[katsugtgz]

Updates aiohttp to address PYSEC-2026-3545, GHSA-5wr8-gcqf-gqf3, GHSA-2g87-pp6c-29x5, GHSA-494j-54xm-rwp3, and GHSA-cq5v-8q36-5273.

Evidence:

• requirements.txt (the uv pip compile pyproject.toml output) referenced aiohttp@3.14.2
• osv-scanner reported those five IDs for aiohttp 3.14.2 before the update
• updated versions: aiohttp==3.14.4 and yarl==1.25.1 (aiohttp 3.14.4 requires yarl>=1.25.1,<2.0, so the yarl pin moves with it)

Validation:

• osv-scanner reports no remaining advisory for aiohttp, and no new advisories were introduced
• the CI command pair pip install -e ".[dev]" then pytest tests/ -v --tb=short passes: 182 passed on Python 3.11
• pip install -r requirements.txt resolves and installs cleanly on Python 3.12

Note: on Python 3.11 the pre-update requirements.txt already fails to resolve, because it pins numpy==2.5.1 (Python >= 3.12) while pyproject.toml declares requires-python = ">=3.11". This PR does not change that; a fresh uv pip compile pass may be worth a separate look.

Scope: dependency pin update only in the generated requirements.txt.