fix(deps): require patched aiohttp on Python 3.10+

[jbeckwith-oai]

Summary

• require aiohttp>=3.14.1 for the optional aiohttp backend
• limit the aiohttp backend and httpx-aiohttp bridge to Python 3.10+, while preserving core SDK support for Python 3.9
• raise a clear runtime error and skip only the unsupported aiohttp test variants on Python 3.9
• regenerate uv.lock, requirements.lock, and requirements-dev.lock so no vulnerable aiohttp 3.13.x version remains
• document the Python 3.10+ requirement

Context

The repository has 11 open Dependabot alerts for aiohttp (7 moderate, 4 low). They share the same root cause: the universal lockfile retained aiohttp 3.13.5 for Python 3.9 even though Python 3.10+ already resolved to the patched 3.14.1 release.

The first version patched for every open advisory is aiohttp 3.14.1, which requires Python 3.10+. Applying that minimum unconditionally would make the entire SDK's optional dependency set unsatisfiable on Python 3.9. This change instead narrows only the aiohttp backend, keeping the core SDK installable on Python 3.9.

User impact and tradeoffs

• Core SDK support remains Python 3.9+.
• The optional aiohttp backend now requires Python 3.10+.
• On Python 3.9, installing openai[aiohttp] remains possible, but the backend dependencies are omitted and DefaultAioHttpClient() raises a targeted version error.
• Python 3.9 development lockfiles no longer install aiohttp, so generated aiohttp test variants are skipped there.
• Refreshing uv.lock also synchronizes the already-declared Bedrock extra and current package version, which were absent/stale in the previous lockfile.

Validation

• ./scripts/lint — passed (Ruff, Pyright, MyPy)
• pytest -q tests/test_client.py tests/test_module_client.py — 196 passed
• Python 3.9 runtime guard — verified
• clean Python 3.13 install of .[aiohttp] — resolved and ran with aiohttp 3.14.1
• rye build — passed; wheel metadata contains the Python 3.10+ markers and aiohttp 3.14.1 minimum
• repository audit — no aiohttp 3.13.x references remain
• GitHub CI — all checks passed, including the full test suite, lint/type checks, CodeQL, breaking-change detection, and Agents SDK integration type checks

The local full test harness could not fetch its Steady OpenAPI spec because that host is blocked in the execution environment; the complete GitHub CI suite passed on commit 782a1efd.

OkTest baseline note

The ready-for-review OkTest run reported 234/237 passing. Its three failures are confined to responses-input-items-list.test.ts and responses-input-items-options.test.ts, where the current SDK returns the newly generated prompt_cache_breakpoint: null field. This is not introduced by this PR: the current base PR (#3514) and the v2.46.0 release PR (#3501) produced the same 234/237 result in the same test files against the same OkTest revision.

[openai-sdks]

OkTest Summary

❌ 234/237 SDK tests passed in 13.366s for Python SDK PR #3515.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	233ms
tests/chat-completions-create.test.ts	✅ Passed	303ms
tests/chat-completions-stream.test.ts	✅ Passed	172ms
tests/files-content-binary.test.ts	✅ Passed	219ms
tests/files-create-multipart.test.ts	✅ Passed	175ms
tests/files-list-pagination.test.ts	✅ Passed	206ms
tests/initialize-config.test.ts	✅ Passed	237ms
tests/instance-isolation.test.ts	✅ Passed	223ms
tests/models-list.test.ts	✅ Passed	199ms
tests/responses-background-lifecycle.test.ts	✅ Passed	278ms
tests/responses-body-method-errors.test.ts	✅ Passed	441ms
tests/responses-cancel-timeout.test.ts	✅ Passed	219ms
tests/responses-cancel.test.ts	✅ Passed	366ms
tests/responses-compact-retries.test.ts	✅ Passed	425ms
tests/responses-compact.test.ts	✅ Passed	313ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	160ms
tests/responses-create-advanced.test.ts	✅ Passed	228ms
tests/responses-create-disconnect.test.ts	✅ Passed	1.699s
tests/responses-create-errors.test.ts	✅ Passed	316ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	443ms
tests/responses-create-retries.test.ts	✅ Passed	321ms
tests/responses-create-stream-failures.test.ts	✅ Passed	167ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	263ms
tests/responses-create-stream-wire.test.ts	✅ Passed	4.37s
tests/responses-create-stream.test.ts	✅ Passed	124ms
tests/responses-create-terminal-states.test.ts	✅ Passed	323ms
tests/responses-create-timeout.test.ts	✅ Passed	217ms
tests/responses-create.test.ts	✅ Passed	376ms
tests/responses-delete.test.ts	✅ Passed	303ms
tests/responses-input-items-errors.test.ts	✅ Passed	390ms
tests/responses-input-items-list.test.ts	❌ Failed	395ms
tests/responses-input-items-options.test.ts	❌ Failed	451ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	271ms
tests/responses-input-tokens-count.test.ts	✅ Passed	302ms
tests/responses-malformed-inputs.test.ts	✅ Passed	3.442s
tests/responses-not-found-errors.test.ts	✅ Passed	349ms
tests/responses-parse.test.ts	✅ Passed	500ms
tests/responses-retrieve-retries.test.ts	✅ Passed	331ms
tests/responses-retrieve.test.ts	✅ Passed	244ms
tests/responses-stored-method-errors.test.ts	✅ Passed	896ms
tests/retry-behavior.test.ts	✅ Passed	3.307s
tests/sdk-error-shape.test.ts	✅ Passed	400ms

View OkTest run #29610486960

_{SDK merge (a6f52565f431) · head (782a1efd3f17) · base (b140f45c2c18) · OkTest (fd7a761c81c1)}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 782a1efd3f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Exercise aiohttp on a supported CI interpreter

The sole test job in .github/workflows/ci.yml bootstraps the repository's .python-version (3.9.18), so this condition now skips every {"http_client": "aiohttp"} test variant in CI. Consequently, neither DefaultAioHttpClient nor the newly required aiohttp 3.14.1/httpx-aiohttp combination is exercised by the automated suite; add a Python 3.10+ test job, or otherwise run these variants on a supported interpreter.

Useful? React with 👍 / 👎.

[HAYDEN-OAI]

looks good, thanks for keeping the core sdk installable on python 3.9 while constraining the aiohttp backend and cleaning up the locks.