chore(pip): update deps

[avivkeller]

Resolves the following code scanning alerts via pip-compile requirements.in:

┌──────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library  │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├──────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ aiohttp  │ CVE-2024-52304 │ MEDIUM   │ fixed  │ 3.10.5            │ 3.10.11       │ aiohttp: aiohttp vulnerable to request smuggling due to      │
│          │                │          │        │                   │               │ incorrect parsing of chunk...                                │
│          │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-52304                   │
│          ├────────────────┼──────────┤        │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│          │ CVE-2025-53643 │ LOW      │        │                   │ 3.12.14       │ aiohttp: AIOHTTP HTTP Request/Response Smuggling             │
│          │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-53643                   │
├──────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ black    │ CVE-2024-21503 │ MEDIUM   │        │ 23.3.0            │ 24.3.0        │ psf/black: ReDoS via the lines_with_leading_tabs_expanded()  │
│          │                │          │        │                   │               │ function in strings.py file                                  │
│          │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-21503                   │
├──────────┼────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ requests │ CVE-2024-35195 │          │        │ 2.31.0            │ 2.32.0        │ requests: subsequent requests to the same host ignore cert   │
│          │                │          │        │                   │               │ verification                                                 │
│          │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-35195                   │
│          ├────────────────┤          │        │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│          │ CVE-2024-47081 │          │        │                   │ 2.32.4        │ requests: Requests vulnerable to .netrc credentials leak via │
│          │                │          │        │                   │               │ malicious URLs                                               │
│          │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-47081                   │
├──────────┼────────────────┤          │        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ urllib3  │ CVE-2025-50181 │          │        │ 2.2.3             │ 2.5.0         │ urllib3: urllib3 redirects are not disabled when retries are │
│          │                │          │        │                   │               │ disabled on PoolManager...                                   │
│          │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-50181                   │
│          ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│          │ CVE-2025-50182 │          │        │                   │               │ urllib3: urllib3 does not control redirects in browsers and  │
│          │                │          │        │                   │               │ Node.js                                                      │
│          │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-50182                   │
└──────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	mypy@​1.4.1 ⏵ 1.17.1	+1
	dill@​0.3.8 ⏵ 0.4.0	-7
	black@​23.3.0 ⏵ 25.1.0	-2
	ckzg@​2.0.1 ⏵ 2.1.1
	bitarray@​2.9.2 ⏵ 3.6.1	+1
	click@​8.1.7 ⏵ 8.2.1	+2
	aiohttp@​3.10.5 ⏵ 3.12.15
	isort@​5.13.2 ⏵ 6.0.1	+1
	astroid@​3.2.4 ⏵ 3.3.11
	greenlet@​3.1.1 ⏵ 3.2.4	+1
	charset-normalizer@​3.3.2 ⏵ 3.4.3
	certifi@​2024.8.30 ⏵ 2025.8.3	+1
	dune-client@​1.7.5 ⏵ 1.7.10	+5				+1
	packaging@​24.1 ⏵ 25.0
	cytoolz@​0.12.3 ⏵ 1.0.1	+1
	aiosignal@​1.3.1 ⏵ 1.4.0			+2
	aiohappyeyeballs@​2.4.0 ⏵ 2.6.1	+1
	eth-utils@​5.0.0 ⏵ 5.3.0	+1
	attrs@​24.2.0 ⏵ 25.3.0	+1
	platformdirs@​4.3.6 ⏵ 4.3.8	+1
	eth-account@​0.13.3 ⏵ 0.13.7	+1
	deprecated@​1.2.14 ⏵ 1.2.18	+1
	colorama@​0.4.6
	frozenlist@​1.4.1 ⏵ 1.7.0
	multidict@​6.1.0 ⏵ 6.6.4	+1
	iniconfig@​2.0.0 ⏵ 2.1.0	+1
	eth-keys@​0.5.1 ⏵ 0.7.0
	pluggy@​1.5.0 ⏵ 1.6.0
	eth-typing@​5.0.0 ⏵ 5.2.1	+1
	eth-abi@​5.1.0 ⏵ 5.2.0
	marshmallow@​3.22.0 ⏵ 3.26.1	+1
	propcache@​0.3.2
See 4 more rows in the dashboard

View full report

[avivkeller]

https://github.com/cowprotocol/token-imbalances/actions/runs/16908881890/job/47905077936?pr=93#step:11:1524 (is it related?)