From c910e2c0f5c7ad6933832f2bd314946f0713889a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 20 Oct 2026 09:53:06 +0000 Subject: [PATCH 1/2] Bump the pip group across 4 directories with 1 update --- updated-dependencies: - dependency-name: aiohttp dependency-version: 3.14.4 dependency-type: direct:production dependency-group: pip - dependency-name: aiohttp dependency-version: 3.14.4 dependency-type: direct:production dependency-group: pip - dependency-name: aiohttp dependency-version: 3.14.4 dependency-type: direct:production dependency-group: pip - dependency-name: aiohttp dependency-version: 3.14.4 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] --- api_app/requirements.txt | 2 +- cli/requirements.txt | 2 +- cli/setup.py | 2 +- resource_processor/vmss_porter/requirements.txt | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/api_app/requirements.txt b/api_app/requirements.txt index 586b221ede..d27b66b15c 100644 --- a/api_app/requirements.txt +++ b/api_app/requirements.txt @@ -1,4 +1,4 @@ -aiohttp==3.14.3 +aiohttp==3.14.4 azure-core==1.38.0 azure-cosmos==4.14.3 azure-eventgrid==4.22.0 diff --git a/cli/requirements.txt b/cli/requirements.txt index 2b3e06275c..0aa15b5661 100644 --- a/cli/requirements.txt +++ b/cli/requirements.txt @@ -8,4 +8,4 @@ pygments==2.20.0 PyJWT==2.15.0 azure-cli-core==2.68.0 azure-identity==1.25.1 -aiohttp==3.14.3 +aiohttp==3.14.4 diff --git a/cli/setup.py b/cli/setup.py index 27885387a0..ae3d7a0d38 100644 --- a/cli/setup.py +++ b/cli/setup.py @@ -42,7 +42,7 @@ "PyJWT==2.15.0", "azure-cli-core==2.68.0", "azure-identity==1.25.1", - "aiohttp==3.14.3", + "aiohttp==3.14.4", ], namespace_packages=[], packages=find_packages(), diff --git a/resource_processor/vmss_porter/requirements.txt b/resource_processor/vmss_porter/requirements.txt index cde3f95cb7..7176c609a6 100644 --- a/resource_processor/vmss_porter/requirements.txt +++ b/resource_processor/vmss_porter/requirements.txt @@ -1,4 +1,4 @@ -aiohttp==3.14.3 +aiohttp==3.14.4 azure-cli-core==2.68.0 azure-identity==1.25.1 azure-monitor-opentelemetry==1.8.9 From 36b50617214582fec5eb5fa4868609e056b6cf56 Mon Sep 17 00:00:00 2001 From: Jay W Date: Tue, 20 Oct 2026 11:46:03 +0100 Subject: [PATCH 2/2] #5270: Record aiohttp security update metadata --- CHANGELOG.md | 1 + api_app/_version.py | 2 +- cli/setup.py | 2 +- resource_processor/_version.py | 2 +- 4 files changed, 4 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 71bcf2202a..4412022b52 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -28,6 +28,7 @@ See [Legacy Airlock & migration](docs/azure-tre-overview/airlock.md#legacy-airlo * Add weekly and manual builds for Dockerfiles and Porter bundles, with selected pull request builds. Retry a failed target once and report final results. ([#5088](https://github.com/microsoft/AzureTRE/issues/5088)) BUG FIXES: +* Update `aiohttp` from 3.14.3 to 3.14.4 in `api_app`, `resource_processor`, and the CLI to address security advisories. (`API` 0.28.7, `resource_processor` 0.13.15, `CLI` 0.2.13) ([#5270](https://github.com/microsoft/AzureTRE/pull/5270)) * Rename a test variable in the E2E polling tests so that CodeQL stops reporting false clear-text logging alerts. ([#5266](https://github.com/microsoft/AzureTRE/pull/5266)) * Protect active validation environments and require successful smoke tests before custom tests. Validate shared-service command arguments and forward explicit Nexus EULA consent. (`devops` 0.6.20, `build-scripts` 1.1.4) ([#5255](https://github.com/microsoft/AzureTRE/pull/5255)) * Give E2E cleanup separate deadlines and allow 30 seconds for smoke health requests. ([#5255](https://github.com/microsoft/AzureTRE/pull/5255)) diff --git a/api_app/_version.py b/api_app/_version.py index 9f396f25c7..90c08ed819 100644 --- a/api_app/_version.py +++ b/api_app/_version.py @@ -1 +1 @@ -__version__ = "0.28.6" +__version__ = "0.28.7" diff --git a/cli/setup.py b/cli/setup.py index ae3d7a0d38..f192237a80 100644 --- a/cli/setup.py +++ b/cli/setup.py @@ -4,7 +4,7 @@ from setuptools import setup PROJECT = "azure-tre-cli" -VERSION = "0.2.12" +VERSION = "0.2.13" try: long_description = open("README.md", "rt").read() diff --git a/resource_processor/_version.py b/resource_processor/_version.py index 23a4e3cb02..2ad2391828 100644 --- a/resource_processor/_version.py +++ b/resource_processor/_version.py @@ -1 +1 @@ -__version__ = "0.13.14" +__version__ = "0.13.15"