fix(deps): patch aiohttp security vulnerability

[semyonfox]

Goal

Patch the direct runtime aiohttp dependency to remediate Dependabot alert #80.

• Lane: security
• Source: Dependabot alert #80 — high severity; direct pip/aiohttp, vulnerable through 3.14.2, patched in 3.14.3
• Kanban task: v4-semyonfox-irish-rail-nabber-dependabot-alert-80
• Base: main

Change

• requirements.txt: aiohttp==3.14.1 → aiohttp==3.14.3

Risk

Low-scoped patch-level dependency update. The daemon uses stable ClientSession, ClientTimeout, GET, status, and text-response APIs. The project runtime is Python 3.14; the updated dependency supports it.

Verification

• git diff --check origin/main...HEAD — passed
• Exact-pin assertion — passed (aiohttp==3.14.3)
• python3 -m pip install --dry-run -r requirements.txt — passed; resolved aiohttp 3.14.3
• Repository pre-push Docker image build — passed
• Fresh independent Claude Opus review — PASS_OPEN_PR

Limitations

No automated test suite covers this dependency-only change. Jenkins builds main after merge rather than the PR branch, so observe that post-merge build/container liveness check before treating deployment verification as complete.

Status: awaiting maintainer review/merge.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ad0784bd-1a7a-4e18-a88b-0e19ad0dca81

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}