DO NOT MERGE: Test adding vulnerability to pyproject but not uv.lock

[sumau]

Test adding vulnerability to pyproject.yaml but not to uv.lock file. Dependency review flags PR but not Datadog.

[github-actions]

Dependency Review

The following issues were found:

• ❌ 1 vulnerable package(s)

See the Details below.

Vulnerabilities

pyproject.toml

Name	Version	Vulnerability	Severity
aiohttp	3.7.0	AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb	high
		aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests	high
		aiohttp is vulnerable to directory traversal	high
		AIOHTTP vulnerable to DoS when bypassing asserts	moderate
		AIOHTTP vulnerable to denial of service through large payloads	moderate
		AIOHTTP vulnerable to DoS through chunked messages	moderate
		aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage	moderate
		AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows	moderate
		AIOHTTP has a Multipart Header Size Bypass	moderate
		AIOHTTP accepts duplicate Host headers	moderate
		AIOHTTP is Vulnerable to Deserialization of Untrusted Data	moderate
		AIOHTTP is vulnerable to cross-origin redirect with per-request cookies	moderate
		aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges	moderate
		aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines	moderate
		aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup	moderate
		aiohttp: HTTP/1 Pipelined Requests Queue Without Limit	moderate
		aiohttp: Incomplete websocket frame payloads bypass memory limits	moderate
		aiohttp.web.Application vulnerable to HTTP request smuggling via llhttp HTTP request parser	moderate
		AIOHTTP has problems in HTTP parser (the python one, not llhttp)	moderate
		aiohttp has vulnerable dependency that is vulnerable to request smuggling	moderate
		aiohttp allows request smuggling due to incorrect parsing of chunk extensions	moderate
		aiohttp Cross-site Scripting vulnerability on index pages for static file handling	moderate
		aiohttp's ClientSession is vulnerable to CRLF injection via method	moderate
		aiohttp's ClientSession is vulnerable to CRLF injection via version	moderate
		aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators	moderate
		`aiohttp` Open Redirect vulnerability (`normalize_path_middleware` middleware)	low
		aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections	low
		aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect	low
		Aiohttp has inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` differing in C and Python fallbacks	low
		aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence	low
		aiohttp: CRLF injection in multipart headers	low
		AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass	low
		AIOHTTP has HTTP response splitting via \r in reason phrase	low
		AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect	low
		AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS	low
		AIOHTTP has CRLF injection through multipart part content type header construction	low
		AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector	low
		AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections	low
		AIOHTTP Vulnerable to Cookie Parser Warning Storm	low
		AIOHTTP's unicode processing of header values could cause parsing discrepancies	low
		AIOHTTP has unicode match groups in regexes for ASCII protocol elements	low
		AIOHTTP vulnerable to brute-force leak of internal static file path components	low

OpenSSF Scorecard

Package	Version	Score	Details
pip/aiohttp	3.7.0	🟢 7.1	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 4 Found 7/15 approved changesets -- score normalized to 4 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Security-Policy 🟢 10 security policy file detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Packaging 🟢 10 packaging workflow detected SAST 🟢 10 SAST tool is run on all commits Signed-Releases 🟢 6 4 out of the last 5 releases have a total of 4 signed artifacts.

Scanned Files

• pyproject.toml

[github-actions]

Your PR has commits that are missing the Signed-off-by trailer. This is likely due to the pre-commit hook not being configured on your local machine. The usual fix for this issue is to run pre-commit install --install-hooks --overwrite -t commit-msg -t pre-commit, however for more detailed help in setting up the pre-commit hooks, follow the instructions at https://github.com/uktrade/github-standards/blob/main/README.md#usage