Upgrade aiohttp to 3.14.3

[IlonaShishov]

Summary

Upgrade aiohttp from >=3.14.1 to >=3.14.3 to address three CVEs:

• CVE-2026-69244 (CVSS 7.1 High) — Heap out-of-bounds read in aiohttp's Cython-based HTTP parser. When processing malformed HTTP traffic, the parser triggers an uncontrolled strlen() call on non-null-terminated network buffers, causing worker process crashes or exposure of adjacent heap memory in exception messages.

• CVE-2026-69243 (CVSS 6.3 Medium) — HTTP request smuggling via WebSocket upgrade. A WebSocket upgrade request with a body causes the parser to switch protocols before the complete request body is received, leaving trailing bytes to be interpreted as pipelined HTTP requests.

• CVE-2026-59881 (CVSS 5.3 Medium) — WebSocket client accepts and decompresses frames with the RSV1 bit set even when permessage-deflate was not negotiated, impacting availability.

Impact on this project: Low. This project does not use aiohttp directly — it is a transitive dependency pulled in by litellm (requires aiohttp>=3.10,<4.0). The agent runs on FastAPI/uvicorn, not an aiohttp server. litellm uses aiohttp as an HTTP client for LLM API calls, where the upstream services (Google Gemini APIs) are trusted and unlikely to send malformed responses.

Breaking changes in aiohttp 3.14.3:

• Connector now raises aiohttp.ClientConnectionError instead of OSError on socket close failures — not caught in this project's code
• Minor URL parsing change for origin-form request targets with empty query strings — no impact

Changes

• pyproject.toml: bump aiohttp>=3.14.1 → aiohttp>=3.14.3
• requirements-agent.txt: regenerated lock file

Test plan

• make lint — clean
• make test — 490 passed
• Verify Konflux build succeeds

🤖 Generated with Claude Code

[luis5tb]

LGTM