Bump aiohttp from 3.14.0 to 3.14.1

[dependabot]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[amrit110]

Security Vulnerability — No Patch Available Yet

aieng-bot found the following security vulnerabilities reported by pip-audit, but cannot fix them automatically because no patched version has been released to PyPI yet:

Package	Version	Vulnerability	Status
torch	2.12.0	CVE-2025-3000	No fix available on PyPI

Why this cannot be auto-fixed

The vulnerability exists in torch itself. A fix requires the upstream maintainers (PyTorch) to release a new version. Once a patched release is published to PyPI, aieng-bot can re-run and apply the update automatically.

What aieng-bot did fix

The following tornado vulnerabilities were fixed in this update by pinning tornado>=6.5.7 in the docs dependency group:

Package	Version	Vulnerability	Fix Version
tornado	6.5.5	CVE-2026-49854	6.5.6
tornado	6.5.5	CVE-2026-49853	6.5.6
tornado	6.5.5	CVE-2026-49855	6.5.6
tornado	6.5.5	GHSA-pw6j-qg29-8w7f	6.5.7

Recommended next steps

1. Monitor the CVE-2025-3000 advisory for a torch patch release
2. Check if a pip-audit ignore/exception can be added temporarily with justification (requires human review)
3. Consider whether this dependency can be replaced with an alternative

This PR will not be auto-merged until the torch vulnerability is resolved.

[amrit110]

Automated fix applied and PR merged

The agentic fix loop successfully fixed this PR and merged it.

✓ Successfully fixed merge_conflict failures - Modified 1 files - Executed 383 agent actions - (242 info, 62 tool_call, 16 error, 50 tool_result, 13 reasoning)

View detailed trace on dashboard | Raw trace

AI Engineering Maintenance Bot