fix: drop all aiohttp CVE ignores via aiogram 3.30 + aiohttp 3.14.1 (v0.18.1)

Nine new aiohttp PYSEC advisories (published today, fixed only in 3.14.x)
turned the blocking CI pip-audit red minutes after the v0.18.0 push.
aiogram 3.30 has lifted its aiohttp<3.14 cap, so instead of nine more
ignore flags this takes the real fix the project has been waiting on
since v0.16.0: aiohttp 3.14.1, clearing the two long-ignored CVEs
(CVE-2026-34993, CVE-2026-47265) and the new batch. Also bumps
cryptography 47->49, msgpack 1.1.2->1.2.1, pydantic-settings 2.14.2
past their advisories. pip-audit now runs with no ignores and reports
no known vulnerabilities; 1219 tests, mypy strict and ruff clean on the
upgraded set.

Claude-Session: https://claude.ai/code/session_01JJzWL7m4Rf6u71aGifgeJn

Author: dervish666

.github/workflows/ci.yml

@@ -34,12 +34,8 @@ jobs:
         run: uv run pytest tests/
 
       # Audits the project venv for known CVEs. Blocking, so new CVEs surface
-      # immediately. Ignored IDs are aiohttp issues fixed only in 3.14, which
-      # aiogram caps below; neither is exploitable here (no CookieJar.load(),
-      # no per-request cookies) — see pyproject.toml. Drop the ignores once
-      # aiogram allows aiohttp>=3.14.
+      # immediately. No ignores: the long-standing aiohttp exceptions were
+      # dropped in v0.18.1 when aiogram 3.30 lifted its aiohttp<3.14 cap and
+      # we moved to aiohttp>=3.14.1.
       - name: Dependency audit (pip-audit)
-        run: >
-          uv run pip-audit
-          --ignore-vuln CVE-2026-34993
-          --ignore-vuln CVE-2026-47265
+        run: uv run pip-audit

CHANGELOG.md

@@ -2,6 +2,15 @@
 
 All notable changes to UnraidMonitor will be documented in this file.
 
+## [0.18.1] - 2026-07-18
+
+### Security
+- **All aiohttp CVE ignores dropped** — aiogram 3.30 lifted its `aiohttp<3.14` cap, so aiohttp is now 3.14.1, which fixes the two long-ignored advisories (CVE-2026-34993, CVE-2026-47265) *and* the nine new aiohttp PYSEC advisories published 2026-07-18 that turned CI red minutes after the v0.18.0 push. CI pip-audit now runs with **no ignore flags**.
+- Bumped `cryptography` (47.0.0 → 49.0.0), `msgpack` (1.1.2 → 1.2.1), and `pydantic-settings` (2.14.1 → 2.14.2) past their respective advisories. `pip-audit`: no known vulnerabilities.
+
+### Changed
+- aiogram 3.28.2 → 3.30.0 (floor raised to `>=3.30.0`); full suite re-verified on the new versions.
+
 ## [0.18.0] - 2026-07-18
 
 ### Added

pyproject.toml

@@ -1,18 +1,17 @@
 [project]
 name = "unraid-monitor-bot"
-version = "0.18.0"
+version = "0.18.1"
 requires-python = ">=3.11"
 dependencies = [
     "docker>=7.0.0,<8.0.0",
-    "aiogram>=3.4.0,<4.0.0",
+    "aiogram>=3.30.0,<4.0.0",
     "pyyaml>=6.0,<7.0",
     "pydantic>=2.0,<3.0",
     "pydantic-settings>=2.0,<3.0",
     "psutil>=6.1.0,<8.0.0",
-    # aiogram caps aiohttp <3.14; CVE-2026-34993/CVE-2026-47265 (fixed in 3.14)
-    # are not exploitable here (no CookieJar.load, no per-request cookies) —
-    # ignored in CI pip-audit. Lift floor to >=3.14 when aiogram allows it.
-    "aiohttp>=3.13.5,<4.0.0",
+    # aiogram >=3.30 allows aiohttp <3.15 — floor raised past the 2026 CVE
+    # batch (all fixed in 3.14.x); CI pip-audit now runs with no ignores.
+    "aiohttp>=3.14.1,<4.0.0",
     "python-dotenv>=1.0.0,<2.0.0",
 ]
 

src/__init__.py

@@ -1 +1 @@
-__version__ = "0.18.0"
+__version__ = "0.18.1"