[rhoai-2.25] RHAIENG-6770,RHAIENG-6767: chore(cve): bump aiohttp to >=3.14.3

[mtchoum1]

Summary

• Raise aiohttp CVE floor to >=3.14.3 in dependencies/cve-constraints.txt for RHAIENG-6770 / RHAIENG-6767 (CVE-2026-69244, CVE-2026-69243; also covers prior CVE-2026-34993).
• Refresh pylocks so workbench/runtime/codeserver images resolve aiohttp 3.14.3 (was 3.14.1 on most images).

Test plan

• gmake test (unit) passed on the branch
• CI Build Notebooks / container tests

Notes

Other unassigned [rhoai-2.25] Python trackers checked:

• GitPython (RHAIENG-6756): already 3.1.57 (>= 3.1.51)
• JupyterLab (RHAIENG-6089): already 4.6.2 (>= 4.5.7); codeserver notebook 7.6.0 (>= 7.5.6)
• transformers (RHAIENG-5495): pinned 4.55.2; fix needs >=5.5.0 (major) — not included
• Node/Java/Go/containerd/vLLM: not addressed in this PR

Summary by CodeRabbit

• Bug Fixes
  • Updated aiohttp to version 3.14.3 across supported Python environments.
  • Addressed known denial-of-service and request-smuggling vulnerabilities through updated security constraints.
  • Refreshed package artifacts and integrity metadata for reliable environment builds.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign harshad16 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

@mtchoum1 — This PR is from a fork.
The build-rhoai CI job was skipped because subscription
builds (RHEL, AIPCC) need secrets unavailable to forks.
ODH builds and code quality checks still ran.

Recommended: Push your branch to the main repo for full CI:

git remote add upstream https://github.com/red-hat-data-services/notebooks.git
git push upstream HEAD:mtchoum1/your-branch-name

Then open a new PR from that branch.

No push access? A maintainer will cherry-pick and test your changes.

See CONTRIBUTING.md for details.

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes

aiohttp security update

Layer / File(s)	Summary
Update aiohttp security constraint dependencies/cve-constraints.txt	The minimum aiohttp version is raised from 3.14.0 to 3.14.3. Additional issue and CVE references are documented.
Refresh aiohttp lockfiles codeserver/..., jupyter/..., runtimes/...	All listed lockfiles replace aiohttp 3.14.1 artifacts with 3.14.3 source and wheel metadata, URLs, sizes, timestamps, and SHA-256 hashes.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• red-hat-data-services/notebooks#2727: Updates aiohttp to 3.14.3 in the same lockfiles and CVE constraints.
• red-hat-data-services/notebooks#2521: Updates aiohttp constraints and lockfile metadata across the same image configurations.
• red-hat-data-services/notebooks#2634: Updates aiohttp CVE constraints and regenerates related lockfile entries.

Suggested reviewers: jiridanek

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CVE-related aiohttp version increase to 3.14.3.
Description check	✅ Passed	The description explains the changes, links the tracked issues, records passed unit tests, and identifies pending CI and container tests.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (rhoai-2.25@4f37e8a). Learn more about missing BASE report.
✅ All tests successful. No failed tests found.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@             Coverage Diff              @@
##             rhoai-2.25   #2732   +/-   ##
============================================
  Coverage              ?       0           
============================================
  Files                 ?       0           
  Lines                 ?       0           
  Branches              ?       0           
============================================
  Hits                  ?       0           
  Misses                ?       0           
  Partials              ?       0           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

🧹 Nitpick comments (1)

codeserver/ubi9-python-3.12/pylock.toml (1)

16-57: 🩺 Stability & Availability | 🔵 Trivial

Complete the pending image validation before merge.

The PR context records CI build and container tests as pending. Run them for the refreshed lockfiles and target images.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@codeserver/ubi9-python-3.12/pylock.toml` around lines 16 - 57, Complete
validation for the refreshed pylock.toml lockfile by running the CI build and
container tests for the affected ubi9-python-3.12 target image, and confirm they
pass before merging.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@codeserver/ubi9-python-3.12/pylock.toml`:
- Around line 16-57: Complete validation for the refreshed pylock.toml lockfile
by running the CI build and container tests for the affected ubi9-python-3.12
target image, and confirm they pass before merging.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 85c7ef8e-27da-4d0e-8fda-4118422cfbf5

📥 Commits

Reviewing files that changed from the base of the PR and between c8b0cb0 and d529889.

📒 Files selected for processing (14)

• codeserver/ubi9-python-3.12/pylock.toml
• dependencies/cve-constraints.txt
• jupyter/datascience/ubi9-python-3.12/pylock.toml
• jupyter/minimal/ubi9-python-3.12/pylock.toml
• jupyter/pytorch+llmcompressor/ubi9-python-3.12/pylock.toml
• jupyter/pytorch/ubi9-python-3.12/pylock.toml
• jupyter/rocm/pytorch/ubi9-python-3.12/pylock.toml
• jupyter/tensorflow/ubi9-python-3.12/pylock.toml
• runtimes/datascience/ubi9-python-3.12/pylock.toml
• runtimes/minimal/ubi9-python-3.12/pylock.toml
• runtimes/pytorch+llmcompressor/ubi9-python-3.12/pylock.toml
• runtimes/pytorch/ubi9-python-3.12/pylock.toml
• runtimes/rocm-pytorch/ubi9-python-3.12/pylock.toml
• runtimes/tensorflow/ubi9-python-3.12/pylock.toml

[ysok]

/build-konflux

[ysok]

On GHA builds, lot of this error, it is not related to this PR, but keep as note.

[mtchoum1]

On GHA builds, lot of this error, it is not related to this PR, but keep as note.

this is a from a fork branch so it can't pull the secrets. close and start any other PR from a branch in the rhds branch

[mtchoum1]

move to a branch in rhds: #2745