Skip to content

fix(deps): require aiohttp >=3.14.1 for VULN-88795 #123

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
shuningc wants to merge 11 commits into
base: main
Choose a base branch
from
Open

fix(deps): require aiohttp >=3.14.1 for VULN-88795 #123

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
4cbc1ee
fix(VULN-88795): require aiohttp >=3.14.1 and bump vcrpy for compat
shuningc Jul 30, 2026
e1192ee
fix(VULN-88795): export aiohttp floor via crewai and all extras
shuningc Aug 4, 2026
35bcca4
Merge branch 'main' into VULN-88795-aiohttp-upgrade
shuningc Aug 4, 2026
aaffd97
Merge branch 'main' into VULN-88795-aiohttp-upgrade
shuningc Aug 4, 2026
0987653
Update pyproject.toml
shuningc Aug 5, 2026
5eadb15
docs(example): raise startup-simulator Python floor to 3.10
shuningc Aug 5, 2026
b275c08
chore(deps): regenerate poetry.lock after aiohttp python constraint
shuningc Aug 5, 2026
9952eb0
docs(example): align startup-simulator Python floor with SDK 3.11+
shuningc Aug 5, 2026
f45541f
Align RAG example aiohttp pins with CVE floor (3.14.3).
shuningc Aug 5, 2026
f021511
Merge branch 'main' into VULN-88795-aiohttp-upgrade
shuningc Aug 5, 2026
475338a
Merge branch 'main' into VULN-88795-aiohttp-upgrade
shuningc Aug 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
215 changes: 124 additions & 91 deletions examples/agent/langgraph-fsi-agent/before/poetry.lock
View file
Open in desktop

Large diffs are not rendered by default.

8 changes: 4 additions & 4 deletions examples/agent/minimal-agent-example/requirements.txt
View file
Open in desktop
Comment thread
shuningc marked this conversation as resolved.
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,9 @@ rich>=13.7.0
questionary>=2.0.1
openai==1.61.1
pydantic==2.10.6
aiohappyeyeballs==2.4.6
aiohttp==3.11.12
aiosignal==1.3.2
aiohappyeyeballs==2.6.1
aiohttp==3.14.3
aiosignal==1.4.0
attrs==25.1.0
certifi==2025.1.31
frozenlist==1.5.0
Expand All @@ -15,6 +15,6 @@ propcache==0.2.1
python-dateutil==2.9.0.post0
six==1.17.0
typing_extensions==4.12.2
urllib3==2.6.3
urllib3==2.7.0
yarl==1.18.3
python-dotenv>=1.0.0
6 changes: 3 additions & 3 deletions examples/agent/startup-simulator-3000/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ run immediately!

Make sure you have:

- **Python 3.10+** installed on your system
- **Python 3.11+** installed on your system
- **Git** (optional, for cloning)
- **A code editor** (VS Code, PyCharm, etc.)

Expand Down Expand Up @@ -219,7 +219,7 @@ cat .env

1. **Check the logs**: Look at the terminal output for error messages
2. **Verify API keys**: Make sure all required API keys are set in `.env`
3. **Check Python version**: Ensure you're using Python 3.8+
3. **Check Python version**: Ensure you're using Python 3.11+
4. **Reinstall dependencies**: `pip install -r requirements.txt --force-reinstall`

## 🎓 Learning Resources
Expand Down Expand Up @@ -280,7 +280,7 @@ If you run into issues:
1. Check the troubleshooting section above
2. Look at the terminal logs for error messages
3. Verify your API keys are correct
4. Make sure you're using Python 3.10+
4. Make sure you're using Python 3.11+

---

Expand Down
4 changes: 2 additions & 2 deletions examples/agent/startup-simulator-3000/TUTORIAL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ This tutorial is designed for developers who want to learn how to build producti
First, make sure you have the prerequisites installed:

```bash
# Check Python version (should be 3.8+)
# Check Python version (should be 3.11+)
python --version

# Create and activate virtual environment
Expand Down Expand Up @@ -431,7 +431,7 @@ gunicorn -w 4 -b 0.0.0.0:2021 app:app

3. **Docker Deployment**
```dockerfile
FROM python:3.10-slim
FROM python:3.11-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install -r requirements.txt
Expand Down
7 changes: 3 additions & 4 deletions examples/agent/startup-simulator-3000/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
annotated-types==0.7.0
anyio==4.9.0
aiohttp==3.9.3
aiohttp==3.14.3
Comment thread
shuningc marked this conversation as resolved.
Comment thread
shuningc marked this conversation as resolved.
attrs==25.3.0
certifi==2025.4.26
charset-normalizer==3.4.2
Expand Down Expand Up @@ -47,11 +47,10 @@ tiktoken==0.9.0
tqdm==4.67.1
typing-extensions==4.14.0
typing-inspection==0.4.1
urllib3==2.6.3
urllib3==2.7.0
wrapt==1.17.2
xxhash==3.5.0
zstandard==0.23.0
rich
flask
flask-cors
aiohttp
flask-cors
2 changes: 1 addition & 1 deletion examples/agent/startup-simulator-3000/start.bat
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ echo ========================================
REM Check if Python is installed
python --version >nul 2>&1
if errorlevel 1 (
echo ❌ Python is not installed or not in PATH. Please install Python 3.8+ first.
echo ❌ Python is not installed or not in PATH. Please install Python 3.11+ first.
pause
exit /b 1
)
Expand Down
6 changes: 3 additions & 3 deletions examples/agent/startup-simulator-3000/start.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,16 +8,16 @@ echo "========================================"

# Check if Python is installed
if ! command -v python3 &> /dev/null; then
echo "❌ Python 3 is not installed. Please install Python 3.8+ first."
echo "❌ Python 3 is not installed. Please install Python 3.11+ first."
exit 1
fi

# Check Python version
python_version=$(python3 -c 'import sys; print(".".join(map(str, sys.version_info[:2])))')
required_version="3.8"
required_version="3.11"

if [ "$(printf '%s\n' "$required_version" "$python_version" | sort -V | head -n1)" != "$required_version" ]; then
echo "❌ Python version $python_version is too old. Please install Python 3.8+"
echo "❌ Python version $python_version is too old. Please install Python 3.11+"
exit 1
fi

Expand Down
4 changes: 2 additions & 2 deletions examples/agent/startup-simulator-3000/test_setup.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,8 @@ def test_python_version() -> bool:
"""Test if Python version is compatible"""
print("🐍 Testing Python version...")
py_version = sys.version_info
if py_version.major < 3 or (py_version.major == 3 and py_version.minor < 8):
print(f"❌ Python {py_version.major}.{py_version.minor} is too old. Need Python 3.8+")
if py_version.major < 3 or (py_version.major == 3 and py_version.minor < 11):
print(f"❌ Python {py_version.major}.{py_version.minor} is too old. Need Python 3.11+")
return False
print(f"✅ Python {py_version.major}.{py_version.minor}.{py_version.micro} is compatible")
return True
Expand Down
8 changes: 4 additions & 4 deletions examples/rag/cli-rag-demo/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,9 @@ rich>=13.7.0
questionary>=2.0.1
openai==1.61.1
pydantic==2.10.6
aiohappyeyeballs==2.4.6
aiohttp==3.11.12
aiosignal==1.3.2
aiohappyeyeballs==2.6.1
aiohttp==3.14.3

@fercor-cisco fercor-cisco Aug 7, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 minor (documentation): Asymmetric coverage with the sibling example: this PR raised the advertised Python floor for startup-simulator-3000 in five places (start.sh, start.bat, test_setup.py, README.md, TUTORIAL.md) because aiohttp==3.14.3 declares python-versions = ">=3.10" — but cli-rag-demo got the identical aiohttp and urllib3==2.7.0 bumps (both >=3.10) while examples/rag/cli-rag-demo/README.md:13 still says - Python 3.8+.

Same failure mode the startup-simulator fix was made to avoid: a quickstart that green-lights an interpreter on which pip install -r requirements.txt cannot resolve. As with that example, 3.8/3.9 were already partly broken here before this PR, so this widens a pre-existing doc inconsistency rather than introducing one — but it's within the scope this PR already took on, and it's a one-word change.

(minimal-agent-example got the same bumps and has no README, so no action needed there.)

🤖 Generated by the Astra agent

aiosignal==1.4.0
attrs==25.1.0
certifi==2025.1.31
frozenlist==1.5.0
Expand All @@ -17,7 +17,7 @@ propcache==0.2.1
python-dateutil==2.9.0.post0
six==1.17.0
typing_extensions==4.12.2
urllib3==2.6.3
urllib3==2.7.0
yarl==1.18.3
faiss-cpu>=1.7.4
sentence-transformers>=2.5.1
Expand Down
4 changes: 2 additions & 2 deletions examples/rag/elastic-chatbot-rag-app/requirements.txt
View file
Open in desktop

@fercor-cisco fercor-cisco Aug 7, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

examples/rag/elastic-chatbot-rag-app/requirements.txt:485-485 (line not in diff)

🟡 minor (other): This is now the only one of the four touched examples left on urllib3==2.6.3; minimal-agent-example, cli-rag-demo, and startup-simulator-3000 all moved to 2.7.0 in this PR, and the SDK's own poetry.lock:5565 locks 2.7.0. 2.6.3 does carry the VULN-88814 fix so there's no exposure here — it's an avoidable three-way inconsistency in a set of files the PR is already normalizing.

I understand from the description that a full pip-compile regeneration of this example is blocked by unrelated splunk-ao/OpenTelemetry resolution conflicts. Since the aiohttp/aiosignal/aiohappyeyeballs lines above were already edited by hand in that same situation, a one-line pin edit here is consistent with the approach already taken. Worth noting: this file is pip-compile-generated and Dockerfile:9 builds on python:3.12-slim, so 2.7.0's >=3.10 floor is satisfied.

Suggested change
urllib3==2.7.0

🤖 Generated by the Astra agent

Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,9 @@
#
aiohappyeyeballs==2.6.1
# via aiohttp
aiohttp==3.11.14
aiohttp==3.14.3
# via langchain-community
aiosignal==1.3.2
aiosignal==1.4.0
# via aiohttp
annotated-types==0.7.0
# via pydantic
Expand Down
Loading
Loading