SK-2907-Added-fix-for-policy-voilation-updated-the-versions

[skyflow-himanshupal]

Summary

Fixes the 10 high-severity Endor Labs findings (SK-2907) against aiohttp@3.13.5 on the v1 branch.

Changes

• setup.py: aiohttp was unpinned. It now requires >=3.14.3 on Python 3.10+.
  • aiohttp 3.14.x requires Python 3.10+, so Python 3.7–3.9 keep the unpinned requirement to avoid breaking installs.

Advisories resolved

GHSA-hg6j-4rv6-33pg, GHSA-4m7w-qmgq-4wj5, GHSA-63hw-fmq6-xxg2, GHSA-g3cq-j2xw-wf74, GHSA-cq5v-8q36-5273, GHSA-9x8q-7h8h-wcw9, GHSA-4fvr-rgm6-gqmc, GHSA-xcgm-r5h9-7989, GHSA-2fqr-mr3j-6wp8, GHSA-m6qw-4cw2-hm4m

Testing

• On Python 3.12, pip install . resolves to aiohttp 3.14.5, and pip check passes.
• OSV.dev lists no open advisories for aiohttp 3.14.3 or 3.14.5.
• I ran the unit tests with aiohttp 3.13.5 and 3.14.5. Both versions failed exactly the same tests, all because of missing vault credentials (CI secrets), not aiohttp.

[github-actions]

✅ Gitleaks Findings: No secrets detected. Safe to proceed!

[github-actions]

Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging.