tj-python · pull · Jul 20, 2026 · Jun 7, 2026 · Jun 8, 2026 · Jun 8, 2026
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -121,7 +121,7 @@ repos:
     exclude: >-
       ^CHANGES\.rst$
 - repo: https://github.com/codespell-project/codespell
-  rev: v2.4.2
+  rev: v2.4.3
   hooks:
   - id: codespell
     additional_dependencies:

diff --git a/CHANGES.rst b/CHANGES.rst
@@ -10,6 +10,239 @@
 
 .. towncrier release notes start
 
+3.14.2 (2026-07-20)
+===================
+
+Bug fixes
+---------
+
+- Fixed :py:attr:`~aiohttp.web.StreamResponse.last_modified` rounding a
+  :class:`datetime.datetime` with a fractional second down.
+
+
+  *Related issues and pull requests on GitHub:*
+  :issue:`5303`.
+
+
+
+- Fixed resolving ``localhost`` on Windows to fall back without ``AI_ADDRCONFIG``
+  when the first lookup fails, so ``localhost`` still works without an active
+  network.
+
+
+  *Related issues and pull requests on GitHub:*
+  :issue:`5357`.
+
+
+
+- Rejected multipart body parts whose ``Content-Length`` header is not a
+  plain sequence of digits (e.g. ``+5``, ``-1``, ``1_0``), matching the
+  strictness of the main request parser per :rfc:`9110#section-8.6`
+  -- by :user:`dxbjavid`.
+
+
+  *Related issues and pull requests on GitHub:*
+  :issue:`12794`.
+
+
+
+- Fixed ``GunicornWebWorker`` endlessly reloading when app fails during startup -- by :user:`Dreamsorcerer`.
+
+
+  *Related issues and pull requests on GitHub:*
+  :issue:`12879`.
+
+
+
+- Fixed some inconsistent case sensitivity on request methods -- by :user:`Dreamsorcerer`.
+
+
+  *Related issues and pull requests on GitHub:*
+  :issue:`12931`.
+
+
+
+- Fixed ``IndexError: string index out of range`` in ``parse_content_disposition``
+  when a header parameter has an empty value (e.g. ``filename=``).
+  -- by :user:`JSap0914`.
+
+
+  *Related issues and pull requests on GitHub:*
+  :issue:`12948`.
+
+
+
+- Fixed the ``sock_read`` timeout being re-armed on a keep-alive connection after
+  it had been returned to the pool. An idle pooled connection could be left with a
+  pending read timeout that fired and poisoned it, so the next request reusing the
+  connection failed immediately with :exc:`aiohttp.SocketTimeoutError`. The read
+  timeout is now only rescheduled when resuming a transport that was actually
+  paused -- by :user:`daragok`.
+
+
+  *Related issues and pull requests on GitHub:*
+  :issue:`12953`, :issue:`12954`.
+
+
+
+- Fixed the client decompressing frames when ``permessage-deflate`` was not negotiated -- by :user:`Dreamsorcerer`.
+
+
+  *Related issues and pull requests on GitHub:*
+  :issue:`12976`.
+
+
+
+- Fixed ``DigestAuthMiddleware`` raising an ``IndexError`` on empty domain -- by :user:`Dreamsorcerer`.
+
+
+  *Related issues and pull requests on GitHub:*
+  :issue:`12983`.
+
+
+
+- Fixed :class:`~aiohttp.DigestAuthMiddleware` corrupting the ``Digest``
+  challenge when a ``WWW-Authenticate`` response offered more than one
+  authentication scheme -- by :user:`Dreamsorcerer`.
+
+
+  *Related issues and pull requests on GitHub:*
+  :issue:`12984`.
+
+
+
+- Fixed client not closing cleanly after an exception -- by :user:`Dreamsorcerer`.
+
+
+  *Related issues and pull requests on GitHub:*
+  :issue:`12985`.
+
+
+
+- Fixed control frames breaking fragmented WebSocket messages -- by :user:`arshsmith1`.
+
+
+  *Related issues and pull requests on GitHub:*
+  :issue:`12988`.
+
+
+
+- Fixed ``parse_content_disposition`` rejecting otherwise-valid
+  ``Content-Disposition`` header values that contain optional whitespace (OWS)
+  around the disposition type (e.g. ``"form-data ; name=\"field\""``).
+  The disposition type is now stripped before token validation, consistent with
+  how parameter keys are already handled -- by :user:`JSap0914`.
+
+
+  *Related issues and pull requests on GitHub:*
+  :issue:`12996`.
+
+
+
+- Fixed an :exc:`IndexError` in the pure-Python HTTP parser -- by :user:`Dreamsorcerer`.
+
+
+  *Related issues and pull requests on GitHub:*
+  :issue:`13001`.
+
+
+
+- Fixed parsing optional whitespace in Content-Disposition -- by :user:`Dreamsorcerer`.
+
+
+  *Related issues and pull requests on GitHub:*
+  :issue:`13002`.
+
+
+
+- Fixed request body not being read on rejected WebSocket upgrades -- by :user:`Dreamsorcerer`.
+
+
+  *Related issues and pull requests on GitHub:*
+  :issue:`13016`.
+
+
+
+- Fixed :exc:`LookupError` (and an unguarded :exc:`UnicodeDecodeError`) escaping
+  ``Content-Disposition`` parsing when a multipart part supplies an extended
+  parameter with an unknown charset
+  -- by :user:`arshsmith1`.
+
+
+  *Related issues and pull requests on GitHub:*
+  :issue:`13042`.
+
+
+
+- Fixed ``escape_quotes`` in the Digest authentication middleware not escaping
+  backslashes, so a ``WWW-Authenticate`` challenge value containing a backslash
+  could break out of its quoted-string in the generated ``Authorization`` header
+  -- by :user:`dxbjavid`.
+
+
+  *Related issues and pull requests on GitHub:*
+  :issue:`13054`.
+
+
+
+- Fixed Python parser not rejecting a bare ``LF`` in the request line -- by :user:`Dreamsorcerer`.
+
+
+  *Related issues and pull requests on GitHub:*
+  :issue:`13136`.
+
+
+
+- Fixed the C HTTP parser folding the fragment into the query string for an
+  origin-form request target with an empty query (e.g. ``/path?#frag``),
+  which diverged from the pure-Python parser -- by :user:`GiulioDER`.
+
+
+  *Related issues and pull requests on GitHub:*
+  :issue:`13171`.
+
+
+
+- Fixed the C parser reporting newer HTTP methods such as ``QUERY`` as ``<unknown>``;
+  the method table is now derived from the vendored llhttp instead of a hand-maintained count
+  -- by :user:`Dreamsorcerer`.
+
+
+  *Related issues and pull requests on GitHub:*
+  :issue:`13174`.
+
+
+
+
+Packaging updates and notes for downstreams
+-------------------------------------------
+
+- Upgraded ``llhttp`` to v9.4.2 -- by :user:`Dreamsorcerer`.
+
+
+  *Related issues and pull requests on GitHub:*
+  :issue:`12956`.
+
+
+
+
+Contributor-facing changes
+--------------------------
+
+- Added admin documentation on incident response and on running reproducer code
+  safely, covering security vulnerability handling and supply-chain, account, and
+  CI/infrastructure compromise -- by :user:`Dreamsorcerer`.
+
+
+  *Related issues and pull requests on GitHub:*
+  :issue:`12914`.
+
+
+
+
+----
+
+
 3.14.1 (2026-06-07)
 ===================
 

diff --git a/CHANGES/12794.bugfix.rst b/CHANGES/12794.bugfix.rst
diff --git a/CHANGES/12879.bugfix.rst b/CHANGES/12879.bugfix.rst
diff --git a/CHANGES/12914.contrib.rst b/CHANGES/12914.contrib.rst
diff --git a/CHANGES/12931.bugfix.rst b/CHANGES/12931.bugfix.rst
diff --git a/CHANGES/12948.bugfix.rst b/CHANGES/12948.bugfix.rst
diff --git a/CHANGES/12953.bugfix.rst b/CHANGES/12953.bugfix.rst
diff --git a/CHANGES/12954.bugfix.rst b/CHANGES/12954.bugfix.rst
diff --git a/CHANGES/12956.packaging.rst b/CHANGES/12956.packaging.rst
diff --git a/CHANGES/12976.bugfix.rst b/CHANGES/12976.bugfix.rst
diff --git a/CHANGES/12983.bugfix.rst b/CHANGES/12983.bugfix.rst
diff --git a/CHANGES/12984.bugfix.rst b/CHANGES/12984.bugfix.rst
diff --git a/CHANGES/12985.bugfix.rst b/CHANGES/12985.bugfix.rst
diff --git a/CHANGES/12988.bugfix.rst b/CHANGES/12988.bugfix.rst
diff --git a/CHANGES/12996.bugfix.rst b/CHANGES/12996.bugfix.rst
diff --git a/CHANGES/13001.bugfix.rst b/CHANGES/13001.bugfix.rst
diff --git a/CHANGES/13002.bugfix.rst b/CHANGES/13002.bugfix.rst
diff --git a/CHANGES/13016.bugfix.rst b/CHANGES/13016.bugfix.rst
diff --git a/CHANGES/13042.bugfix.rst b/CHANGES/13042.bugfix.rst
diff --git a/CHANGES/13054.bugfix.rst b/CHANGES/13054.bugfix.rst
diff --git a/CHANGES/13136.bugfix.rst b/CHANGES/13136.bugfix.rst
diff --git a/CHANGES/13171.bugfix.rst b/CHANGES/13171.bugfix.rst
diff --git a/CHANGES/13174.bugfix.rst b/CHANGES/13174.bugfix.rst
diff --git a/CHANGES/13180.bugfix.rst b/CHANGES/13180.bugfix.rst
@@ -0,0 +1,2 @@
+Fixed the client dropping only the first ``Authorization``, ``Cookie`` and
+``Proxy-Authorization`` header when a redirect crosses an origin -- by :user:`arshsmith1`.
diff --git a/CHANGES/5303.bugfix.rst b/CHANGES/5303.bugfix.rst
diff --git a/CHANGES/5357.bugfix.rst b/CHANGES/5357.bugfix.rst
diff --git a/aiohttp/client.py b/aiohttp/client.py
@@ -837,9 +837,9 @@ async def _request(
 
                         if url.origin() != redirect_origin:
                             cookies = None
-                            headers.pop(hdrs.AUTHORIZATION, None)
-                            headers.pop(hdrs.COOKIE, None)
-                            headers.pop(hdrs.PROXY_AUTHORIZATION, None)
+                            headers.popall(hdrs.AUTHORIZATION, None)
+                            headers.popall(hdrs.COOKIE, None)
+                            headers.popall(hdrs.PROXY_AUTHORIZATION, None)
 
                         url = parsed_redirect_url
                         params = {}
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		Fixed the client dropping only the first ``Authorization``, ``Cookie`` and
		``Proxy-Authorization`` header when a redirect crosses an origin -- by :user:`arshsmith1`.