[Snyk] Security upgrade aiohttp from 3.8.6 to 3.13.3

[RemyLoveLogicAI]

Snyk has created this PR to fix 8 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

• requirements.txt

⚠️ Warning

transformers 4.30.2 requires safetensors, which is not installed.
timm 0.9.12 requires safetensors, which is not installed.
python-docx 1.1.2 has requirement typing-extensions>=4.9.0, but you have typing-extensions 4.7.1.
paddlepaddle 1.8.5 requires scipy, which is not installed.
paddlepaddle 1.8.5 has requirement opencv-python<=4.2.0.32, but you have opencv-python 4.12.0.88.
paddleocr 2.7.5 requires scikit-image, which is not installed.
paddleocr 2.7.5 has requirement opencv-python<=4.6.0.66, but you have opencv-python 4.12.0.88.
paddleocr 2.7.5 has requirement Pillow>=10.0.0, but you have Pillow 9.5.0.
imgaug 0.4.0 requires scipy, which is not installed.
imgaug 0.4.0 requires scikit-image, which is not installed.
gradio 3.34.0 requires aiohttp, which is not installed.
gradio 3.34.0 requires ffmpy, which is not installed.
easyocr 1.7.2 requires ninja, which is not installed.
easyocr 1.7.2 requires scipy, which is not installed.
easyocr 1.7.2 requires scikit-image, which is not installed.
easyocr 1.7.2 requires python-bidi, which is not installed.
dashscope 1.16.0 requires aiohttp, which is not installed.
botocore 1.33.13 has requirement urllib3<1.27,>=1.25.4; python_version < "3.10", but you have urllib3 2.0.7.
anthropic 0.38.0 requires jiter, which is not installed.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.
• Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

---

Summary by cubic

Upgrade security by setting a minimum aiohttp version of 3.13.3 to address eight known vulnerabilities and protect transitive users (e.g., gradio, dashscope). No code changes; only the dependency list is updated.

• Dependencies
  • Added aiohttp>=3.13.3 to requirements.txt to enforce a secure version during installs.

^{Written for commit c62bbf7. Summary will update on new commits.}

Summary by Bito

• Updates the aiohttp dependency in requirements.txt to version 3.13.3 to address eight known vulnerabilities, ensuring the project uses a secure version critical for application security.
• No code changes were made; only the dependency list was updated to enforce this version during installations.
• Overall summary: updates the aiohttp dependency to mitigate security risks.

[codeant-ai]

CodeAnt AI is reviewing your PR.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[safedep]

SafeDep Report Summary

Package Details

Package	Malware	Vulnerability	Risky License	Report
aiohttp @ 3.13.3 requirements.txt				🔗

_{This report is generated by SafeDep Github App}

[gemini-code-assist]

Summary of Changes

Hello @RemyLoveLogicAI, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request automates a critical security update for the project's dependencies. It specifically targets and resolves multiple identified vulnerabilities within the aiohttp package by upgrading it to a more secure version. This proactive measure enhances the overall security posture of the application by ensuring that a key network library is free from known exploits.

Highlights

• Security Vulnerability Fix: This pull request addresses 8 security vulnerabilities by upgrading the aiohttp dependency to its latest secure version.
• Dependency Update: The requirements.txt file has been modified to pin aiohttp to version 3.13.3 as recommended by Snyk.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[codeant-ai]

CodeAnt AI finished reviewing your PR.

[codeant-ai]

💡 Enhance Your PR Reviews

We noticed that 3 feature(s) are not configured for this repository. Enabling these features can help improve your code quality and workflow:

🚦 Quality Gates

Status: Quality Gates are not enabled at the organization level
Learn more about Quality Gates

🎫 Jira Ticket Compliance

Status: Jira credentials file not found. Please configure Jira integration in your settings
Learn more about Jira Integration

⚙️ Custom Rules

Status: No custom rules configured. Add rules via organization settings or .codeant/review.json in your repository
Learn more about Custom Rules

---

Want to enable these features? Contact your organization admin or check our documentation for setup instructions.

[gemini-code-assist]

Code Review

This pull request from Snyk addresses important security vulnerabilities by upgrading aiohttp. While the change itself is correct and necessary, the Snyk report in the pull request description highlights numerous other dependency conflicts and missing packages. These issues are critical as they can cause runtime errors or unpredictable behavior. I strongly recommend creating a follow-up task to investigate and resolve all the warnings listed by Snyk to ensure the project's stability and reliability.

[gemini-code-assist]

The comment provided by Snyk is slightly misleading. aiohttp is a transitive dependency of gradio and dashscope, which are present in your requirements.txt. Pinning it here is the correct approach to enforce a secure version. For better clarity and future maintenance, I suggest updating the comment to reflect this.

Additionally, this file is missing a newline at the end. It's a good practice and a PEP 8 recommendation to end text files with a newline character to prevent issues with some tools and to produce cleaner diffs.

aiohttp>=3.13.3 # Pinned by Snyk to resolve security vulnerabilities; transitive dependency of gradio, dashscope

References

1. PEP 8, the style guide for Python code, recommends that all files should end with a single newline character. This helps avoid issues with file concatenation and some command-line tools. ^(link)

[cubic-dev-ai]

No issues found across 1 file