chore(deps)(deps): bump aiohttp from 3.13.4 to 3.14.3 in /python/x402_a2a - #160
Open
dependabot[bot] wants to merge 1 commit into
Open
chore(deps)(deps): bump aiohttp from 3.13.4 to 3.14.3 in /python/x402_a2a#160dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [aiohttp](https://github.com/aio-libs/aiohttp) from 3.13.4 to 3.14.3. - [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst) - [Commits](aio-libs/aiohttp@v3.13.4...v3.14.3) --- updated-dependencies: - dependency-name: aiohttp dependency-version: 3.14.3 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
lingzhong
added a commit
to lingzhong/a2a-x402
that referenced
this pull request
Aug 11, 2026
The lint jobs invoke `uvx ruff` with no version constraint, so each run downloads whatever ruff is newest at that moment. Ruff 0.16 shipped between 2026-07-06 and 2026-07-24 and tightened several rules, so the lint job began failing on unchanged code: `main` at 125db55 reports 99 errors in python/x402_a2a and 20 in python/examples/adk-demo. This is visible on Dependabot's own PRs -- google-agentic-commerce#147 (2026-07-06) passed lint, while google-agentic-commerce#154 (2026-07-24) and google-agentic-commerce#160 (2026-08-04) both fail it. Pinning to 0.15.18 restores green CI without touching any source, and makes lint results reproducible over time. The ruff dev-dependency floor in both pyproject.toml files matches, so local and CI agree.
lingzhong
added a commit
to lingzhong/a2a-x402
that referenced
this pull request
Aug 11, 2026
Four of the bumps this PR consolidated were superseded while it sat open. Re-locked to the versions Dependabot now proposes, and picked up one new safe PR (google-agentic-commerce#131). python/x402_a2a: aiohttp 3.14.0 -> 3.14.3 (google-agentic-commerce#160, supersedes google-agentic-commerce#122) pyasn1 0.6.3 -> 0.6.4 (google-agentic-commerce#154, supersedes google-agentic-commerce#100) python-multipart 0.0.27 -> 0.0.31 (google-agentic-commerce#131, new) pytest 9.0.3 -> 9.1.0 (google-agentic-commerce#135, supersedes google-agentic-commerce#113) pytest-asyncio 1.3.0 -> 1.4.0 (google-agentic-commerce#135) ruff 0.15.13 -> 0.15.18 (google-agentic-commerce#135) python/examples/adk-demo: click 8.3.3 -> 8.4.1 (google-agentic-commerce#147, supersedes google-agentic-commerce#116) uvicorn 0.46.0 -> 0.49.0 (google-agentic-commerce#147) cdp-sdk 1.46.0 -> 1.47.1 (google-agentic-commerce#147) ruff 0.15.12 -> 0.15.18 (google-agentic-commerce#147) pytest-mock, trio and web3 were already at or above the new targets. The ruff floor is now 0.15.18 in both pyproject.toml files, resolving the inconsistency flagged in review (adk-demo had >=0.15.12 against x402_a2a's >=0.15.13) and matching the version pinned in CI. Majors remain excluded: starlette (google-agentic-commerce#133), x402 (google-agentic-commerce#117), a2a-sdk (google-agentic-commerce#114).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps aiohttp from 3.13.4 to 3.14.3.
Changelog
Sourced from aiohttp's changelog.
... (truncated)
Commits
5e392ceRelease v3.14.3 (#13225)49f65d5[PR #13222/f4866933 backport][3.14] Build C parser error message from bounded...240099e[PR #13180/ee53d655 backport][3.14] drop every copy of credential headers on ...d93f30aBump version (#13202)c1b9212Release v3.14.2 (#13201)380d4b5[PR #13054/ed8b040c backport][3.14] escape backslashes in digest auth quoted-...e1e1beeMake llhttp method array size dynamic (#13174) (#13196)aa4cf29[PR #13170/2b906869 backport][3.14] Fix StreamResponse.last_modified rounding...71b57b4[PR #13172/a57747ed backport][3.14] Fix C parser folding fragment into query_...64a03fb[PR #13169/1adc0cd7 backport][3.14] Upgrade http:// to https:// in README.rst...You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.