[katsugtgz]

Updates aiohttp to 3.14.4 and yarl to 1.25.1 to address GHSA-5wr8-gcqf-gqf3, GHSA-2g87-pp6c-29x5, and GHSA-494j-54xm-rwp3.

Evidence:

• requirements.txt and requirements.lock.txt referenced aiohttp==3.14.3
• osv-scanner reported GHSA-5wr8-gcqf-gqf3, GHSA-2g87-pp6c-29x5, and GHSA-494j-54xm-rwp3 for aiohttp 3.14.3 before the update
• aiohttp 3.14.4 requires yarl>=1.25.1 while the lockfile pinned yarl==1.24.5, so the yarl entry was updated in the same change

Validation:

• osv-scanner no longer reports any advisory for aiohttp or yarl after the update
• pip install --require-hashes -r requirements.lock.txt succeeds
• pytest -q passes: 268 passed, 2 skipped, 13 subtests passed

Scope: dependency pin and hashed lockfile entries only.

Note: the lockfile has separate advisories for other pins (for example urllib3 1.26.9, which needs a major upgrade to clear). Not addressed here.

[vercel]

@katsugtgz is attempting to deploy a commit to the vastsa's projects Team on Vercel.

A member of the Team first needs to authorize it.