fix: refresh nested uv.lock aiohttp pins for CVE-2026-59881/69243 (POT-2180)

[shmbhvi101]

Vulnerability details

• Vulnerability IDs: CVE-2026-59881, CVE-2026-69243
• Affected repo: potpie-ai/potpie
• Affected package: aiohttp (pip)
• Vulnerable range: <= 3.14.1
• Fixed version: >= 3.14.2 (locks resolve to 3.14.3)
• Severity: Medium
• Dependabot advisories: Update api key fetch logic #360, Support mermaid diagrams [UI] #361, Add empty string validation in search schema #363, Updating UI to latest commit #364, Issue with redirections #365, Custom Querying Knowledge Graph #366
• Linear: https://linear.app/potpie/issue/POT-2180

Why this PR

#1039 already raised aiohttp floors to >=3.14.2 in pyproject.toml and the root uv.lock. The standalone Dependabot/dependency-graph locks under potpie/context-engine/uv.lock and potpie/sandbox/uv.lock still pinned aiohttp==3.14.1, so Medium Vanta findings remained open.

Fix summary

• potpie/context-engine/uv.lock: constraint >=3.14.1 → >=3.14.2; package 3.14.1 → 3.14.3
• potpie/sandbox/uv.lock: same

Validation

• Confirmed no aiohttp 3.14.0/3.14.1 pins remain in any uv.lock
• uv lock --check passes on root
• Runtime: installed aiohttp==3.14.3 (>=3.14.2)
• pytest tests/unit: 1091 passed

Review

Please review: @yashkrishan
(Automated review request via GitHub API returned 403 for this integration token.)

Resolves POT-2180 (leave open until Vanta clears).

Linear note

Linear MCP auth is unavailable in this cloud agent environment, so the issue could not be moved to In Progress or commented on automatically. Please authenticate Linear MCP / add LINEAR_API_KEY, then comment with this PR URL: #1040

Linear Issue: POT-2180

  

[linear-code]

POT-2180

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (2)

• potpie/context-engine/uv.lock is excluded by !**/*.lock
• potpie/sandbox/uv.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Repository UI (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c924bdf6-1fd4-48d5-808d-9715733f6033

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[shmbhvi101]

Conflicts with main are resolved by merging #1038’s nested lock refresh.

Net result: this branch now matches main for potpie/context-engine/uv.lock and potpie/sandbox/uv.lock (aiohttp 3.14.3, constraint >=3.14.3). There is no remaining file delta vs main — #1038 already landed the Dependabot/Vanta remediation this PR targeted (POT-2180 / CVE-2026-59881 / CVE-2026-69243).

Recommend closing as superseded by #1038 rather than merging an empty change set.