Skip to content

Python: Bump aiohttp from 3.13.3 to 3.14.1 in /python#14053

Closed
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/uv/python/aiohttp-3.14.0
Closed

Python: Bump aiohttp from 3.13.3 to 3.14.1 in /python#14053
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/uv/python/aiohttp-3.14.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Motivation and Context

Dependabot security alerts now require aiohttp >= 3.14.1, so the previous bump to 3.14.0 is no longer sufficient.

Description

  • Updated the Python lockfile to resolve aiohttp at 3.14.1 (instead of 3.14.0).
  • Regenerated python/uv.lock accordingly.
  • No source code functionality changes were introduced.

Contribution Checklist

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot
Bump aiohttp from 3.13.3 to 3.14.0 in /python
6766881 
---
updated-dependencies:
- dependency-name: aiohttp
  dependency-version: 3.14.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file. Used by Dependabot. python:uv Pull requests that update python:uv code labels Jun 3, 2026
Copilot AI review requested due to automatic review settings June 3, 2026 23:20
@dependabot
dependabot Bot requested a review from a team as a code owner June 3, 2026 23:20
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file. Used by Dependabot. python:uv Pull requests that update python:uv code labels Jun 3, 2026
Copilot AI reviewed Jun 3, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@dependabot dependabot Bot mentioned this pull request Jun 3, 2026
Closed
@moonbox3 moonbox3 added the python Pull requests for the Python Semantic Kernel label Jun 3, 2026
@github-actions github-actions Bot changed the title Bump aiohttp from 3.13.3 to 3.14.0 in /python Python: Bump aiohttp from 3.13.3 to 3.14.0 in /python Jun 3, 2026
github-actions[bot]
github-actions Bot reviewed Jun 3, 2026
View reviewed changes

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automated Code Review

Reviewers: 4 | Confidence: 61% | Result: All clear

Reviewed: Correctness, Security Reliability, Test Coverage, Design Approach

Automated review by dependabot[bot]'s agents

@moonbox3

moonbox3 commented Jun 17, 2026

Copy link
Copy Markdown
Collaborator

@copilot: update this PR to bump aiohttp to 3.14.1 instead of 3.14.0 and regenerate python/uv.lock. Current Dependabot alerts require aiohttp>=3.14.1.

Copilot AI commented Jun 17, 2026

Copy link
Copy Markdown
Contributor

@copilot: update this PR to bump aiohttp to 3.14.1 instead of 3.14.0 and regenerate python/uv.lock. Current Dependabot alerts require aiohttp>=3.14.1.

Updated in commit ac385eb. python/uv.lock now resolves aiohttp to 3.14.1 and was regenerated accordingly.

Copilot AI changed the title Python: Bump aiohttp from 3.13.3 to 3.14.0 in /python Python: Bump aiohttp from 3.13.3 to 3.14.1 in /python Jun 17, 2026
Copilot AI requested a review from moonbox3 June 17, 2026 06:06
@dependabot @github

dependabot Bot commented on behalf of github Jun 17, 2026

Copy link
Copy Markdown
Contributor Author

A newer version of aiohttp exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

@moonbox3
moonbox3 requested a review from eavanvalkenburg June 17, 2026 11:49
@moonbox3
moonbox3 enabled auto-merge June 17, 2026 11:49
@eavanvalkenburg

eavanvalkenburg commented Jun 17, 2026

Copy link
Copy Markdown
Member

@dependabot /recreate

@rogerbarreto

rogerbarreto commented Jul 22, 2026

Copy link
Copy Markdown
Member

@copilot this Dependabot pull request has failing CI checks. Please investigate the failures and fix what may be wrong. When applicable, this can include bumping other related dependencies to compatible versions and resolving breaking changes introduced by this update. Please push the fixes to this pull request branch so the checks can pass.

Copilot AI commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

@copilot this Dependabot pull request has failing CI checks. Please investigate the failures and fix what may be wrong. When applicable, this can include bumping other related dependencies to compatib...

Fixed in commit cb71170. I investigated the failing CI run and addressed the failing Python unit test path by explicitly marking the two pandas async tests with @pytest.mark.asyncio, which stabilizes event loop setup in the failing matrix jobs.

Copilot AI requested a review from rogerbarreto July 22, 2026 13:16
@moonbox3 moonbox3 mentioned this pull request Jul 23, 2026
Merged
4 tasks
pull Bot pushed a commit to AmirulAndalib/semantic-kernel that referenced this pull request Jul 23, 2026
@moonbox3 @dependabot
Consolidate Dependabot dependency updates (microsoft#14176)
d003eb2 
### Motivation and Context

Semantic Kernel currently has 43 open Dependabot pull requests spanning
GitHub Actions, .NET, Python, npm, and Yarn dependency graphs. This
rollup applies their compatible net changes together on the latest
`main`, making it possible to validate and merge the updates as one
coherent dependency state.

Supersedes:

- microsoft#13133
- microsoft#13134
- microsoft#13136
- microsoft#13172
- microsoft#13507
- microsoft#13601
- microsoft#13606
- microsoft#13666
- microsoft#13673
- microsoft#13688
- microsoft#13700
- microsoft#13707
- microsoft#13708
- microsoft#13712
- microsoft#13721
- microsoft#13873
- microsoft#13930
- microsoft#13939
- microsoft#13949
- microsoft#13950
- microsoft#13951
- microsoft#13997
- microsoft#14000
- microsoft#14053
- microsoft#14069
- microsoft#14088
- microsoft#14091
- microsoft#14094
- microsoft#14103
- microsoft#14106
- microsoft#14107
- microsoft#14108
- microsoft#14109
- microsoft#14110
- microsoft#14128
- microsoft#14148
- microsoft#14149
- microsoft#14160
- microsoft#14161
- microsoft#14164
- microsoft#14171
- microsoft#14172
- microsoft#14173

### Description

- Updates the requested GitHub Actions and preserves the PR-file-scoped
typos workflow fix.
- Consolidates the .NET Aspire, AWS SDK, ReportGenerator, JavaScript,
and SQLite security updates.
- Regenerates the npm, Yarn, and uv lockfiles from the combined
manifests instead of resolving generated-file conflicts by selection.
- Rolls overlapping updates forward to one compatible result: pyasn1
0.6.4 supersedes 0.6.3; pyOpenSSL 26.2.0 remains compatible with
cryptography 48.0.1; and Vite 8/Rolldown makes the older Rollup-only
overrides obsolete.
- Retains updates already present on current `main` without
reintroducing stale pins, including Aspire Hosting Azure Search 13.3.0
and Prompty.Core 2.0.0-beta.3.

The full .NET solution builds in Debug with zero warnings and errors.
Focused validation passed 82 .NET tests (3 skipped), 1,096 Python tests,
both frontend production builds, and uv lock consistency checks for the
main Python project and OAuth sample.

### Contribution Checklist

- [x] The code builds clean without any errors or warnings
- [ ] The PR follows the [SK Contribution
Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md)
and the [pre-submission formatting
script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts)
raises no violations
- [ ] All unit tests pass, and I have added new tests where possible
- [x] I didn't break anyone 😄

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
@moonbox3

moonbox3 commented Jul 23, 2026

Copy link
Copy Markdown
Collaborator

Superseded by #14176

@moonbox3 moonbox3 closed this Jul 23, 2026
auto-merge was automatically disabled July 23, 2026 09:30

Pull request was closed

@dependabot @github

dependabot Bot commented on behalf of github Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/uv/python/aiohttp-3.14.0 branch July 23, 2026 09:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] left review comments
Copilot code review Copilot Copilot left review comments
@eavanvalkenburg eavanvalkenburg eavanvalkenburg approved these changes
@moonbox3 moonbox3 moonbox3 approved these changes
@rogerbarreto rogerbarreto Awaiting requested review from rogerbarreto

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file. Used by Dependabot. python:uv Pull requests that update python:uv code python Pull requests for the Python Semantic Kernel

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@moonbox3 @eavanvalkenburg @rogerbarreto