LCORE-1187: bump-up AIOHTTP library for Konflux build #1056
Conversation
WalkthroughChanges involve upgrading aiohttp from 3.13.2 to 3.13.3 across multiple dependency manifests, adding python-multipart==0.0.22 to source hashes, removing python-multipart==0.0.21 from wheel hashes, and applying whitespace normalization to Tekton pipeline configuration files. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI agents
In `@requirements.hashes.source.txt`:
- Around line 405-407: The requirements pin for python-multipart references a
non-existent version "python-multipart==0.0.22"; update the requirement entry to
a valid released version (e.g., "python-multipart==0.0.21") and replace the
accompanying --hash values with the correct hashes for that version, or if
0.0.22 is intentionally planned, add a comment and hold the change until it is
published; locate the package line containing "python-multipart==0.0.22" to make
this edit and ensure the two --hash=sha256:... entries are updated to match the
chosen version.
In `@requirements.overrides.txt`:
- Line 6: The requirements override adds aiohttp==3.13.3 which requires
Brotli/brotlicffi >=1.2; update requirements.overrides.txt to pin the Brotli
implementation your project uses (e.g., add brotlicffi>=1.2 or Brotli>=1.2, or a
specific patch pin like brotlicffi==1.2.*) so the minimum version constraint is
satisfied; check whether your code or dependencies import brotlicffi vs Brotli
and choose the matching package name (brotlicffi or Brotli), add the line next
to aiohttp, and regenerate/update your dependency lock/CI artifacts to ensure
the new constraint is applied.
| python-multipart==0.0.22 \ | ||
| --hash=sha256:2b2cd894c83d21bf49d702499531c7bafd057d730c201782048f7945d82de155 \ | ||
| --hash=sha256:7340bef99a7e0032613f56dc36027b959fd3b30a787ed62d310e951f7c3a3a58 |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
python-multipart 0.0.22 release notes changelog
💡 Result:
python-multipart 0.0.22 was released on Jan 25, 2026 (PyPI “Latest version”). [1]
The upstream changelog is intended to be in the repo at tag refs/tags/0.0.22 (file CHANGELOG.md). [1][2]
However, I couldn’t retrieve the contents of CHANGELOG.md for 0.0.22 via the available web sources/tools (GitHub returned a load error), so I can’t reliably list the actual 0.0.22 changes here. [2]
Sources: [1] [2]
🌐 Web query:
python-multipart 0.0.21 0.0.22 wheel hash PyPI
💡 Result:
- python-multipart 0.0.21 wheel (python_multipart-0.0.21-py3-none-any.whl) SHA256:
cf7a6713e01c87aa35387f4774e812c4361150938d20d232800f75ffcf266090[1] - python-multipart 0.0.22 wheel hash: No 0.0.22 release/files are currently listed for
python-multiparton PyPI (latest shown is 0.0.21, uploaded Dec 17, 2025). [1]
Sources: [1] PyPI project page for python-multipart (includes file details + hashes).
🌐 Web query:
site:pypi.org python-multipart latest version 0.0.22
💡 Result:
The latest released version of python-multipart on PyPI is 0.0.21 (uploaded Dec 17, 2025). There is no 0.0.22 release shown in the PyPI release history. [1][2]
Fix python-multipart version: 0.0.22 does not exist on PyPI.
Version 0.0.22 is not available on PyPI; the latest released version is 0.0.21 (Dec 17, 2025). This pin will cause installation to fail. Either update to 0.0.21 or confirm whether 0.0.22 is a planned/unreleased version.
🤖 Prompt for AI Agents
In `@requirements.hashes.source.txt` around lines 405 - 407, The requirements pin
for python-multipart references a non-existent version
"python-multipart==0.0.22"; update the requirement entry to a valid released
version (e.g., "python-multipart==0.0.21") and replace the accompanying --hash
values with the correct hashes for that version, or if 0.0.22 is intentionally
planned, add a comment and hold the change until it is published; locate the
package line containing "python-multipart==0.0.22" to make this edit and ensure
the two --hash=sha256:... entries are updated to match the chosen version.
| tokenizers==0.22.1 | ||
| scipy==1.16.3 | ||
| aiohttp==3.13.2 | ||
| aiohttp==3.13.3 |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
aiohttp 3.13.3 release notes CVE security fixes
💡 Result:
aiohttp 3.13.3 was released on 2026-01-03 and the upstream changelog states it “contains fixes for several vulnerabilities” and recommends upgrading ASAP. It also raises the minimum Brotli/brotlicffi version to 1.2 and sets a default 32 MiB maximum output per decompress call (security-hardening against decompression bombs). [1]
Security issues (CVE) fixed in 3.13.3:
- CVE-2025-69223: “zip bomb” / memory-exhaustion DoS via compressed request bodies; fixed in 3.13.3. [2]
- CVE-2025-69227: DoS via an infinite loop when Python assertions are stripped (e.g.,
-O) duringRequest.post()processing; fixed in 3.13.3. [3] - CVE-2025-69229: DoS risk via excessive blocking CPU when handling chunked messages with many chunks (notably when using
request.read()); fixed in 3.13.3. [4] - CVE-2025-69230: DoS-style impact via cookie parsing warning log storms when
cookiesis accessed; fixed in 3.13.3. [5]
Sources: aiohttp changelog + CVE records. [1–5]
References:
[1] (docs.aiohttp.org)
[2] (ubuntu.com)
[3] (nvd.nist.gov)
[4] (nvd.nist.gov)
[5] (nvd.nist.gov)
Citations:
- 1: https://docs.aiohttp.org/en/stable/changes.html?utm_source=openai
- 2: https://ubuntu.com/security/CVE-2025-69223?utm_source=openai
- 3: https://nvd.nist.gov/vuln/detail/CVE-2025-69227?utm_source=openai
- 4: https://nvd.nist.gov/vuln/detail/CVE-2025-69229?utm_source=openai
- 5: https://nvd.nist.gov/vuln/detail/CVE-2025-69230?utm_source=openai
Verify Brotli/brotlicffi version requirement is also updated.
aiohttp 3.13.3 (released 2026-01-03) is confirmed as a security release fixing four CVEs (CVE-2025-69223, CVE-2025-69227, CVE-2025-69229, CVE-2025-69230) and upstream recommends upgrading ASAP. However, this release also raises the minimum Brotli/brotlicffi version to 1.2 as a security hardening measure against decompression bombs. Confirm whether Brotli or brotlicffi should also be pinned in requirements.overrides.txt to match this constraint.
🤖 Prompt for AI Agents
In `@requirements.overrides.txt` at line 6, The requirements override adds
aiohttp==3.13.3 which requires Brotli/brotlicffi >=1.2; update
requirements.overrides.txt to pin the Brotli implementation your project uses
(e.g., add brotlicffi>=1.2 or Brotli>=1.2, or a specific patch pin like
brotlicffi==1.2.*) so the minimum version constraint is satisfied; check whether
your code or dependencies import brotlicffi vs Brotli and choose the matching
package name (brotlicffi or Brotli), add the line next to aiohttp, and
regenerate/update your dependency lock/CI artifacts to ensure the new constraint
is applied.
1 participant
Description
LCORE-1187: bump-up AIOHTTP library for Konflux build
Type of change
Tools used to create PR
Related Tickets & Documents
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.