Bump aiohttp from 3.9.5 to 3.10.0

[dependabot]

Bumps aiohttp from 3.9.5 to 3.10.0.

Release notes

Sourced from aiohttp's releases.

3.10.0

Bug fixes

• Fixed server response headers for Content-Type and Content-Encoding for static compressed files -- by :user:steverep.

  Server will now respond with a Content-Type appropriate for the compressed file (e.g. "application/gzip"), and omit the Content-Encoding header. Users should expect that most clients will no longer decompress such responses by default.

  Related issues and pull requests on GitHub: #4462.

• Fixed duplicate cookie expiration calls in the CookieJar implementation

  Related issues and pull requests on GitHub: #7784.

• Adjusted FileResponse to check file existence and access when preparing the response -- by :user:steverep.

  The :py:class:~aiohttp.web.FileResponse class was modified to respond with 403 Forbidden or 404 Not Found as appropriate. Previously, it would cause a server error if the path did not exist or could not be accessed. Checks for existence, non-regular files, and permissions were expected to be done in the route handler. For static routes, this now permits a compressed file to exist without its uncompressed variant and still be served. In addition, this changes the response status for files without read permission to 403, and for non-regular files from 404 to 403 for consistency.

  Related issues and pull requests on GitHub: #8182.

• Fixed AsyncResolver to match ThreadedResolver behavior -- by :user:bdraco.

  On system with IPv6 support, the :py:class:~aiohttp.resolver.AsyncResolver would not fallback to providing A records when AAAA records were not available. Additionally, unlike the :py:class:~aiohttp.resolver.ThreadedResolver, the :py:class:~aiohttp.resolver.AsyncResolver did not handle link-local addresses correctly.

... (truncated)

Changelog

Sourced from aiohttp's changelog.

3.10.0 (2024-07-30)

Bug fixes

• Fixed server response headers for Content-Type and Content-Encoding for static compressed files -- by :user:steverep.

  Server will now respond with a Content-Type appropriate for the compressed file (e.g. "application/gzip"), and omit the Content-Encoding header. Users should expect that most clients will no longer decompress such responses by default.

  Related issues and pull requests on GitHub: :issue:4462.

• Fixed duplicate cookie expiration calls in the CookieJar implementation

  Related issues and pull requests on GitHub: :issue:7784.

• Adjusted FileResponse to check file existence and access when preparing the response -- by :user:steverep.

  The :py:class:~aiohttp.web.FileResponse class was modified to respond with 403 Forbidden or 404 Not Found as appropriate. Previously, it would cause a server error if the path did not exist or could not be accessed. Checks for existence, non-regular files, and permissions were expected to be done in the route handler. For static routes, this now permits a compressed file to exist without its uncompressed variant and still be served. In addition, this changes the response status for files without read permission to 403, and for non-regular files from 404 to 403 for consistency.

  Related issues and pull requests on GitHub: :issue:8182.

• Fixed AsyncResolver to match ThreadedResolver behavior -- by :user:bdraco.

  On system with IPv6 support, the :py:class:~aiohttp.resolver.AsyncResolver would not fallback to providing A records when AAAA records were not available.

... (truncated)

Commits

• 7f29851 Release 3.10.0 (attempt 2) (#8552)
• fc201e8 Release 3.10.0 (#8550)
• 305f67a Release 3.10.0rc0 (#8545)
• ed8de3a [PR #8541/a561fa99 backport][3.10] Cleanup for #8495 (#8544)
• df57b9f [3.10] Handle 403 and 404 issues in FileResponse class (#8538) (#8539)
• 3baa6de [PR #8535/7108d646 backport][3.10] Small speed up to cookiejar filter_cookies...
• 5621ecf Bump pytest from 8.3.1 to 8.3.2 (#8536)
• 9b9cec2 Release 3.10.0b1 (#8533)
• 088f734 [3.10] Downgrade upload/download artifact to v3 to fix CI (#8532)
• 948a4c5 Release 3.10.0b0 (#8531)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #892.