Aiohttp

Latest version: v3.11.14

Safety actively analyzes 722032 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 4 of 33

3.10.8

Not secure
===================

Bug fixes
---------

- Fixed cancellation leaking upwards on timeout -- by :user:`bdraco`.


*Related issues and pull requests on GitHub:*
:issue:`9326`.




----

3.10.7

Not secure
===================

Bug fixes
---------

- Fixed assembling the :class:`~yarl.URL` for web requests when the host contains a non-default port or IPv6 address -- by :user:`bdraco`.


*Related issues and pull requests on GitHub:*
:issue:`9309`.




Miscellaneous internal changes
------------------------------

- Improved performance of determining if a URL is absolute -- by :user:`bdraco`.

The property :attr:`~yarl.URL.absolute` is more performant than the method ``URL.is_absolute()`` and preferred when newer versions of yarl are used.


*Related issues and pull requests on GitHub:*
:issue:`9171`.



- Replaced code that can now be handled by ``yarl`` -- by :user:`bdraco`.


*Related issues and pull requests on GitHub:*
:issue:`9301`.




----

3.10.6

Not secure
===================

Bug fixes
---------

- Added :exc:`aiohttp.ClientConnectionResetError`. Client code that previously threw :exc:`ConnectionResetError`
will now throw this -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`9137`.



- Fixed an unclosed transport ``ResourceWarning`` on web handlers -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`8875`.



- Fixed resolve_host() 'Task was destroyed but is pending' errors -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`8967`.



- Fixed handling of some file-like objects (e.g. ``tarfile.extractfile()``) which raise ``AttributeError`` instead of ``OSError`` when ``fileno`` fails for streaming payload data -- by :user:`ReallyReivax`.


*Related issues and pull requests on GitHub:*
:issue:`6732`.



- Fixed web router not matching pre-encoded URLs (requires yarl 1.9.6+) -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`8898`, :issue:`9267`.



- Fixed an error when trying to add a route for multiple methods with a path containing a regex pattern -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`8998`.



- Fixed ``Response.text`` when body is a ``Payload`` -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`6485`.



- Fixed compressed requests failing when no body was provided -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`9108`.



- Fixed client incorrectly reusing a connection when the previous message had not been fully sent -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`8992`.



- Fixed race condition that could cause server to close connection incorrectly at keepalive timeout -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`9140`.



- Fixed Python parser chunked handling with multiple Transfer-Encoding values -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`8823`.



- Fixed error handling after 100-continue so server sends 500 response instead of disconnecting -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`8876`.



- Stopped adding a default Content-Type header when response has no content -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`8858`.



- Added support for URL credentials with empty (zero-length) username, e.g. ``https://:passwordhost`` -- by :user:`shuckc`


*Related issues and pull requests on GitHub:*
:issue:`6494`.



- Stopped logging exceptions from ``web.run_app()`` that would be raised regardless -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`6807`.



- Implemented binding to IPv6 addresses in the pytest server fixture.


*Related issues and pull requests on GitHub:*
:issue:`4650`.



- Fixed the incorrect use of flags for ``getnameinfo()`` in the Resolver --by :user:`GitNMLee`

Link-Local IPv6 addresses can now be handled by the Resolver correctly.


*Related issues and pull requests on GitHub:*
:issue:`9032`.



- Fixed StreamResponse.prepared to return True after EOF is sent -- by :user:`arthurdarcet`.


*Related issues and pull requests on GitHub:*
:issue:`5343`.



- Changed ``make_mocked_request()`` to use empty payload by default -- by :user:`rahulnht`.


*Related issues and pull requests on GitHub:*
:issue:`7167`.



- Used more precise type for ``ClientResponseError.headers``, fixing some type errors when using them -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`8768`.



- Changed behavior when returning an invalid response to send a 500 response -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`8845`.



- Fixed response reading from closed session to throw an error immediately instead of timing out -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`8878`.



- Fixed ``CancelledError`` from one cleanup context stopping other contexts from completing -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`8908`.



- Fixed changing scheme/host in ``Response.clone()`` for absolute URLs -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`8990`.



- Fixed ``Site.name`` when host is an empty string -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`8929`.



- Updated Python parser to reject messages after a close message, matching C parser behaviour -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`9018`.



- Fixed creation of ``SSLContext`` inside of :py:class:`aiohttp.TCPConnector` with multiple event loops in different threads -- by :user:`bdraco`.


*Related issues and pull requests on GitHub:*
:issue:`9029`.



- Fixed (on Python 3.11+) some edge cases where a task cancellation may get incorrectly suppressed -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`9030`.



- Fixed exception information getting lost on ``HttpProcessingError`` -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`9052`.



- Fixed ``If-None-Match`` not using weak comparison -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`9063`.



- Fixed badly encoded charset crashing when getting response text instead of falling back to charset detector.


*Related issues and pull requests on GitHub:*
:issue:`9160`.



- Rejected `\n` in `reason` values to avoid sending broken HTTP messages -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`9167`.



- Changed :py:meth:`ClientResponse.raise_for_status() <aiohttp.ClientResponse.raise_for_status>` to only release the connection when invoked outside an ``async with`` context -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`9239`.




Features
--------

- Improved type on ``params`` to match the underlying type allowed by ``yarl`` -- by :user:`lpetre`.


*Related issues and pull requests on GitHub:*
:issue:`8564`.



- Declared Python 3.13 supported -- by :user:`bdraco`.


*Related issues and pull requests on GitHub:*
:issue:`8748`.




Removals and backward incompatible breaking changes
---------------------------------------------------

- Improved middleware performance -- by :user:`bdraco`.

The ``set_current_app`` method was removed from ``UrlMappingMatchInfo`` because it is no longer used, and it was unlikely external caller would ever use it.


*Related issues and pull requests on GitHub:*
:issue:`9200`.



- Increased minimum yarl version to 1.12.0 -- by :user:`bdraco`.


*Related issues and pull requests on GitHub:*
:issue:`9267`.




Improved documentation
----------------------

- Clarified that ``GracefulExit`` needs to be handled in ``AppRunner`` and ``ServerRunner`` when using ``handle_signals=True``. -- by :user:`Daste745`


*Related issues and pull requests on GitHub:*
:issue:`4414`.



- Clarified that auth parameter in ClientSession will persist and be included with any request to any origin, even during redirects to different origins. -- by :user:`MaximZemskov`.


*Related issues and pull requests on GitHub:*
:issue:`6764`.



- Clarified which timeout exceptions happen on which timeouts -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`8968`.



- Updated ``ClientSession`` parameters to match current code -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`8991`.




Packaging updates and notes for downstreams
-------------------------------------------

- Fixed ``test_client_session_timeout_zero`` to not require internet access -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`9004`.




Miscellaneous internal changes
------------------------------

- Improved performance of making requests when there are no auto headers to skip -- by :user:`bdraco`.


*Related issues and pull requests on GitHub:*
:issue:`8847`.



- Exported ``aiohttp.TraceRequestHeadersSentParams`` -- by :user:`Hadock-is-ok`.


*Related issues and pull requests on GitHub:*
:issue:`8947`.



- Avoided tracing overhead in the http writer when there are no active traces -- by user:`bdraco`.


*Related issues and pull requests on GitHub:*
:issue:`9031`.



- Improved performance of reify Cython implementation -- by :user:`bdraco`.


*Related issues and pull requests on GitHub:*
:issue:`9054`.



- Use :meth:`URL.extend_query() <yarl.URL.extend_query>` to extend query params (requires yarl 1.11.0+) -- by :user:`bdraco`.

If yarl is older than 1.11.0, the previous slower hand rolled version will be used.


*Related issues and pull requests on GitHub:*
:issue:`9068`.



- Improved performance of checking if a host is an IP Address -- by :user:`bdraco`.


*Related issues and pull requests on GitHub:*
:issue:`9095`.



- Significantly improved performance of middlewares -- by :user:`bdraco`.

The construction of the middleware wrappers is now cached and is built once per handler instead of on every request.


*Related issues and pull requests on GitHub:*
:issue:`9158`, :issue:`9170`.



- Improved performance of web requests -- by :user:`bdraco`.


*Related issues and pull requests on GitHub:*
:issue:`9168`, :issue:`9169`, :issue:`9172`, :issue:`9174`, :issue:`9175`, :issue:`9241`.



- Improved performance of starting web requests when there is no response prepare hook -- by :user:`bdraco`.


*Related issues and pull requests on GitHub:*
:issue:`9173`.



- Significantly improved performance of expiring cookies -- by :user:`bdraco`.

Expiring cookies has been redesigned to use :mod:`heapq` instead of a linear search, to better scale.


*Related issues and pull requests on GitHub:*
:issue:`9203`.



- Significantly sped up filtering cookies -- by :user:`bdraco`.


*Related issues and pull requests on GitHub:*
:issue:`9204`.




----

3.10.5

Not secure
=========================

Bug fixes
---------

- Fixed :meth:`aiohttp.ClientResponse.json()` not setting ``status`` when :exc:`aiohttp.ContentTypeError` is raised -- by :user:`bdraco`.


*Related issues and pull requests on GitHub:*
:issue:`8742`.




Miscellaneous internal changes
------------------------------

- Improved performance of the WebSocket reader -- by :user:`bdraco`.


*Related issues and pull requests on GitHub:*
:issue:`8736`, :issue:`8747`.




----

3.10.4

Not secure
===================

Bug fixes
---------

- Fixed decoding base64 chunk in BodyPartReader -- by :user:`hyzyla`.


*Related issues and pull requests on GitHub:*
:issue:`3867`.



- Fixed a race closing the server-side WebSocket where the close code would not reach the client -- by :user:`bdraco`.


*Related issues and pull requests on GitHub:*
:issue:`8680`.



- Fixed unconsumed exceptions raised by the WebSocket heartbeat -- by :user:`bdraco`.

If the heartbeat ping raised an exception, it would not be consumed and would be logged as an warning.


*Related issues and pull requests on GitHub:*
:issue:`8685`.



- Fixed an edge case in the Python parser when chunk separators happen to align with network chunks -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`8720`.




Improved documentation
----------------------

- Added ``aiohttp-apischema`` to supported libraries -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`8700`.




Miscellaneous internal changes
------------------------------

- Improved performance of starting request handlers with Python 3.12+ -- by :user:`bdraco`.

This change is a followup to :issue:`8661` to make the same optimization for Python 3.12+ where the request is connected.


*Related issues and pull requests on GitHub:*
:issue:`8681`.




----

3.10.3

Not secure
========================

Bug fixes
---------

- Fixed multipart reading when stream buffer splits the boundary over several read() calls -- by :user:`Dreamsorcerer`.


*Related issues and pull requests on GitHub:*
:issue:`8653`.



- Fixed :py:class:`aiohttp.TCPConnector` doing blocking I/O in the event loop to create the ``SSLContext`` -- by :user:`bdraco`.

The blocking I/O would only happen once per verify mode. However, it could cause the event loop to block for a long time if the ``SSLContext`` creation is slow, which is more likely during startup when the disk cache is not yet present.


*Related issues and pull requests on GitHub:*
:issue:`8672`.




Miscellaneous internal changes
------------------------------

- Improved performance of :py:meth:`~aiohttp.ClientWebSocketResponse.receive` and :py:meth:`~aiohttp.web.WebSocketResponse.receive` when there is no timeout. -- by :user:`bdraco`.

The timeout context manager is now avoided when there is no timeout as it accounted for up to 50% of the time spent in the :py:meth:`~aiohttp.ClientWebSocketResponse.receive` and :py:meth:`~aiohttp.web.WebSocketResponse.receive` methods.


*Related issues and pull requests on GitHub:*
:issue:`8660`.



- Improved performance of starting request handlers with Python 3.12+ -- by :user:`bdraco`.


*Related issues and pull requests on GitHub:*
:issue:`8661`.



- Improved performance of HTTP keep-alive checks -- by :user:`bdraco`.

Previously, when processing a request for a keep-alive connection, the keep-alive check would happen every second; the check is now rescheduled if it fires too early instead.


*Related issues and pull requests on GitHub:*
:issue:`8662`.



- Improved performance of generating random WebSocket mask -- by :user:`bdraco`.


*Related issues and pull requests on GitHub:*
:issue:`8667`.




----

Page 4 of 33

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.