{"package":"aiohttp","ecosystem":"pypi","latest_version":"3.14.3","description":"Async http client/server framework (asyncio)","license":"Apache-2.0 AND MIT","license_risk":"permissive","commercial_use_notes":"Permissive: commercial closed-source use OK; preserve the copyright notice.","homepage":"https://pypi.org/project/aiohttp/","repository":"https://github.com/aio-libs/aiohttp","downloads_weekly":104978966,"health":{"score":88,"risk":"low","breakdown":{"maintenance":20,"popularity":20,"security":25,"maturity":15,"community":8,"popularity_floor":0},"deprecated":false,"max_score":100},"vulnerabilities":{"count":0,"critical":0,"high":0,"medium":0,"low":0,"details":[]},"versions":{"latest":"3.14.3","total_count":312,"recent":["3.12.8","3.12.9","3.12.10","3.12.11","3.12.12","3.12.13","3.12.14","3.12.15","3.13.0","3.13.1","3.13.2","3.13.3","3.13.4","3.13.5","3.14.0","3.14.1","3.14.2","3.14.3","4.0.0a0","4.0.0a1"]},"metadata":{"deprecated":false,"deprecated_message":null,"maintainers_count":0,"first_published":null,"last_published":"2026-07-23T01:52:08.217234Z","dependencies_count":13,"dependencies":["aiohappyeyeballs>=2.5.0","aiosignal>=1.4.0","async-timeout<6.0,>=4.0; python_version < \"3.11\"","attrs>=17.3.0","frozenlist>=1.1.1","multidict<7.0,>=4.5","propcache>=0.2.0","typing_extensions>=4.4; python_version < \"3.13\"","yarl<2.0,>=1.17.0","aiodns>=3.3.0; (sys_platform != \"android\" and sys_platform != \"ios\") and extra == \"speedups\"","Brotli>=1.2; (platform_python_implementation == \"CPython\" and sys_platform != \"android\" and sys_platform != \"ios\") and extra == \"speedups\"","brotlicffi>=1.2; platform_python_implementation != \"CPython\" and extra == \"speedups\"","backports.zstd; (platform_python_implementation == \"CPython\" and python_version < \"3.14\" and sys_platform != \"android\" and sys_platform != \"ios\") and extra == \"speedups\""]},"github_stats":{"stars":16427,"forks":2260,"open_issues":281,"is_archived":false,"pushed_at":"2026-04-30T13:37:11+00:00"},"bundle":null,"typescript":null,"known_issues":{"bugs_count":88,"bugs_severity":{"high":3,"medium":68,"low":17},"status_breakdown":{"fixed":88},"link":"/api/bugs/pypi/aiohttp?version=3.14.3","scope":"version","details":[{"title":"AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)","severity":"high","status":"fixed","affected_version":null,"fixed_version":"3.14.3","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273"},{"title":"AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb","severity":"high","status":"fixed","affected_version":null,"fixed_version":"3.13.3","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6mq8-rvhq-8wgg"},{"title":"aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests","severity":"high","status":"fixed","affected_version":null,"fixed_version":"3.9.4","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5m98-qgg9-wh84"},{"title":"AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate","severity":"medium","status":"fixed","affected_version":null,"fixed_version":"3.14.2","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mq44-7p77-q5h7"},{"title":"AIOHTTP: HTTP request smuggling via WebSocket upgrade","severity":"medium","status":"fixed","affected_version":null,"fixed_version":"3.14.2","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v"}]},"historical_compromise":null,"recommendation":{"action":"safe_to_use","issues":[],"use_version":"3.14.3","version_hint":null,"summary":"aiohttp@3.14.3 is safe to use (health: 88/100)"},"version_scoped":null,"_meta":{"endpoint":"check","tier":"full","philosophy":"DepScope is free. Use the cheapest endpoint that answers your real question.","cheaper_alternatives":[{"endpoint":"/api/exists/pypi/aiohttp","tokens_estimated":12,"use_when":"you only need to know if the package exists (hallucination guard)"},{"endpoint":"/api/health/pypi/aiohttp","tokens_estimated":80,"use_when":"you only need a 0-100 score for go/no-go (>=70 = safe)"},{"endpoint":"/api/prompt/pypi/aiohttp","tokens_estimated":280,"use_when":"you want a plain-text LLM-friendly brief instead of JSON"},{"endpoint":"POST /api/check_bulk","tokens_estimated":60,"use_when":"you have 5+ packages to check; sends one round-trip instead of N"}],"docs":"https://depscope.dev/integrate","hint_bulk":"You've called /api/check 73 times in 60s. Save bandwidth + tokens with POST /api/check_bulk (1 round-trip for N pkgs)."},"requested_version":null,"_cache":"hit","_response_ms":7,"_powered_by":"depscope.dev — free package intelligence for AI agents","typosquat":{"is_suspected":false},"maintainer_trust":{"available":true,"bus_factor_3m":21,"active_contributors_12m":21,"primary_author_ratio":0.47,"owner_account_age_days":4415,"is_archived":false,"stars":16420,"alerts":[]},"malicious":{"is_malicious":false},"scorecard":{"available":true,"score":6.7,"tier":"moderate"},"quality":{"available":true,"criticality_score":0.775,"criticality_tier":"critical","velocity_pct":-64.4,"velocity_trend":"rapid_decline","publish_security":"api_token"},"co_used_with":[{"package":"manifold3d","occurrences":7}],"version_history_summary":{"total_versions":20,"first_release_age_days":4692,"last_release_days_ago":39,"avg_days_between_releases":247,"release_velocity":"active"}}