[dependabot]

Bumps the aiohttp group with 2 updates: aiohttp and multidict.

Updates aiohttp from 3.14.4 to 3.14.5
Updates multidict from 6.9.1 to 7.1.0

Release notes

Sourced from multidict's releases.

7.1.0 is a correctness and housekeeping release. It changes what keys() yields, fixes a long list of crashes and inconsistencies that Python code run in the middle of an operation could trigger, stores the common all-str multidicts in half the space, and deprecates multidict.upstr.

Behaviour changes. keys() and iteration over a multidict yield each key once, as spelled in its first item, so len(d.keys()) counts distinct keys; items(), values() and len(d) still see every item. A str subclass's own lower() is no longer called to compute the case-insensitive identity of a CIMultiDict key.

Robustness. Finalizers, __eq__(), __repr__(), lower() and argument iterators that read or mutate the multidict in the middle of __init__(), update(), merge(), del d[key], popall(), popitem(), to_dict() or repr() no longer crash the C extension, lose or duplicate pairs, or make the two backends disagree. Two data races against lock-free readers on the free-threaded build are gone too.

Memory. A MultiDict whose keys are all exact str, and a CIMultiDict whose keys are all exact istr, are stored in a compact table without a separate identity and hash per entry, which cuts their size by about 45%.

Bug fixes

• Fixed building the C extension on platforms where char is unsigned, such as ARM, PowerPC, s390x and RISC-V, and with GCC 9, which flags CPython's own headers from 3.12 on; both failed on a sign conversion warning since -Wconversion took effect. GCC 9 builds the extension without -Wconversion -- by @​asvetlov.

  Related issues and pull requests on GitHub: #1759, #1760.

• Fixed getversion() returning only the low 32 bits of the version on Windows and on 32-bit platforms, where two different versions could compare equal, and fixed a race in the pure-Python implementation on GIL builds that could give two multidicts mutated at the same time from different threads the same version -- by @​asvetlov.

  Related issues and pull requests on GitHub: #1607, #1610.

... (truncated)

Changelog

Sourced from multidict's changelog.

7.1.0

(2026-10-08)

7.1.0 is a correctness and housekeeping release. It changes what :meth:~multidict.MultiDict.keys yields, fixes a long list of crashes and inconsistencies that Python code run in the middle of an operation could trigger, stores the common all-:class:str multidicts in half the space, and deprecates multidict.upstr.

Behaviour changes. :meth:~multidict.MultiDict.keys and iteration over a multidict yield each key once, as spelled in its first item, so len(d.keys()) counts distinct keys; :meth:~multidict.MultiDict.items, :meth:~multidict.MultiDict.values and len(d) still see every item. A :class:str subclass's own lower() is no longer called to compute the case-insensitive identity of a :class:~multidict.CIMultiDict key.

Robustness. Finalizers, __eq__(), __repr__(), lower() and argument iterators that read or mutate the multidict in the middle of __init__(), update(), merge(), del d[key], :meth:~multidict.MultiDict.popall, :meth:~multidict.MultiDict.popitem, :meth:~multidict.MultiDict.to_dict or :func:repr no longer crash the C extension, lose or duplicate pairs, or make the two backends disagree. Two data races against lock-free readers on the free-threaded build are gone too.

Memory. A :class:~multidict.MultiDict whose keys are all exact :class:str, and a :class:~multidict.CIMultiDict whose keys are all exact :class:~multidict.istr, are stored in a compact table without a separate identity and hash per entry, which cuts their size by about 45%.

Bug fixes

• Fixed building the C extension on platforms where char is unsigned, such as ARM, PowerPC, s390x and RISC-V, and with GCC 9, which flags CPython's own headers from 3.12 on; both failed on a sign conversion warning since -Wconversion took effect. GCC 9 builds the extension without -Wconversion -- by :user:asvetlov.

  Related issues and pull requests on GitHub: :issue:1759, :issue:1760.

• Fixed :func:~multidict.getversion returning only the low 32 bits of the version on Windows and on 32-bit platforms, where two different versions could compare equal, and fixed a race in the pure-Python implementation on GIL builds that could give two multidicts mutated at the same time from different threads the same version

... (truncated)

Commits

• 709f260 Trim the test run of the emulated wheel jobs (#1762)
• dbc3aba Build(deps): Bump pypa/cibuildwheel from 4.2.1 to 4.3.0 (#1761)
• ef68371 Build without -Wconversion on GCC 9 (#1760)
• e812c4f Fix the C extension build where char is unsigned (#1759)
• f9459a1 Release 7.1.0 (#1758)
• 45552bd Fold the hash chain walk into _md_update() (#1757)
• 84c5412 Move to_dict() into to_dict.h and mark only later duplicates (#1756)
• cfd8ea2 Reserve room for update() and merge() only when keys are added (#1755)
• fb828e3 Prefix header-local helpers with an underscore (#1753)
• 3c3fc84 Move istr_canonical() into istr_object.h (#1754)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.