Fix MEDIUM-severity vulnerabilities in runtime Python deps (aiohttp, cryptography, starlette, idna)

[yedidyakfir]

Summary

Dependabot has flagged several MEDIUM-severity vulnerabilities in runtime Python dependencies (resolved in uv.lock). These should be bundled into the same remediation pass as the HIGH-priority bumps.

Source: GitHub → Security → Dependabot alerts.

Affected packages

Package	Advisory	Fixed in	GHSA
aiohttp	~11 advisories: untrusted-data deserialization, Windows UNC SSRF/file-read, multipart header bypass, DoS variants	3.14.0	GHSA-jg22-mg44-37j8, GHSA-p998-jp59-783m, GHSA-m5qp-6w8w-w647, et al.
cryptography	Buffer overflow with non-contiguous buffers	46.0.7	GHSA-p423-j2cm-9vmq
starlette	Missing Host-header validation poisons request.url.path	1.0.1	GHSA-86qp-5c8j-p5mr
idna	idna.encode() bypass of CVE-2024-3651 fix	3.15	GHSA-65pc-fj4g-8rjx

Implementation Considerations

• Resolved in uv.lock; bump together:

  uv lock --upgrade-package aiohttp --upgrade-package cryptography --upgrade-package starlette --upgrade-package idna
  uv sync

• aiohttp 3.14 is a notable jump — watch for API/behavior changes in client/server usage.
• Run the full test suite before committing.

List tasks

• Bump aiohttp to ≥3.14.0
• Bump cryptography to ≥46.0.7
• Bump starlette to ≥1.0.1
• Bump idna to ≥3.15
• Run test suite and commit updated uv.lock
• Confirm alerts cleared in Dependabot

[github-actions]

Closed by #125.