aiohttp breaking changes

3.14.4

22 breaking changes, first published October 5, 2026.

• Behavior changed AbstractStreamWriter
  The internal writer proxy was removed; custom AbstractStreamWriter implementations must invoke on_body_write or Payload.bytes_written reports 0. github.com
• Behavior changed aiohttp.web.BaseRequest.post
  Form bodies with more than 1000 fields are rejected with 413 unless the new client_max_fields limit on Application is raised; 0 disables it. github.com
• Behavior changed CookieJar
  Each Set-Cookie header sets one cookie; later name=value pairs and unknown attributes no longer create extra cookies, and $Path and $Domain are ignored. github.com
• Behavior changed DummyCookieJar
  DummyCookieJar and CookieJar in safe mode for IP origins no longer parse Set-Cookie headers at all. github.com
• Behavior changed WebSocketReader
  Code creating a WebSocketReader directly and passing it to set_parser() must keep its own strong reference or frames may be lost. github.com
• Configuration changed
  Test tooling only; pytest minversion is now 8.4 and xdist and coverage are enabled by default. github.com
• Configuration changed
  Users must install yarl 1.25.1 or later. github.com
• Configuration changed
  Built distributions carry License-Expression instead of License; the build needs setuptools 77.0 or newer. github.com
• Signature changed aiohttp.abc.AbstractCookieJar.host_only_cookies
  Was host_only_cookies: frozenset[tuple[str, str]]; now host_only_cookies: frozenset[tuple[str, str, str]]. pypi.org
• Signature changed aiohttp.abc.Application.__init__
  Was def __init__(self, *, logger: logging.Logger = web_logger, router: UrlDispatcher | None = None, middlewares: Iterable[Middleware] = (), handler_args: Mapping[str, Any] | None = None, client_max_size: int = 1024 ** 2, loop... pypi.org

And 12 more in this version.

3.14.2

4 breaking changes, first published July 20, 2026.

• Removed aiohttp.hdrs.METH_CONNECT_ALL
  aiohttp.hdrs.METH_CONNECT_ALL was removed in aiohttp 3.14.2 pypi.org
• Removed aiohttp.hdrs.METH_HEAD_ALL
  aiohttp.hdrs.METH_HEAD_ALL was removed in aiohttp 3.14.2 pypi.org
• Behavior changed
  The pure-Python parser now rejects a bare LF line ending in the request line, which it previously accepted. Clients that send bare LF line endings will now get errors. github.com
• Behavior changed
  Multipart body parts whose Content-Length header is not plain digits, such as +5, -1 or 1_0, are now rejected instead of accepted. Code that sends or parses such headers must send plain digits. github.com

3.14.1

6 breaking changes, first published June 7, 2026.

• Behavior changed aiohttp.CookieJar.load
  load() replaces existing cookies instead of merging onto them, and loaded cookies for IP-address hosts are dropped unless the jar is created with unsafe=True. github.com
• Behavior changed aiohttp.DigestAuthMiddleware
  Credentials are only used for the origin of the first request; a redirect to another origin is answered only if it falls within a protection space advertised through the domain directive. github.com
• Behavior changed aiohttp.StreamReader.read_nowait
  Data fed back into the buffer during the call is no longer joined into the result, so callers may receive smaller reads. github.com
• Behavior changed aiohttp.StreamReader.readany
  Data fed back into the buffer during the call is no longer joined into the result, so callers may receive smaller reads. github.com
• Behavior changed aiohttp.TCPConnector
  Hosts like 2130706433, 017700000001 or 127.1 now raise InvalidUrlClientError; use canonical dotted-quad IPv4 addresses instead. github.com
• Signature changed aiohttp.base_protocol.HttpParser.__init__
  Was def __init__(self, protocol: BaseProtocol | None = None, loop: asyncio.AbstractEventLoop | None = None, limit: int = 2 ** 16, max_line_size: int = 8190, max_headers: int = 128, max_field_size: int = 8190, timer: BaseTimerContext | None... pypi.org

3.14.0

354 breaking changes, first published June 1, 2026.

• Removed
  aiohttp no longer supports Python 3.9; upgrade Python before installing this release. github.com
• Removed aiohttp.compression_utils.DEFAULT_MAX_DECOMPRESS_SIZE
  aiohttp.compression_utils.DEFAULT_MAX_DECOMPRESS_SIZE was removed in aiohttp 3.14.0 pypi.org
• Behavior changed
  Digest authentication now uses the percent-encoded request-target as sent on the wire, which can change computed signatures. github.com
• Behavior changed
  Redirects with a consumed non-rewindable request body raise ClientPayloadError instead of sending an empty body. github.com
• Behavior changed
  Per-request cookies are no longer sent after a cross-origin redirect. github.com
• Behavior changed
  Outbound status lines, header names and values containing control characters 0x00-0x08, 0x0A-0x1F or 0x7F now raise ValueError instead of being sent. Remove bare control characters from headers. github.com
• Behavior changed aiohttp.CookieJar.save
  CookieJar.save writes JSON and load tries JSON first with a restricted pickle fallback. Previously saved cookie files may need regenerating. github.com
• Behavior changed aiohttp.FormData.add_field
  Names and filenames containing invalid bytes are now rejected, so such inputs must be cleaned up. github.com
• Behavior changed aiohttp.web.BaseRequest.host
  When no Host header is present, host now returns the local socket address or an empty string instead of the FQDN. Code relying on the FQDN must call socket.getfqdn itself, off the event loop. github.com
• Default changed zlib_executor_size
  Compressed payloads are now handled asynchronously by default, so code relying on the previous default behavior may see different timing. github.com

And 344 more in this version.

Check your code

These are the changes. To see which of them reach your code, scan a public repository, or have your coding agent call check_code with your manifest or lockfile over MCP. The API reads every change in every version, not only the newest. On Team and up, a fix pull request opens for the changes that reach a connected repository. Nothing merges or deploys.