Pip install - aiohttp CVE update (v3.7.4) is incompatible with botbuilder 4.13.0

[cas--]

Version

4.13.0

Describe the bug

This was supposed to be fixed in #1621 but since botbuilder-integration-aiohttp lists the dependency as "aiohttp~=3.6.2" instead of "aiohttp>=3.6.2,<3.8.0" it still remains an issue.

Error log:

There are incompatible versions in the resolved dependencies:
  aiohttp>=3.7.4 (from -r requirements.in (line 1))
  aiohttp~=3.6.2 (from botbuilder-integration-aiohttp==4.13.0->-r requirements.in (line 2))

To save time I have copied the steps from the original issue:

To Reproduce

Steps to reproduce the behavior:

1. Update aiohttp to 3.7.4 on any Python botbuilder project requirements.txt file (see https://github.com/james-flynn-ie/covid-bot/blob/main/requirements.txt for example)
2. Run pip install -r requirements.txt
3. Observe errors in console output.

Expected behavior

Errors are not displayed that aiohttp==3.6.2 is a requirement.
Pip install successfully installs all dependencies and Bot Framework Python SDK apps run as expected.

[axelsrz]

Hello @cas-- , thanks for reporting this issue, we will schedule a fix for our next release in order to support the security fix on aiohttp.