# What changed in aiohttp

> 170 changes in aiohttp 3 from its official release notes, upgrade guides and advisories: 25 breaking, 4 deprecations, 48 security, 19 new APIs and options. Each one cited. Sources checked 2026-10-17. HTML: https://unstale.sh/pypi/aiohttp/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## aiohttp 3

### Breaking changes

- Rejects HTTP and HTTPS absolute-form targets without // or with an empty host. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Stalled first request bodies now close connections, while actively arriving bodies extend the deadline. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Pure-Python parsing now rejects control characters in request targets, matching the llhttp-backed parser. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- The receive queue keeps only a weak reference while parsing is stalled, so direct users must retain the reader. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- The minimum supported yarl version is now 1.25.1. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Multipart Content-Length values must contain only decimal digits, matching the main request parser. (3.14.2) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2)
- load now replaces jar contents instead of merging them with existing state. (3.14.1) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.1)
- Loaded cookies now use update_cookies acceptance rules, including rejecting IP-address cookies without unsafe=True. (3.14.1) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.1)
- read_nowait now returns only chunks buffered when the call started, keeping automatic body draining bounded. (3.14.1) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.1)
- readany now returns only chunks buffered when the call started, keeping automatic body draining bounded. (3.14.1) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.1)
- Legacy non-canonical numeric IPv4 forms are rejected; only canonical dotted-quad literals are treated as IP addresses. (3.14.1) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.1)
- Missing Host headers now fall back to the local socket address or an empty string instead of reverse DNS. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)
- Redirects with consumed non-rewindable bodies now raise ClientPayloadError instead of sending an empty body. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)
- Cookies containing ASCII control characters are skipped instead of propagating CookieError. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)
- CookieJar.save now writes JSON format and protects saved files with restrictive permissions. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)
- Adds an API for encoding HTTP Basic Authentication credentials. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)
- Outbound status lines and headers now reject all forbidden ASCII control characters with ValueError. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)
- Python 3.9 is no longer supported. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)
- Pure-Python request header validation now follows RFC 9110 control-character handling while response parsing remains lax. (3.13.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4)
- The C extension parser now rejects duplicate singleton headers, matching the pure Python parser and preventing parser-differential access-control bypasses. (3.13.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4)
- Malformed chunked transfer encoding now raises TransferEncodingError instead of hanging indefinitely. (3.13.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4)
- Brotli minimum version is now 1.2. (3.13.3) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.3)
- brotlicffi minimum version is now 1.2. (3.13.3) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.3)
- Decompression now defaults to a maximum output size of 32MiB per decompress call. (3.13.3) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.3)
- Python versions below 3.14 now require backports.zstd instead of zstandard for zstd support. (3.13.1) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.1)

### Security

- The web server no longer trusts the scheme supplied in an absolute-form request target. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Discarded data after a WebSocket frame protocol error no longer grows without bound; read_bufsize also bounds pre-reader data. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Reduces CPU consumption and rejects large numbers of concatenated compressed members. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Secure shared cookies are no longer sent over unencrypted connections. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Secure per-request cookies are now sent to origins configured as treat_as_secure_origin. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Prevents integer overflow when processing messages that are too large. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Each Set-Cookie header now creates one cookie and ignores unrecognized attributes, preventing attacker-controlled cookie-object growth. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Rejects a new data frame inserted between fragments of an in-progress message as a protocol error. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response) (3.14.3) — [security advisory](https://github.com/advisories/GHSA-CQ5V-8Q36-5273)
- AIOHTTP: HTTP request smuggling via WebSocket upgrade (3.14.2) — [security advisory](https://github.com/advisories/GHSA-MFX4-HV73-Q22V)
- AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate (3.14.2) — [security advisory](https://github.com/advisories/GHSA-MQ44-7P77-Q5H7)
- The Python parser now rejects a bare LF in the request line. (3.14.2) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2)
- aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines (3.14.1) — [security advisory](https://github.com/advisories/GHSA-63HW-FMQ6-XXG2), [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.1)
- aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges (3.14.1) — [security advisory](https://github.com/advisories/GHSA-HPJ7-WQ8M-9HGP)
- aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence (3.14.1) — [security advisory](https://github.com/advisories/GHSA-2FQR-MR3J-6WP8)
- aiohttp: HTTP/1 Pipelined Requests Queue Without Limit (3.14.1) — [security advisory](https://github.com/advisories/GHSA-4FVR-RGM6-GQMC)
- aiohttp: Incomplete websocket frame payloads bypass memory limits (3.14.1) — [security advisory](https://github.com/advisories/GHSA-XCGM-R5H9-7989)
- aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect (3.14.1) — [security advisory](https://github.com/advisories/GHSA-9X8Q-7H8H-WCW9), [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.1)
- aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections (3.14.1) — [security advisory](https://github.com/advisories/GHSA-4M7W-QMGQ-4WJ5), [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.1)
- aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup (3.14.1) — [security advisory](https://github.com/advisories/GHSA-G3CQ-J2XW-WF74)
- Persisted cookies retain the host-only flag, keeping cookies without Domain scoped to their exact host after reload. (3.14.1) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.1)
- Digest credentials are scoped to the first request origin, preventing credentials from being used for unrelated redirect origins. (3.14.1) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.1)
- The pure-Python HTTP parser now enforces max_line_size when a complete chunk-size line arrives in one read. (3.14.1) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.1)
- Parsed but unhandled pipelined requests are bounded per connection, preventing unbounded server backlog while one handler is busy. (3.14.1) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.1)
- aiohttp: CRLF injection in multipart headers (3.14.0) — [security advisory](https://github.com/advisories/GHSA-M6QW-4CW2-HM4M)
- AIOHTTP is vulnerable to cross-origin redirect with per-request cookies (3.14.0) — [security advisory](https://github.com/advisories/GHSA-HG6J-4RV6-33PG)
- AIOHTTP is Vulnerable to Deserialization of Untrusted Data (3.14.0) — [security advisory](https://github.com/advisories/GHSA-JG22-MG44-37J8)
- Highly compressed valid payloads are decompressed safely in chunks of 256+ KiB. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)
- Saved cookie files now use 0x600 permissions to limit access by other users. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)
- AIOHTTP accepts duplicate Host headers (3.13.4) — [security advisory](https://github.com/advisories/GHSA-C427-H43C-VF67)
- AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector (3.13.4) — [security advisory](https://github.com/advisories/GHSA-HCC4-C3V8-RX92)
- AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows (3.13.4) — [security advisory](https://github.com/advisories/GHSA-P998-JP59-783M)
- aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage (3.13.4) — [security advisory](https://github.com/advisories/GHSA-W2FM-2CPV-W7V5)
- AIOHTTP has a Multipart Header Size Bypass (3.13.4) — [security advisory](https://github.com/advisories/GHSA-M5QP-6W8W-W647)
- AIOHTTP has CRLF injection through multipart part content type header construction (3.13.4) — [security advisory](https://github.com/advisories/GHSA-2VRM-GR82-F7M5)
- AIOHTTP has HTTP response splitting via \r in reason phrase (3.13.4) — [security advisory](https://github.com/advisories/GHSA-MWH4-6H8G-PG8W)
- AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS (3.13.4) — [security advisory](https://github.com/advisories/GHSA-3WQ7-RQQ7-WX6J)
- AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect (3.13.4) — [security advisory](https://github.com/advisories/GHSA-966J-VMVW-G2G9)
- AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass (3.13.4) — [security advisory](https://github.com/advisories/GHSA-63HF-3VF5-4WQF)
- AIOHTTP has unicode match groups in regexes for ASCII protocol elements (3.13.3) — [security advisory](https://github.com/advisories/GHSA-MQQC-3GQH-H2X8)
- AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb (3.13.3) — [security advisory](https://github.com/advisories/GHSA-6MQ8-RVHQ-8WGG)
- AIOHTTP's unicode processing of header values could cause parsing discrepancies (3.13.3) — [security advisory](https://github.com/advisories/GHSA-69F9-5GXW-WVC2)
- AIOHTTP vulnerable to brute-force leak of internal static file path components (3.13.3) — [security advisory](https://github.com/advisories/GHSA-54JQ-C3M8-4M76)
- AIOHTTP Vulnerable to Cookie Parser Warning Storm (3.13.3) — [security advisory](https://github.com/advisories/GHSA-FH55-R93G-J68G)
- AIOHTTP vulnerable to denial of service through large payloads (3.13.3) — [security advisory](https://github.com/advisories/GHSA-6JHG-HG63-JVVF)
- AIOHTTP vulnerable to DoS through chunked messages (3.13.3) — [security advisory](https://github.com/advisories/GHSA-G84X-MCQJ-X9QQ)
- AIOHTTP vulnerable to DoS when bypassing asserts (3.13.3) — [security advisory](https://github.com/advisories/GHSA-JJ3X-WXRX-4X23)
- The parser now raises an exception for a continuation frame without an initial frame in context. (3.13.3) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.3)

### Deprecations

- Deprecated in favor of aiohttp.UploadTracker. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Deprecated in favor of aiohttp.UploadTracker. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- The built-in pytest plugin is deprecated; projects should switch to pytest-aiohttp. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)
- BasicAuth is deprecated; use encode_basic_auth with an Authorization header. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)

### New APIs and options

- Custom writers must invoke on_body_write with each accepted body chunk length or Payload.bytes_written remains zero. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Adds constants for widely used browser, tracing, security, caching, RFC, proxy, and application headers. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Adds an API for observing client request upload progress. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Adds a cap on form fields accepted by BaseRequest.post; the default is 1000 and 0 disables the cap. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Adds access to the response output size. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)
- Adds access to whether response upload completion has occurred. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)
- Exposes stored cookies and their full attributes through a read-only property. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)
- Exposes host-only cookie state through a read-only property. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)
- Allows WebSocket TEXT messages to be received as raw bytes for direct use with high-performance JSON parsers. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)
- Adds a response helper for bytes-returning JSON serialization. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)
- Adds an explicit type for bytes-returning JSON serializers. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)
- Adds a payload type for bytes-returning JSON serialization. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)
- Adds statically typed request context storage keys, matching AppKey behavior. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)
- Adds statically typed response context storage keys, matching AppKey behavior. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)
- Exposes the dynamically allocated TCP port. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)
- Added an async generator for non-blocking decompression of large multipart payloads. (3.13.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4)
- Added a TCPConnector parameter to limit the DNS cache size. (3.13.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4)
- Added a parameter to limit the number of headers read from a response. (3.13.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4)
- AppRunner configuration options are now also available when using run_app(). (3.13.1) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.1)

### Performance

- Uses spooled temporary files to reduce the number of file descriptors required. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Fixes excessive memory consumption for small WebSocket messages. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Bounds per-read overhead while reassembling fragmented WebSocket frames. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)

### Behavior and default changes

- Cookie parsing, storage, and generated Cookie headers are bounded with Firefox-style eviction. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Cleanup contexts may now be asynchronous context managers; legacy single-yield generators remain supported. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)
- CookieJar.load tries JSON first and falls back to a restricted pickle unpickler. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)
- Compressed payloads now run asynchronously by default because the default threshold changed. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)
- Response parsing in lax mode now skips duplicate singleton header checks; strict mode continues enforcing RFC 9110 singletons. (3.13.5) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.5)
- Multipart processing chunks increased from 64 KiB to 256KiB to better match aiohttp internals. (3.13.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4)

### Tooling

- An installable pure-Python wheel is published for platforms without a working compiler or matching binary wheel. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Wheels are now available for Android and iOS platforms. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)

### Fixes and other changes

- WebSocket connections no longer fail when control frames have RSV1 set after permessage-deflate negotiation. (3.14.5) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.5)
- Domain routing now handles Host ports and uppercase wildcard domains correctly. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Using keepalive_timeout=None no longer crashes on the second request to the same host. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Accepts range units without regard to letter case. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Multipart parts with Content-Length 0 now immediately yield an empty chunk. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Prevents a segmentation fault on Python 3.12 and newer when decompression errors occur while draining data. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Header values now have trailing whitespace stripped consistently with the pure-Python parser and RFC 9110. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Stops the parser from raising ClientPayloadError when a complete Content-Length body is pending completion. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Cancelled or failed requests waiting for 100 Continue no longer leave corrupted connections eligible for reuse. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Mixed-case encoding values such as Gzip are accepted and decompressed correctly. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Copies mutable Morsel objects supplied by callers. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Prevents possible event loop state corruption on Python 3.12 and newer. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- The pure-Python request parser now reads a body in HEAD requests. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Requests behind declined upgrades no longer remain unanswered or get served more than once. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Internally retried requests no longer send truncated bodies when request data is a file object. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Fixes overlapping slots and broken slots inheritance affecting request handling and response classes. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Finds multibyte separators split across chunks without returning data past the separator. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Accepts compressed data frames when a control frame arrives before the first data frame. (3.14.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4)
- Redirects crossing an origin no longer drop all but the first Authorization, Cookie, or Proxy-Authorization header. (3.14.3) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.3)
- The client now closes cleanly after an exception. (3.14.2) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2)
- Optional whitespace in Content-Disposition headers is parsed correctly. (3.14.2) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2)
- Unknown charsets in extended multipart parameters no longer escape parsing as LookupError or UnicodeDecodeError. (3.14.2) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2)
- An empty authentication domain no longer raises IndexError. (3.14.2) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2)
- Digest challenges remain valid when WWW-Authenticate offers multiple schemes. (3.14.2) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2)
- Digest authentication escaping now handles backslashes in challenge values. (3.14.2) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2)
- Control frames no longer break fragmented WebSocket messages. (3.14.2) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2)
- The worker no longer endlessly reloads when application startup fails. (3.14.2) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2)
- The C parser now recognizes newer HTTP methods such as QUERY. (3.14.2) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2)
- The pure-Python HTTP parser no longer raises IndexError for affected input. (3.14.2) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2)
- Datetime values with fractional seconds are no longer rounded down incorrectly. (3.14.2) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2)
- Windows resolution falls back without AI_ADDRCONFIG when the first lookup fails. (3.14.2) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2)
- The C parser no longer folds a fragment into the query string when the query is empty. (3.14.2) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2)
- Empty header parameter values no longer raise IndexError. (3.14.2) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2)
- Optional whitespace around the disposition type is accepted before token validation. (3.14.2) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2)
- The client no longer decompresses WebSocket frames when compression was not negotiated. (3.14.2) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2)
- Request method handling now has consistent case sensitivity. (3.14.2) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2)
- Read timeouts are no longer left pending on idle pooled keep-alive connections. (3.14.2) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2)
- Request bodies are now read when WebSocket upgrades are rejected. (3.14.2) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2)
- CancelledError now closes the associated connection. (3.14.1) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.1)
- Absolute expiration deadlines are persisted, so reloaded cookies keep their original lifetime. (3.14.1) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.1)
- Closing during in-flight DNS resolution now raises ClientConnectionError instead of AttributeError. (3.14.1) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.1)
- WebSocket parser validation was tightened. (3.14.1) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.1)
- Digest signatures now use the encoded request-target sent on the wire. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)
- Inbound data resets the heartbeat timer, preventing false ping/pong timeouts during large frames. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)
- Concatenated gzip and deflate members are now fully decompressed using fresh decompressors. (3.14.0) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.14.0)
- Access log timestamps now reflect daylight saving time transitions. (3.13.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4)
- Fixed the running-event-loop error when using this worker on Python 3.14 and newer. (3.13.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4)
- Fixed the running-event-loop error when using this worker on Python 3.14 and newer. (3.13.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4)
- Restored decode as a synchronous method for backward compatibility after it was changed to async in 3.13.3. (3.13.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4)
- Accessing os_error no longer raises AttributeError. (3.13.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4)
- ClientTimeout(total=0) no longer raises ValueError when creating a TLS connection. (3.13.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4)
- The pure-Python request parser now splits comma-separated and repeated Connection values for keep-alive, close, and upgrade handling. (3.13.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4)
- Digest authentication now preserves challenge fields whose values are empty strings. (3.13.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4)
- Passing enable_cleanup_closed to TCPConnector on Python 3.12.7 no longer emits a false-positive DeprecationWarning. (3.13.4) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4)
- Multipart reading no longer fails when it encounters an empty body part. (3.13.3) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.3)
- Proxy authorization headers are now passed when reusing a connection, preventing 407 errors. (3.13.3) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.3)
- Continues parsing subsequent cookies after a malformed cookie fails regex validation. (3.13.2) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.2)
- Makes compressed sends cancellation safe by shielding compression and preserving compressor state. (3.13.2) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.2)
- Routing to a sub-application added with add_domain() now works when the parent app has the same path. (3.13.1) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.1)
- Invalid Content-Type syntax now produces application/octet-stream. (3.13.1) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.1)
- netrc file lookup no longer performs blocking I/O in the event loop. (3.13.1) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.1)
- Python 3.14 now works when aiohttp is built without zstd support. (3.13.1) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.1)
- Decompression is fixed for chunked zstd streams. (3.13.1) — [release notes](https://github.com/aio-libs/aiohttp/releases/tag/v3.13.1)