[Mathis (echobt)]

Summary

Bumps aiohttp from 3.14.3 to 3.14.4 in uv.lock (lock only, nothing else changes).

Why

python-images on main (run 39325164614, merge commit cd5d4b5) fails at "Reject fixable high or critical vulnerabilities": Trivy reports 2 HIGH findings fixed in 3.14.4, CVE-2026-111064 (aiohttp server lacks an initial request/header timeout) and GHSA-2g87-pp6c-29x5 (unbounded memory/CPU use). The advisories were published after the previous green main (602ea02), so no image can be published until the lock moves. The Trivy gate is correct and is not touched.

What changed

• uv.lock — aiohttp 3.14.3 -> 3.14.4 (artifact URLs and hashes only; no other package changes).

How it was tested

uv run --frozen pytest -q        # 1240 passed
ruff check . / ruff format --check .   # clean
python scripts/check_repo.py     # Repository contracts passed
python -c "import aiohttp;print(aiohttp.__version__)"   # 3.14.4

The real proof is the python-images run on the merge commit (Trivy gate).

Risk and rollback

Patch-level bump of a transitive dependency. Rollback: revert the merge commit (the image would then fail the Trivy gate again).

Owner after merge

Forge (CTO Cortex Foundation).

Checklist

• One objective: unblock image publication
• No source, workflow or Dockerfile change
• Suite green, output above
• No secret

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 1

• uv.lock is excluded by !**/*.lock, !uv.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

• Configuration used: Repository: CortexLM/cortex/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 7ea9d574-d2d0-4506-a2db-007e9e896914

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}