chore: bump aiohttp from 3.13.4 to 3.14.0#108
Conversation
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedThe vulnerability exists in I verified that even the latest release ( Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerabilities reported by pip-audit, but cannot fix them automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedThe vulnerability affects A fix requires the upstream chromadb maintainers to release a new version. Once a patched release is published to PyPI, aieng-bot can re-run and apply the update automatically. Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Vulnerability Details
Why this cannot be auto-fixedpip-audit reports no fixed version for CVE-2026-45829. The advisory states the vulnerability affects "version 1.0.0 or later" — all currently published versions of chromadb (including the latest 1.5.9) appear to be affected according to the vulnerability database. A fix requires the upstream ChromaDB maintainers to release a patched version and update the advisory. Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved or explicitly approved for ignoring by a human reviewer. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedThe vulnerability exists in Vulnerability details: A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedThe vulnerability exists in The PyPI advisory database lists Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerabilities reported by pip-audit, but cannot fix them automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedThe vulnerability exists in Vulnerability detailsA pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Vulnerability DetailsCVE-2026-45829: A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and Why this cannot be auto-fixedpip-audit reports no fixed version for this CVE. The advisory covers all ChromaDB versions 1.0.0 and later (current latest on PyPI is 1.5.9, which is also affected). A fix requires the upstream ChromaDB maintainers to release a patched version. Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedThe vulnerability CVE-2026-45829 is a pre-authentication code injection vulnerability affecting ChromaDB version 1.0.0 and later. Even the latest release (1.5.9) is still listed as vulnerable ( Once a patched release is published to PyPI, aieng-bot can re-run and apply the update automatically. Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
42f341e to
1f04d75
Compare
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedCVE-2026-45829 is a pre-authentication code injection vulnerability in ChromaDB (versions 1.0.0+). It was verified to still be present in the latest release (1.5.9), meaning no patched version exists on PyPI yet. A fix requires the upstream ChromaDB maintainers to release a new version. Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
DetailsCVE-2026-45829: A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint. pip-audit reports no fix version for chromadb (current: 1.5.5, latest: 1.5.9 — all versions 1.0.0+ are affected). What was fixedThe pip PYSEC-2026-196 vulnerability (pip 26.1 → 26.1.2) was fixed in this run by adding Why chromadb cannot be auto-fixedThe vulnerability exists in Recommended next steps
This PR will not be auto-merged until the chromadb vulnerability is resolved. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedThe vulnerability exists in The latest chromadb release (1.5.9) is also affected — the Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Details
Why this cannot be auto-fixedThe vulnerability exists in Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedThe vulnerability is a pre-authentication code injection flaw in the ChromaDB Python project (versions 1.0.0 and later), where an unauthenticated attacker can run arbitrary code on the server by sending a malicious model repository with A fix requires the upstream ChromaDB maintainers to release a new version. The OSV advisory confirms all versions up to and including 1.5.9 (the latest on PyPI) are affected, with no Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
|
A newer version of aiohttp exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedThe vulnerability exists in CVE description: A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedCVE-2026-45829 is a pre-authentication code injection vulnerability in ChromaDB ≥1.0.0 that allows an unauthenticated attacker to run arbitrary code on the server. The vulnerability is present in all available chromadb versions (checked up to 1.5.9 — the latest on PyPI as of today). No patched release has been published to PyPI yet. A fix requires the upstream maintainers to release a new version. Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
|
Automated fix applied and PR merged The agentic fix loop successfully fixed this PR and merged it. ✓ Successfully fixed security failures - Modified 1 files - Executed 236 agent actions - (163 info, 32 tool_call, 4 error, 25 tool_result, 12 reasoning) View detailed trace on dashboard | Raw trace AI Engineering Maintenance Bot |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedThe vulnerability exists in Vulnerability details: A pre-authentication code injection vulnerability in ChromaDB version 1.0.0 or later allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository with Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
|
Automated fix applied and PR merged The agentic fix loop successfully fixed this PR and merged it. ✓ Successfully fixed security failures - Modified 0 files - Executed 100 agent actions - (64 info, 15 tool_call, 1 error, 12 tool_result, 8 reasoning) View detailed trace on dashboard | Raw trace AI Engineering Maintenance Bot |
--- updated-dependencies: - dependency-name: aiohttp dependency-version: 3.14.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
pip 26.1 was flagged by pip-audit for PYSEC-2026-196. Bumped to 26.1.2 which contains the fix for path sanitization in console_scripts/gui_scripts. Note: chromadb CVE-2026-45829 has no upstream fix available yet (all versions 1.0.0+ are affected). See PR comment for details. Co-authored-by: aieng-bot <aieng-bot@vectorinstitute.ai>
pypdf 6.10.2 was flagged by pip-audit for two vulnerabilities: - CVE-2026-48156: ReDoS via crafted PDF with large /Size values - CVE-2026-48155: Memory exhaustion via crafted PDF in layout mode Bumped constraint to >=6.12.0 (resolved to 6.13.2) which contains the fixes. Note: chromadb CVE-2026-45829 still has no upstream fix available. See PR comment for details. Co-authored-by: aieng-bot <aieng-bot@vectorinstitute.ai>
dac0c55 to
e119dcf
Compare
|
Automated fix applied and PR merged The agentic fix loop successfully fixed this PR and merged it. ✓ Successfully fixed security failures - Modified 0 files - Executed 75 agent actions - (35 info, 18 tool_call, 6 error, 11 tool_result, 5 reasoning) View detailed trace on dashboard | Raw trace AI Engineering Maintenance Bot |
- aiohttp>=3.14.1 (fixes CVE-2026-54273/54274/54275/54276/54277/54278/54279/54280) - cryptography>=48.0.1 (fixes GHSA-537c-gmf6-5ccf) - langsmith>=0.8.18 (fixes GHSA-f4xh-w4cj-qxq8) - pypdf>=6.13.3 (fixes GHSA-jm82-fx9c-mx94) - msgpack>=1.2.1 added (fixes GHSA-6v7p-g79w-8964) - pydantic-settings>=2.14.2 added (fixes GHSA-4xgf-cpjx-pc3j) Remaining unfixable: - chromadb CVE-2026-45829: no patch released upstream - langchain GHSA-gr75-jv2w-4656: fix requires langchain>=1.3.9 which conflicts with langchain-neo4j/langchain-graphrag dependency tree Co-authored-by: aieng-bot <aieng-bot@vectorinstitute.ai>
Security Vulnerabilities — Partial Fix Appliedaieng-bot fixed 6 of the 8 vulnerable packages. Two vulnerabilities cannot be auto-fixed:
Fixed in this commit
Why the remaining two cannot be auto-fixedchromadb CVE-2026-45829: A pre-authentication code injection vulnerability when langchain GHSA-gr75-jv2w-4656: The fix requires
This conflict makes Recommended next steps
This PR will not be auto-merged while these vulnerabilities remain unresolved. |
|
Automated fix applied and PR merged The agentic fix loop successfully fixed this PR and merged it. ✓ Successfully fixed security failures - Modified 1 files - Executed 754 agent actions - (604 info, 59 tool_call, 13 error, 47 tool_result, 30 reasoning, 1 action) View detailed trace on dashboard | Raw trace AI Engineering Maintenance Bot |
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.