fix(deps): vuln aiohttp (minor → 3.14.1) [tools/base]

[gh-worker-campaigns-3e9aa4]

Summary: Security update — 1 package upgraded (MINOR changes included)

Manifests changed:

• tools/base (pip)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
aiohttp	3.13.5	3.14.1	minor	Direct	7 MEDIUM, 5 LOW

---

Security Details

ℹ️ Other Vulnerabilities (12)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
aiohttp	GHSA-4fvr-rgm6-gqmc	MODERATE	aiohttp: HTTP/1 Pipelined Requests Queue Without Limit	3.13.5	3.14.1	-
aiohttp	GHSA-xcgm-r5h9-7989	MODERATE	aiohttp: Incomplete websocket frame payloads bypass memory limits	3.13.5	3.14.1	-
aiohttp	GHSA-63hw-fmq6-xxg2	MODERATE	aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines	3.13.5	3.14.1	-
aiohttp	GHSA-g3cq-j2xw-wf74	MODERATE	aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup	3.13.5	3.14.1	-
aiohttp	GHSA-jg22-mg44-37j8	MODERATE	AIOHTTP is Vulnerable to Deserialization of Untrusted Data	3.13.5	3.14.0	-
aiohttp	GHSA-hg6j-4rv6-33pg	MODERATE	AIOHTTP is vulnerable to cross-origin redirect with per-request cookies	3.13.5	3.14.0	-
aiohttp	GHSA-hpj7-wq8m-9hgp	MODERATE	aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges	3.13.5	3.14.1	-
aiohttp	GHSA-9x8q-7h8h-wcw9	LOW	aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect	3.13.5	3.14.1	-
aiohttp	PYSEC-2026-237	LOW	-	3.13.5	3.14.1	-
aiohttp	GHSA-4m7w-qmgq-4wj5	LOW	aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections	3.13.5	3.14.1	-
aiohttp	GHSA-2fqr-mr3j-6wp8	LOW	aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence	3.13.5	3.14.1	-
aiohttp	GHSA-m6qw-4cw2-hm4m	LOW	aiohttp: CRLF injection in multipart headers	3.13.5	3.14.0	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[dd-prapprover-prod-77c48c]

PRApprover will approve and merge this PR, FAQ, #dx-source-code-management

🛠️ PRApproval Status

• ✅ PR is eligible for auto-approval by rule dependency-management-version-updater - 2026-07-07T12:41:01Z
• ⬜ CI tests passed
• ⬜ Approved
• ⬜ Merge Started
• ⬜ Merged

➡️ Current phase: waiting for CI tests to complete...