Bug fixes Fixed the client dropping only the first Authorization, Cookie and Proxy-Authorization header when a redirect crossed an origin -- by :user:arshsmith1. Related issues and pull requests on GitHub: #13180. Fixed error message construction in the C HTTP parser -- by :user:bdraco. Related issues and pull requests on GitHub: #13222.
Bug fixes Fixed :py:attr:~aiohttp.web.StreamResponse.last_modified rounding a :class:datetime.datetime with a fractional second down. Related issues and pull requests on GitHub: #5303. Fixed resolving localhost on Windows to fall back without AI_ADDRCONFIG when the first lookup fails, so localhost still works without an active network. Related issues and pull requests on GitHub: #5357. Rejected mu…
Bug fixes Fixed a race condition in :py:class:~aiohttp.TCPConnector where closing the connector while a DNS resolution was in-flight could raise :py:exc:AttributeError instead of :py:exc:~aiohttp.ClientConnectionError -- by :user:goingforstudying-ctrl. Related issues and pull requests on GitHub: #12497. Fixed CancelledError not closing a connection -- by :user:aiolibsbot. Related issues and pull r…
We have a new website! https://aio-libs.org Subscribe to the news feed to find out more about what we're working on in future. Features Added RequestKey and ResponseKey classes, which enable static type checking for request & response context storages in the same way that AppKey does for Application -- by :user:gsoldatov. Related issues and pull requests on GitHub: #11766. Added :func:~aiohttp.enc…
Bug fixes Skipped the duplicate singleton header check in lax mode (the default for response parsing). In strict mode (request parsing, or -X dev), all RFC 9110 singletons are still enforced -- by :user:bdraco. Related issues and pull requests on GitHub: #12302.
Features Added max_headers parameter to limit the number of headers that should be read from a response -- by :user:Dreamsorcerer. Related issues and pull requests on GitHub: #11955. Added a dns_cache_max_size parameter to TCPConnector to limit the size of the cache -- by :user:Dreamsorcerer. Related issues and pull requests on GitHub: #12106. Bug fixes Fixed server hanging indefinitely when chunk…
This release contains fixes for several vulnerabilities. It is advised to upgrade as soon as possible. Bug fixes Fixed proxy authorization headers not being passed when reusing a connection, which caused 407 (Proxy authentication required) errors -- by :user:GLeurquin. Related issues and pull requests on GitHub: #2596. Fixed multipart reading failing when encountering an empty body part -- by :use…
Bug fixes Fixed cookie parser to continue parsing subsequent cookies when encountering a malformed cookie that fails regex validation, such as Google's g_state cookie with unescaped quotes -- by :user:bdraco. Related issues and pull requests on GitHub: #11632. Fixed loading netrc credentials from the default :file:~/.netrc (:file:~/_netrc on Windows) location when the :envvar:NETRC environment var…
Features Make configuration options in AppRunner also available in run_app() -- by :user:Cycloctane. Related issues and pull requests on GitHub: #11633. Bug fixes Switched to backports.zstd for Python <3.14 and fixed zstd decompression for chunked zstd streams -- by :user:ZhaoMJ. Note: Users who installed zstandard for support on Python <3.14 will now need to install backports.zstd instead (instal…
Features Added support for Python 3.14. Related issues and pull requests on GitHub: #10851, #10872. Added support for free-threading in Python 3.14+ -- by :user:kumaraditya303. Related issues and pull requests on GitHub: #11466, #11464. Added support for Zstandard (aka Zstd) compression -- by :user:KGuillaume-chaps. Related issues and pull requests on GitHub: #11161. Added StreamReader.total_raw_b…
Bug fixes Fixed :class:~aiohttp.DigestAuthMiddleware to preserve the algorithm case from the server's challenge in the authorization response. This improves compatibility with servers that perform case-sensitive algorithm matching (e.g., servers expecting algorithm=MD5-sess instead of algorithm=MD5-SESS) -- by :user:bdraco. Related issues and pull requests on GitHub: #11352. Improved documentation…
Bug fixes Fixed file uploads failing with HTTP 422 errors when encountering 307/308 redirects, and 301/302 redirects for non-POST methods, by preserving the request body when appropriate per :rfc:9110#section-15.4.3-3.1 -- by :user:bdraco. Related issues and pull requests on GitHub: #11270. Fixed :py:meth:ClientSession.close() <aiohttp.ClientSession.close> hanging indefinitely when using HTTPS req…