fix(agentex): bump aiohttp 3.14.1 -> 3.14.3 (clears 3 CVEs, agentex server image)

[scale-prodsec]

Summary

Bumps aiohttp from 3.14.1 → 3.14.3 in the workspace lockfile that the agentex server image builds from (022465994601.dkr.ecr.us-west-2.amazonaws.com/golden/agentex).

Follow-up to #359, which bumped aiohttp 3.13.4 → 3.14.1. A subsequent Trivy rescan of the rebuilt image surfaced 3 new CVEs in the transitively-resolved aiohttp 3.14.1. aiohttp is a transitive dependency (pulled via agentex-sdk / litellm); the build definition agentex/Dockerfile installs from the root pyproject.toml + uv.lock via uv export --frozen --no-dev --package agentex-backend / uv sync --frozen.

Fix

Raised the existing aiohttp floor in [tool.uv] override-dependencies from >=3.14.1 to >=3.14.3 in pyproject.toml (mirroring the established CVE-floor pattern), then regenerated uv.lock with uv lock --upgrade-package aiohttp.

Package	Installed	Fixed
aiohttp	3.14.1	3.14.3

Clears 3 CVEs:

CVE	Severity	Fixed in
CVE-2026-59881	MEDIUM	3.14.2
CVE-2026-69243	MEDIUM	3.14.2
CVE-2026-69244	HIGH	3.14.3

3.14.2 is skipped as a target because it still carries CVE-2026-69244 (GHSA-cq5v-8q36-5273 / PYSEC-2026-3545); 3.14.3 is the lowest release clean of all three advisories.

Verification

• uv lock --upgrade-package aiohttp → Updated aiohttp v3.14.1 -> v3.14.3, 198 packages resolved (unchanged count — no transitive additions/removals).
• Lock diff limited to the aiohttp block (version + sdist/wheel hashes) plus the manifest override specifier; git diff --summary empty (no dep add/remove), git diff --check clean, lock revision = 3 preserved, all entries stay on the pypi.org/simple registry.
• uv export --frozen --no-dev --no-emit-project --package agentex-backend (the exact Dockerfile step) succeeds and pins aiohttp==3.14.3 (no 3.14.1 remaining).
• uv lock --check passes; aiohttp 3.14.3 imports cleanly under CPython 3.12.
• Minor bump within the 3.14.x line; parents declare aiohttp>=3.10.9,<4 so 3.14.3 is within range (transitive-pin safety holds).
• Branch merged up to main (conflict-free; only the aiohttp bump differs from main).

Downstream

After merge, the public submodule pointer in scaleapi/agentex should be advanced to include this commit so the server image rebuild picks up the fix (same as #359).

Linear

• Parent: GFDVR-21928
• Children cleared: GFDVR-21648 (CVE-2026-59881), GFDVR-21649 (CVE-2026-69243), GFDVR-21650 (CVE-2026-69244)

🤖 Generated with Claude Code

Greptile Summary

The PR raises the workspace-wide aiohttp security floor from 3.14.1 to 3.14.3 and regenerates the corresponding lockfile package artifacts.

• Updates the aiohttp override in pyproject.toml.
• Pins aiohttp 3.14.3 with refreshed distribution hashes in uv.lock.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
pyproject.toml	Raises the existing aiohttp override floor to 3.14.3 and documents the additional CVEs addressed.
uv.lock	Consistently updates the aiohttp override, resolved version, and distribution hashes without changing its dependency set.

_{Reviews (2): Last reviewed commit: "Merge remote-tracking branch 'origin/mai..." | Re-trigger Greptile}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​aiohttp@​3.14.1 ⏵ 3.14.3	+1	+19

View full report