chole(deps): bump aiohttp to 3.14.3

[borgesius]

Clears alerts #63, #64 and #65 — the same aiohttp advisory trio patched in backend#6437, which surfaced here too.

Advisory	Severity
Out-of-bounds heap read in the C HTTP response parser error path (malformed chunked response)	high
WebSocket client accepts compressed frames without negotiated permessage-deflate	moderate
HTTP request smuggling via WebSocket upgrade	moderate

3.14.3 is the first release patching all three.

Scope

runner/pyproject.toml already permits it (aiohttp>=3.14.1), so only runner/uv.lock moves — 3.14.1 → 3.14.3, resolved as a single-package upgrade with nothing else shifting.

The runner declares aiohttp directly but does not import it anywhere in its own source; it is reached through provider SDKs acting as HTTP clients, which is the direction the response-parser advisory applies to.

Verification

• uv lock --upgrade-package aiohttp → 3.14.3, single package changed
• uv sync + import aiohttp confirms 3.14.3 installed
• Full runner suite: 1247 passed, 2 skipped (the 2 skips are pre-existing — optional google-stt / google-tts extras not installed)

Not in this PR

benchmarks also has near-deadline npm alerts in a different manifest — #48 sharp (→0.35.0, ~17 days) and #58 postcss (→8.5.18, ~19 days), plus #38 dompurify. Those are a separate lockfile and a separate change.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
benchmarks	Ready	Preview	Aug 5, 2026 1:36am

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• runner/uv.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: af2c46dd-df27-41ec-ba67-2d941c952dc9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[callumreid]

Approving. Lockfile-only aiohttp 3.14.1 → 3.14.3, matching backend#6437 so the two repos stay on the same version of a security-relevant dependency rather than drifting.

Single file, hashes and wheel URLs regenerated by the resolver rather than hand-edited, green.