[dependabot]

Bumps aiohttp from 3.14.3 to 3.14.4.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Summary by cubic

Bumps aiohttp from 3.14.3 to 3.14.4, updating uv.lock with the new resolved dependency tree.

^{Written for commit 4dc68f1. Summary will update on new commits.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: JWEB0689/coderabbit/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5d24004c-ecd2-437a-80f8-af6a6fd317d9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[kilo-code-bot]

Code Review Roast 🔥

Verdict: No Issues Found | Recommendation: Merge

Oh wait, this PR is actually clean. I need to sit down. I had my flamethrower warmed up and everything.

What I checked before throwing the flamethrower away:

• aiohttp 3.14.3 → 3.14.4 — a patch bump, and the pyproject.toml constraint aiohttp>=3.14.3,<4 still holds, so uv lock --check in CI has no reason to sulk.
• yarl 1.24.2 → 1.25.1 rode along as a transitive bump — mandatory plumbing for the newer aiohttp, not a stray finger on the keyboard. The project never imports yarl directly, so it inherits aiohttp's contract rather than forming its own opinions.
• Lock format (version = 1, revision = 3) and requires-python = ">=3.12" are untouched — no sneaky interpreter bump hiding in the whitespace.
• Wheel coverage is complete for cp312 through cp315, including the free-threaded cp314-cp314t / cp315t builds, so the docker/Dockerfile.lambda build on python3.14 won't go looking for a wheel that isn't there.
• Every changed line in uv.lock is a version, hash, URL, or upload-time — no dependency graph reshuffling smuggled in under the cover of a "patch" release.

The only thing I'd genuinely nit: the PR title mentions aiohttp while the diff also bumps yarl, but that's uv's doing, not yours, and the lock file is exactly where that change belongs.

📊 Overall: Like a well-labeled grocery list — one item swapped, prices updated, nothing unexpected in the cart.

Files Reviewed (1 file)

• uv.lock - 0 issues

---

_{Reviewed by free · Input: 71.1K · Output: 11.2K · Cached: 1.1M}