Make aiohttp version requirements consistent; address CVE-2025-69223#693
Merged
Conversation
We used to have: ``` ofrak_core/setup.py: "aiohttp>=3.12.14", ofrak_core/requirements.txt:aiohttp>=3.12.14 disassemblers/ofrak_ghidra/setup.py: "aiohttp~=3.12.14", disassemblers/ofrak_ghidra/requirements.txt:aiohttp>=3.12.14 ``` but the `>=` requirements were resulting in `aiohttp` 3.13.x getting installed, which then clashed with `ofrak_ghidra`'s `setup.py` This changes both `requirements.txt` to use `=~3.12.14`
4 tasks
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
ANogin
changed the title
aiohttp version requirements consistentaiohttp version requirements consistent; address CVE-2025-69223
whyitfor
requested changes
Feb 4, 2026
Contributor
whyitfor
left a comment
whyitfor
left a comment
There was a problem hiding this comment.
Need to bump ofrak and ofrak_ghidra rc version numbers with this change.
rbs-jacob
approved these changes
Feb 13, 2026
Member
rbs-jacob
left a comment
rbs-jacob
left a comment
There was a problem hiding this comment.
Confirmed that this is not a breaking change with regards to internal projects that use OFRAK.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
One sentence summary of this PR (This should go in the CHANGELOG!)
Bump
aiohttpto >=3.13.3 to address CVE-2025-69223Link to Related Issue(s)
N/A
Please describe the changes in your request.
We used to have:
but the
>=requirements were resulting inaiohttp3.13.x getting installed, which then clashed withofrak_ghidra'ssetup.pyAt the same time, 3.12.14 (all <= 3.13.2) have a security vulnerability (CVE-2025-69223)
This changes both
setup.pyto >= 3.13.3 andrequirements.txtto use==3.13.3Anyone you think should look at this, specifically?
@whyitfor