[Security] Dependabot: aiohttp (LOW) - AIOHTTP: Secure attribute not enforced for shared cookie #417

Security Vulnerability Details

• Type: Dependabot Alert docs: update OpenWiki #393
• Package: aiohttp
• Severity: LOW
• Vulnerable Versions: <= 3.14.3
• Patched Version: 3.14.4
• Advisory IDs: GHSA-494j-54xm-rwp3 / CVE-2026-111063
• Alert URL: https://github.com/lgcorzo/mlops-python-package/security/dependabot/393

Summary

AIOHTTP: Secure attribute not enforced for shared cookie

Description

Summary

The Secure attribute was not being enforced for the shared cookie.

Impact

It may be possible to send a shared cookie marked Secure through an unencrypted request.

Remediation Steps

1. Upgrade aiohttp to version 3.14.4 or higher in project dependency specifications.
2. Run test suites and lockfile generation to ensure backwards compatibility.
3. Commit and deploy patched dependencies.

#jules