coverage collection (which uses coverage run --append, incompatible
  with parallel mode) now opts out per-invocation via a
  COVERAGE_PARALLEL_MODE environment variable instead of trying to
  override it on the command line.

  Related issues and pull requests on GitHub:
  :issue:13422.

• Stopped the benchmark CI job from hanging in the CodSpeed runner's apt
  install by installing libc6-dbg up front with a bounded retry, and raised
  the job timeout from 15 to 30 minutes -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:13489.

• Added benchmarks for reading masked WebSocket messages and fixed the
  existing read benchmarks, which stopped measuring the parser after the
  eighth large frame due to the queue limit -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:13561.

• Removed stale filterwarnings ignores from the pytest configuration
  that are no longer triggered by aiohttp, the supported Python versions
  or the pinned test dependencies -- by :user:aiolibsbot.

  Related issues and pull requests on GitHub:
  :issue:13717.

• Dropped the leftover PIP_USER setting and the pip --user PATH
  prefix from the CI workflow; both became dead once the test jobs started
  provisioning Python via astral-sh/setup-uv
  -- by :user:aiolibsbot.

  Related issues and pull requests on GitHub:
  :issue:13718, :issue:13721.

• Changed the long host in the Host header tests to one that is not made
  only of digits, since yarl now parses such a host as an IP address in its
  default mode and rejects this one as out of range
  -- by :user:asvetlov.

  Related issues and pull requests on GitHub:
  :issue:13861.

• Fixed tools/gen.py dropping a header name from the generated C lookup
  when two names shared a prefix that differed only in letter case, such as
  Accept-CH and Accept-Charset, and made the generated code compile
  without warnings -- by :user:asvetlov.

  Related issues and pull requests on GitHub:
  :issue:13886.

Miscellaneous internal changes

• Avoided formatting an unused fallback Date header value when the response
  already has one -- by :user:marcus-campbell.

  Related issues and pull requests on GitHub:
  :issue:13299.

• Improved header parsing performance in the C HTTP parser by reusing the
  :class:~multidict.istr built for a header name missing from
  aiohttp.hdrs the next time the same name arrives, from a bounded
  cache of up to 512 names of at most 64 bytes -- by :user:asvetlov.

  Related issues and pull requests on GitHub:
  :issue:13887.

v3.14.3

Compare Source

===================

Bug fixes

• Fixed the client dropping only the first Authorization, Cookie and
  Proxy-Authorization header when a redirect crossed an origin -- by :user:arshsmith1.

  Related issues and pull requests on GitHub:
  :issue:13180.

• Fixed error message construction in the C HTTP parser -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:13222.

v3.14.2

Compare Source

===================

Bug fixes

• Fixed :py:attr:~aiohttp.web.StreamResponse.last_modified rounding a
  :class:datetime.datetime with a fractional second down.

  Related issues and pull requests on GitHub:
  :issue:5303.

• Fixed resolving localhost on Windows to fall back without AI_ADDRCONFIG
  when the first lookup fails, so localhost still works without an active
  network.

  Related issues and pull requests on GitHub:
  :issue:5357.

• Rejected multipart body parts whose Content-Length header is not a
  plain sequence of digits (e.g. +5, -1, 1_0), matching the
  strictness of the main request parser per :rfc:9110#section-8.6
  -- by :user:dxbjavid.

  Related issues and pull requests on GitHub:
  :issue:12794.

• Fixed GunicornWebWorker endlessly reloading when app fails during startup -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12879.

• Fixed some inconsistent case sensitivity on request methods -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12931.

• Fixed IndexError: string index out of range in parse_content_disposition
  when a header parameter has an empty value (e.g. filename=).
  -- by :user:JSap0914.

  Related issues and pull requests on GitHub:
  :issue:12948.

• Fixed the sock_read timeout being re-armed on a keep-alive connection after
  it had been returned to the pool. An idle pooled connection could be left with a
  pending read timeout that fired and poisoned it, so the next request reusing the
  connection failed immediately with :exc:aiohttp.SocketTimeoutError. The read
  timeout is now only rescheduled when resuming a transport that was actually
  paused -- by :user:daragok.

  Related issues and pull requests on GitHub:
  :issue:12953, :issue:12954.

• Fixed the client decompressing frames when permessage-deflate was not negotiated -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12976.

• Fixed DigestAuthMiddleware raising an IndexError on empty domain -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12983.

• Fixed :class:~aiohttp.DigestAuthMiddleware corrupting the Digest
  challenge when a WWW-Authenticate response offered more than one
  authentication scheme -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12984.

• Fixed client not closing cleanly after an exception -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12985.

• Fixed control frames breaking fragmented WebSocket messages -- by :user:arshsmith1.

  Related issues and pull requests on GitHub:
  :issue:12988.

• Fixed parse_content_disposition rejecting otherwise-valid
  Content-Disposition header values that contain optional whitespace (OWS)
  around the disposition type (e.g. "form-data ; name=\"field\"").
  The disposition type is now stripped before token validation, consistent with
  how parameter keys are already handled -- by :user:JSap0914.

  Related issues and pull requests on GitHub:
  :issue:12996.

• Fixed an :exc:IndexError in the pure-Python HTTP parser -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13001.

• Fixed parsing optional whitespace in Content-Disposition -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13002.

• Fixed request body not being read on rejected WebSocket upgrades -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13016.

• Fixed :exc:LookupError (and an unguarded :exc:UnicodeDecodeError) escaping
  Content-Disposition parsing when a multipart part supplies an extended
  parameter with an unknown charset
  -- by :user:arshsmith1.

  Related issues and pull requests on GitHub:
  :issue:13042.

• Fixed escape_quotes in the Digest authentication middleware not escaping
  backslashes, so a WWW-Authenticate challenge value containing a backslash
  could break out of its quoted-string in the generated Authorization header
  -- by :user:dxbjavid.

  Related issues and pull requests on GitHub:
  :issue:13054.

• Fixed Python parser not rejecting a bare LF in the request line -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13136.

• Fixed the C HTTP parser folding the fragment into the query string for an
  origin-form request target with an empty query (e.g. /path?#frag),
  which diverged from the pure-Python parser -- by :user:GiulioDER.

  Related issues and pull requests on GitHub:
  :issue:13171.

• Fixed the C parser reporting newer HTTP methods such as QUERY as <unknown>;
  the method table is now derived from the vendored llhttp instead of a hand-maintained count
  -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:13174.

Packaging updates and notes for downstreams

• Upgraded llhttp to v9.4.2 -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12956.

Contributor-facing changes

• Added admin documentation on incident response and on running reproducer code
  safely, covering security vulnerability handling and supply-chain, account, and
  CI/infrastructure compromise -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12914.

v3.14.1

Compare Source

===================

Bug fixes

• Fixed a race condition in :py:class:~aiohttp.TCPConnector where closing the connector while a DNS resolution was in-flight could raise :py:exc:AttributeError instead of :py:exc:~aiohttp.ClientConnectionError -- by :user:goingforstudying-ctrl.

  Related issues and pull requests on GitHub:
  :issue:12497.

• Fixed CancelledError not closing a connection -- by :user:aiolibsbot.

  Related issues and pull requests on GitHub:
  :issue:12795.

• Tightened up some websocket parser checks -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12817.

• Fixed :class:~aiohttp.CookieJar dropping the host-only flag of cookies when persisted with :meth:~aiohttp.CookieJar.save and reloaded with :meth:~aiohttp.CookieJar.load, so a cookie set without a Domain attribute is again scoped to the exact host that set it after a reload; the absolute expiration deadline is now persisted as well, so a reloaded cookie keeps its original lifetime instead of being rescheduled from the load time. :meth:~aiohttp.CookieJar.load now replaces the jar contents rather than merging onto prior state, and loaded cookies pass through the same acceptance rules as :meth:~aiohttp.CookieJar.update_cookies, so a cookie for an IP-address host is dropped when loaded into a jar created without unsafe=True -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:12824.

• Scoped :class:~aiohttp.DigestAuthMiddleware credentials to the origin of the first request it handles, so a redirect to a different origin no longer triggers a digest response computed from the configured credentials; a challenge from another origin is only answered when that origin falls within a protection space advertised by the anchor origin through the RFC 7616 domain directive -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:12825.

• Fixed the C HTTP parser not enforcing max_line_size on a request target or response reason phrase that is split across multiple reads; each fragment was checked on its own, so an accumulated line could exceed the limit without raising LineTooLong. The accumulated length is now checked, matching the pure-Python parser -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:12826.

• Changed :class:~aiohttp.TCPConnector to reject legacy non-canonical numeric IPv4 host forms such as 2130706433, 017700000001 and 127.1 with :exc:~aiohttp.InvalidUrlClientError; only canonical dotted-quad IPv4 literals are now treated as IP address literals, while every other host is sent through the configured resolver -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:12827.

• Fixed :meth:~aiohttp.StreamReader.readany and :meth:~aiohttp.StreamReader.read_nowait joining data fed back into the buffer during the call (when draining below the low water mark resumes reading) into a single unbounded :class:bytes; a call now returns only the chunks that were buffered when it started, keeping the drain of an unread auto-decompressed request body bounded by the read buffer -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:12828.

• Bounded the number of parsed-but-unhandled pipelined HTTP/1 requests buffered per connection on the server; once the queue reaches an internal limit the parser stops emitting and the transport is paused, resuming as the request handler drains the queue, so a client keeping one handler busy can no longer accumulate an unbounded backlog of pipelined requests -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:12830.

• Fixed :meth:aiohttp.web.Response.write_eof skipping Payload.close() when the body write was interrupted by an error or cancellation, for example when a client disconnects mid-response; the payload close hook now runs in a finally so a :class:~aiohttp.payload.Payload body always releases its resources -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:12831.

• Fixed the pure-Python HTTP parser not enforcing max_line_size on a chunk-size line when the whole line arrived in a single read; the limit was only applied to chunk-size metadata split across reads. The complete-line case is now checked too, matching the split-line behavior -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:12832.

• Included the per-request server_hostname override in the :class:~aiohttp.TCPConnector connection pool key, so a pooled TLS connection is no longer reused for a request that sets server_hostname to a different value -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:12835.

v3.14.0

Compare Source

===================

We have a new website! https://aio-libs.org
Subscribe to the news feed to find out more about what we're working on in future.

Features

• Added RequestKey and ResponseKey classes,
  which enable static type checking for request & response
  context storages in the same way that AppKey does for Application
  -- by :user:gsoldatov.

  Related issues and pull requests on GitHub:
  :issue:11766.

• Added :func:~aiohttp.encode_basic_auth for encoding HTTP Basic
  Authentication credentials. Replaces the now-deprecated
  aiohttp.BasicAuth -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12499.

• Started accepting :term:asynchronous context managers <asynchronous context manager> for cleanup contexts.
  Legacy single-yield :term:asynchronous generator cleanup contexts continue to be
  supported; async context managers are adapted internally so they are
  entered at startup and exited during cleanup.

  -- by :user:MannXo.

  Related issues and pull requests on GitHub:
  :issue:11681.

• Added :py:attr:~aiohttp.CookieJar.cookies and :py:attr:~aiohttp.CookieJar.host_only_cookies read-only properties to :py:class:~aiohttp.CookieJar exposing the stored cookies with their full attributes -- by :user:Br1an67.

  Related issues and pull requests on GitHub:
  :issue:3951.

• Added :py:attr:~aiohttp.web.TCPSite.port accessor for dynamic port allocations in :class:~aiohttp.web.TCPSite -- by :user:twhittock-disguise and :user:rodrigobnogueira.

  Related issues and pull requests on GitHub:
  :issue:10665.

• Added decode_text parameter to :meth:~aiohttp.ClientSession.ws_connect and :class:~aiohttp.web.WebSocketResponse to receive WebSocket TEXT messages as raw bytes instead of decoded strings, enabling direct use with high-performance JSON parsers like orjson -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:11763, :issue:11764.

• Large overhaul of parser/decompression code.

  The zip bomb security fix in 3.13 stopped highly compressed payloads
  from being decompressed, regardless of validity. Now aiohttp will
  decompress such payloads in chunks of 256+ KiB, allowing safe decompression
  of such payloads.

  -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:11966.

• Added explicit APIs for bytes-returning JSON serializer:
  JSONBytesEncoder type, JsonBytesPayload,
  :func:~aiohttp.web.json_bytes_response,
  :meth:~aiohttp.web.WebSocketResponse.send_json_bytes and
  :meth:~aiohttp.ClientWebSocketResponse.send_json_bytes methods, and
  json_serialize_bytes parameter for :class:~aiohttp.ClientSession
  -- by :user:kevinpark1217.

  Related issues and pull requests on GitHub:
  :issue:11989.

• Added ClientResponse.output_size and ClientResponse.upload_complete -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12452.

Bug fixes

• Fixed ZLibDecompressor silently dropping data past the first
  member when decompressing concatenated gzip/deflate streams. Each subsequent
  member is now handed to a fresh decompressor, matching the behaviour already
  implemented for ZSTD multi-frame streams.

  -- by :user:Ashutosh-177

  Related issues and pull requests on GitHub:
  :issue:7157.

• Improved the parser error message shown when TLS handshake bytes are received on an HTTP port -- by :user:puneetdixit200.

  Related issues and pull requests on GitHub:
  :issue:10142.

• Fixed the C parser failing to reject a response with a body when none was expected -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:10587.

• Fixed http parser not rejecting HTTP/1.1 requests that do not have valid Host header.
  -- by :user:Cycloctane.

  Related issues and pull requests on GitHub:
  :issue:10600.

• Fixed misleading TLS-in-TLS warning being emitted when sending HTTPS requests through an HTTP proxy. The warning now only fires when the proxy itself uses HTTPS, which is the only case where TLS-in-TLS actually applies -- by :user:wavebyrd.

  Related issues and pull requests on GitHub:
  :issue:10683.

• Fixed AssertionError when the transport is None during WebSocket
  preparation or file response sending (e.g. when a client disconnects
  immediately after connecting). A ConnectionResetError is now raised
  instead -- by :user:agners.

  Related issues and pull requests on GitHub:
  :issue:11761.

• Fixed ad-hoc cookies passed to individual requests not being sent when the session's cookie jar has unsafe=True and the target URL uses an IP address, by copying the unsafe setting from the session's cookie jar to the temporary cookie jar -- by :user:Krishnachaitanyakc.

  Related issues and pull requests on GitHub:
  :issue:12011.

• Reset the WebSocket heartbeat timer on inbound data to avoid false ping/pong timeouts while receiving large frames
  -- by :user:hoffmang9.

  Related issues and pull requests on GitHub:
  :issue:12030.

• Switched :py:meth:~aiohttp.CookieJar.save to use JSON format and
  :py:meth:~aiohttp.CookieJar.load to try JSON first with a fallback to
  a restricted pickle unpickler -- by :user:YuvalElbar6.

  Related issues and pull requests on GitHub:
  :issue:12091.

• Fixed redirects with consumed non-rewindable request bodies to raise
  :class:aiohttp.ClientPayloadError instead of silently sending an empty body.

  Related issues and pull requests on GitHub:
  :issue:12195.

• Fixed zstd decompression failing with ClientPayloadError when the server
  sends a response as multiple zstd frames -- by :user:josu-moreno.

  Related issues and pull requests on GitHub:
  :issue:12234.

• Fixed spurious Future exception was never retrieved warning on disconnect during back-pressure -- by :user:availov.

  Related issues and pull requests on GitHub:
  :issue:12281.

• Cookiejar.save() now uses 0x600 permissions to better protect them from being read by other users -- by :user:digiscrypt.

  Related issues and pull requests on GitHub:
  :issue:12312.

• Fixed a crash (:external+python:exc:~http.cookies.CookieError) in the cookie parser when receiving cookies
  containing ASCII control characters on CPython builds with the :cve:2026-3644
  patch. The parser now gracefully skips cookies whose value contains control
  characters instead of letting the exception propagate -- by :user:rodrigobnogueira.

  Related issues and pull requests on GitHub:
  :issue:12395.

• Fixed digest authentication failing for requests whose path or query string contains percent-encoded reserved characters; the digest signature now uses the encoded request-target that is sent on the wire instead of the decoded form -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:12436.

• Fixed :func:aiohttp.web.run_app losing inner traceback frames when an
  exception is raised during application startup (e.g. inside
  cleanup_ctx or on_startup). Regression since 3.10.6.

  Related issues and pull requests on GitHub:
  :issue:12493.

• Fixed per-request cookies not being dropped on cross-origin redirects -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12550.

• Fixed invalid bytes being allowed in multipart/payload headers -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12719.

• Fixed :py:meth:~aiohttp.FormData.add_field accepting invalid bytes in name and filename -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12721.

• Fixed websocket upgrade occurring when header contained a value like notupgrade -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12723.

Deprecations (removal in next major release)

• Deprecated aiohttp.BasicAuth and the auth / proxy_auth
  parameters. They will be removed in aiohttp 4.0. Use the new
  :func:~aiohttp.encode_basic_auth helper together with
  headers={"Authorization": ...} (or
  proxy_headers={"Proxy-Authorization": ...} for proxies) instead.
  Note that encode_basic_auth() defaults to utf-8, not latin1
  -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12499.

• Added deprecation warning to aiohttp.pytest_plugin, please switch to pytest-aiohttp -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:10785.

Removals and backward incompatible breaking changes

• Stopped calling :func:socket.getfqdn as the fallback for
  :attr:aiohttp.web.BaseRequest.host. :func:socket.getfqdn
  performs blocking reverse DNS resolution on the event loop
  thread and can stall a worker for many seconds when the system
  resolver is slow, and could be triggered remotely by an HTTP/1.0
  request that omits the Host header. The fallback when no
  Host header is present is now the local socket address the
  request arrived on (transport sockname), or an empty string
  if no transport information is available. Code that relied on
  the FQDN being returned must now read it from
  :func:socket.getfqdn directly, off the event loop
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:9308, :issue:12597.

• Dropped support for Python 3.9 -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:11601.

• Tightened outbound header serialization to reject all ASCII control
  characters forbidden by :rfc:9110#section-5.5 and :rfc:9112#section-4
  (0x00-0x08, 0x0A-0x1F, 0x7F) in status lines,
  header field-names, and field-values. Previously only CR, LF and NUL were
  rejected. HTAB (0x09) remains permitted in field values. Applications
  that placed bare control characters in outbound headers will now raise
  :exc:ValueError instead of emitting non-RFC-compliant bytes -- by :user:rodrigobnogueira.

  Related issues and pull requests on GitHub:
  :issue:12689.

Improved documentation

• Replaced the deprecated ujson library with orjson in the
  client quickstart documentation. ujson has been put into
  maintenance-only mode; orjson is the recommended alternative.
  -- by :user:indoor47

  Related issues and pull requests on GitHub:
  :issue:10795.

• Added the :doc:threat_model to the Sphinx documentation -- by :user:omkar-334.

  Related issues and pull requests on GitHub:
  :issue:12549.

• Removed archived and deprecated repositories from third party list -- by :user:Polandia94.

  Related issues and pull requests on GitHub:
  :issue:12726.

• Added aiointercept to list of third-party libraries -- by :user:Polandia94.

  Related issues and pull requests on GitHub:
  :issue:12727.

Packaging updates and notes for downstreams

• Added wheels for Android and iOS platforms -- by :user:timrid.

  Related issues and pull requests on GitHub:
  :issue:11750.

• Parallelized the Cython extension compilation by defaulting
  build_ext.parallel to os.cpu_count(), so each module's
  gcc invocation now runs concurrently instead of one at a time
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:12576.

• Submitted vendored llhttp to Github's SBOM -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12678.

• Updated llhttp to v9.4.1 -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12681.

Contributor-facing changes

• The coverage tool is now configured using the new native
  auto-discovered :file:.coveragerc.toml file
  -- by :user:webknjaz.

  It is also set up to use the ctrace core that works
  around the performance issues in the sysmon tracer
  which is default under Python 3.14.

  Related issues and pull requests on GitHub:
  :issue:11826.

• Fixed and reworked autobahn tests -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12173.

• Added a CI job to measure Cython coverage -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12349.

• Disabled coverage and xdist by default to ease local development -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12364.

• Avoid installation of backports.zstd on Python 3.14 in linting dependency set
  -- by :user:seifertm.

  Related issues and pull requests on GitHub:
  :issue:12406.

• Added --durations=30 to the benchmark CI run so the slowest tests are reported when the job hits its timeout -- by :user:aiolibsbot.

  Related issues and pull requests on GitHub:
  :issue:12562.

• Fixed two flakey test_middleware_uses_session_avoids_recursion_with_* tests
  that hard coded localhost in the inner middleware request; they now target
  the bound server URL so happy eyeballs cannot pick an unbound address on
  Windows runners -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:12571.

• Restricted the isal test dependency to CPython, since
  isal 1.8.0 stopped publishing PyPy wheels and the source
  build requires nasm, which is not available on the CI
  runners. The parametrize_zlib_backend fixture already
  calls pytest.importorskip, so PyPy continues to exercise
  the zlib and zlib_ng backends with no further
  changes -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:12589.

• Fixed a flakey test_tcp_connector_fingerprint_ok by aborting
  the SSL shutdown on the test's TCP connector before returning.
  The graceful TLS close was occasionally outliving the test event
  loop on one of the CI jobs, and the teardown gc.collect()
  then surfaced the still-open transport as a
  PytestUnraisableExceptionWarning -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:12592.

• Switched the cibuildwheel build frontend to build[uv] so
  that uv provisions every build-isolation virtual environment
  in the wheel matrix, replacing the per-ABI pip resolve with a
  roughly sub-second uv resolve
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:12595.

• Fixed flaky test_handler_returns_not_response and
  test_handler_returns_none by routing loop.set_debug(True)
  through a new loop_debug_mode fixture that disables debug
  mode before the aiohttp_client fixture finalizes. Leaving
  debug on through teardown let PyPy 3.11's asyncio slow-callback
  logger walk into Task.__repr__ during connector close,
  surfacing a spurious RuntimeWarning: coroutine was never awaited -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:12603.

• Reduced runtime of several of the slowest unit tests
  (decompress size-limit payloads from 64 MiB to 2 MiB,
  test_chunk_splits_after_pause chunk count from 50000
  to 20000, and test_set_cookies_max_age sleep from 2
  seconds to 1.1 seconds) without changing what they
  exercise -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:12606.

• Added a default 120-second per-test timeout via pytest-timeout so a
  hung test surfaces by name in CI output instead of getting hidden behind
  the job-level timeout added in :pr:12619. The autobahn and
  benchmark jobs opt out with --timeout=0 -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:12624.

• Switched the CI test and autobahn jobs from
  actions/setup-python to astral-sh/setup-uv for installing
  interpreters, cutting the Setup Python step from 40-58s to a
  few seconds on macos-latest and windows-latest runners for
  variants not in the hosted tool-cache (notably the free-threaded
  3.14t)
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:12629.

• Made the pip command used by the :file:Makefile configurable via a
  PIP variable; downstream consumers can now run, for example,
  make .develop PIP="uv pip" to install via uv without us
  maintaining a parallel target
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:12641.

• Allowed re-running the deploy job in .github/workflows/ci-cd.yml
  after a partial release failure: the Make Release step now skips
  when the GitHub Release already exists, and the PyPI publish step uses
  skip-existing so dists that were already uploaded on a prior
  attempt do not break the retry -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:12651.

• Switched the armv7l wheel builds onto GitHub's hosted ARM runners. The
  32-bit ARM build still runs under QEMU, but the host is now aarch64
  rather than x86_64, so the emulation overhead drops sharply
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:12655.

Miscellaneous internal changes

• Added win_arm64 to the wheels that gets pushed to PyPI
  -- by :user:AraHaan.

  Related issues and pull requests on GitHub:
  :issue:11937.

• Added cdef type declarations and inlined the upgrade check in the HTTP parser
  -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:12321.

• Changed zlib_executor_size default so compressed payloads are async by default -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12358.

• Added THREAT_MODEL.md detailing our security stance -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub:
  :issue:12512.

• Reduced payload sizes and request counts in the slowest client and URL
  dispatcher benchmarks so they no longer dominate CI runtime
  -- by :user:bdraco.

[!IMPORTANT]
✂ PR body was truncated to here.