From df8ad83efdd33408db2803cbd4a50be45422b74f Mon Sep 17 00:00:00 2001
From: Mingjie Zhao <48666391+ZhaoMJ@users.noreply.github.com>
Date: Thu, 9 Oct 2025 20:25:39 +0800
Subject: [PATCH 1/3] Fix zstd decompression for chunked zstd response (#11623)

---
 CHANGES/11623.bugfix          |  1 +
 CONTRIBUTORS.txt              |  1 +
 aiohttp/compression_utils.py  | 18 +++++++-----------
 aiohttp/http_parser.py        |  2 +-
 docs/client_quickstart.rst    |  2 +-
 requirements/base-ft.txt      |  2 +-
 requirements/base.txt         |  2 +-
 requirements/constraints.txt  |  2 +-
 requirements/dev.txt          |  2 +-
 requirements/lint.in          |  2 +-
 requirements/lint.txt         |  2 +-
 requirements/runtime-deps.in  |  2 +-
 requirements/runtime-deps.txt |  2 +-
 requirements/test-ft.txt      |  2 +-
 requirements/test.txt         |  2 +-
 setup.cfg                     |  2 +-
 tests/test_http_parser.py     | 14 +++++++-------
 17 files changed, 29 insertions(+), 31 deletions(-)
 create mode 100644 CHANGES/11623.bugfix

diff --git a/CHANGES/11623.bugfix b/CHANGES/11623.bugfix
new file mode 100644
index 00000000000..447dd56388c
--- /dev/null
+++ b/CHANGES/11623.bugfix
@@ -0,0 +1 @@
+Switched to `backports.zstd` for Python <3.14 and fixed zstd decompression for chunked zstd streams -- by :user:`ZhaoMJ`.
diff --git a/CONTRIBUTORS.txt b/CONTRIBUTORS.txt
index b64d99fb632..84692200b6e 100644
--- a/CONTRIBUTORS.txt
+++ b/CONTRIBUTORS.txt
@@ -270,6 +270,7 @@ Mikhail Burshteyn
 Mikhail Kashkin
 Mikhail Lukyanchenko
 Mikhail Nacharov
+Mingjie Zhao
 Misha Behersky
 Mitchell Ferree
 Morgan Delahaye-Prat
diff --git a/aiohttp/compression_utils.py b/aiohttp/compression_utils.py
index fcaee591fe5..c6c6f0d71fc 100644
--- a/aiohttp/compression_utils.py
+++ b/aiohttp/compression_utils.py
@@ -22,18 +22,14 @@
     HAS_BROTLI = False
 
 try:
-    from compression.zstd import (  # type: ignore[import-not-found]  # noqa: I900
-        ZstdDecompressor,
-    )
+    if sys.version_info >= (3, 14):
+        from compression.zstd import ZstdDecompressor  # noqa: I900
+    else:  # TODO(PY314): Remove mentions of backports.zstd across codebase
+        from backports.zstd import ZstdDecompressor
 
     HAS_ZSTD = True
 except ImportError:
-    try:
-        from zstandard import ZstdDecompressor
-
-        HAS_ZSTD = True
-    except ImportError:
-        HAS_ZSTD = False
+    HAS_ZSTD = False
 
 
 MAX_SYNC_CHUNK_SIZE = 1024
@@ -298,12 +294,12 @@ def __init__(self) -> None:
         if not HAS_ZSTD:
             raise RuntimeError(
                 "The zstd decompression is not available. "
-                "Please install `zstandard` module"
+                "Please install `backports.zstd` module"
             )
         self._obj = ZstdDecompressor()
 
     def decompress_sync(self, data: bytes) -> bytes:
-        return self._obj.decompress(data)  # type: ignore[no-any-return]
+        return self._obj.decompress(data)
 
     def flush(self) -> bytes:
         return b""
diff --git a/aiohttp/http_parser.py b/aiohttp/http_parser.py
index ce143819141..9e4d5a9ce0c 100644
--- a/aiohttp/http_parser.py
+++ b/aiohttp/http_parser.py
@@ -938,7 +938,7 @@ def __init__(self, out: StreamReader, encoding: str | None) -> None:
             if not HAS_ZSTD:
                 raise ContentEncodingError(
                     "Can not decode content-encoding: zstandard (zstd). "
-                    "Please install `zstandard`"
+                    "Please install `backports.zstd`"
                 )
             self.decompressor = ZSTDDecompressor()
         else:
diff --git a/docs/client_quickstart.rst b/docs/client_quickstart.rst
index 48f123b94bd..fc6d3875ea1 100644
--- a/docs/client_quickstart.rst
+++ b/docs/client_quickstart.rst
@@ -191,7 +191,7 @@ just install `Brotli <https://pypi.org/project/Brotli/>`_
 or `brotlicffi <https://pypi.org/project/brotlicffi/>`_.
 
 You can enable ``zstd`` transfer-encodings support,
-install `zstandard <https://pypi.org/project/zstandard/>`_.
+install `backports.zstd <https://pypi.org/project/backports.zstd/>`_.
 If you are using Python >= 3.14, no dependency should be required.
 
 JSON Request
diff --git a/requirements/base-ft.txt b/requirements/base-ft.txt
index 5615e306c84..ef2067ebf3e 100644
--- a/requirements/base-ft.txt
+++ b/requirements/base-ft.txt
@@ -44,5 +44,5 @@ typing-extensions==4.15.0
     #   multidict
 yarl==1.21.0
     # via -r requirements/runtime-deps.in
-zstandard==0.25.0 ; platform_python_implementation == "CPython" and python_version < "3.14"
+backports.zstd==0.5.0 ; platform_python_implementation == "CPython" and python_version < "3.14"
     # via -r requirements/runtime-deps.in
diff --git a/requirements/base.txt b/requirements/base.txt
index f3e3fe2649b..45e788dd884 100644
--- a/requirements/base.txt
+++ b/requirements/base.txt
@@ -46,5 +46,5 @@ uvloop==0.21.0 ; platform_system != "Windows" and implementation_name == "cpytho
     # via -r requirements/base.in
 yarl==1.21.0
     # via -r requirements/runtime-deps.in
-zstandard==0.25.0 ; platform_python_implementation == "CPython" and python_version < "3.14"
+backports.zstd==0.5.0 ; platform_python_implementation == "CPython" and python_version < "3.14"
     # via -r requirements/runtime-deps.in
diff --git a/requirements/constraints.txt b/requirements/constraints.txt
index fd73a37c401..1afb19583c4 100644
--- a/requirements/constraints.txt
+++ b/requirements/constraints.txt
@@ -299,7 +299,7 @@ zlib-ng==1.0.0
     # via
     #   -r requirements/lint.in
     #   -r requirements/test-common.in
-zstandard==0.25.0 ; implementation_name == "cpython"
+backports.zstd==0.5.0 ; implementation_name == "cpython"
     # via
     #   -r requirements/lint.in
     #   -r requirements/runtime-deps.in
diff --git a/requirements/dev.txt b/requirements/dev.txt
index f0ac2f57a03..481d99587b6 100644
--- a/requirements/dev.txt
+++ b/requirements/dev.txt
@@ -290,7 +290,7 @@ zlib-ng==1.0.0
     # via
     #   -r requirements/lint.in
     #   -r requirements/test-common.in
-zstandard==0.25.0 ; platform_python_implementation == "CPython" and python_version < "3.14"
+backports.zstd==0.5.0 ; platform_python_implementation == "CPython" and python_version < "3.14"
     # via
     #   -r requirements/lint.in
     #   -r requirements/runtime-deps.in
diff --git a/requirements/lint.in b/requirements/lint.in
index e36b5f28cd6..c83d1dcec88 100644
--- a/requirements/lint.in
+++ b/requirements/lint.in
@@ -1,4 +1,5 @@
 aiodns
+backports.zstd; implementation_name == "cpython"
 blockbuster
 freezegun
 isal
@@ -14,4 +15,3 @@ trustme
 uvloop; platform_system != "Windows"
 valkey
 zlib_ng
-zstandard; implementation_name == "cpython"
diff --git a/requirements/lint.txt b/requirements/lint.txt
index 087a2f63e90..dbe3dcf4013 100644
--- a/requirements/lint.txt
+++ b/requirements/lint.txt
@@ -123,5 +123,5 @@ virtualenv==20.34.0
     # via pre-commit
 zlib-ng==1.0.0
     # via -r requirements/lint.in
-zstandard==0.25.0 ; implementation_name == "cpython"
+backports.zstd==0.5.0 ; implementation_name == "cpython"
     # via -r requirements/lint.in
diff --git a/requirements/runtime-deps.in b/requirements/runtime-deps.in
index f849b448cf6..f6c6f2e8caa 100644
--- a/requirements/runtime-deps.in
+++ b/requirements/runtime-deps.in
@@ -4,10 +4,10 @@ aiodns >= 3.3.0
 aiohappyeyeballs >= 2.5.0
 aiosignal >= 1.4.0
 async-timeout >= 4.0, < 6.0 ; python_version < "3.11"
+backports.zstd; platform_python_implementation == 'CPython' and python_version < "3.14"
 Brotli; platform_python_implementation == 'CPython'
 brotlicffi; platform_python_implementation != 'CPython'
 frozenlist >= 1.1.1
 multidict >=4.5, < 7.0
 propcache >= 0.2.0
 yarl >= 1.17.0, < 2.0
-zstandard; platform_python_implementation == 'CPython' and python_version < "3.14"
diff --git a/requirements/runtime-deps.txt b/requirements/runtime-deps.txt
index 9af01567e76..3faef5825f1 100644
--- a/requirements/runtime-deps.txt
+++ b/requirements/runtime-deps.txt
@@ -40,5 +40,5 @@ typing-extensions==4.15.0
     #   multidict
 yarl==1.21.0
     # via -r requirements/runtime-deps.in
-zstandard==0.25.0 ; platform_python_implementation == "CPython" and python_version < "3.14"
+backports.zstd==0.5.0 ; platform_python_implementation == "CPython" and python_version < "3.14"
     # via -r requirements/runtime-deps.in
diff --git a/requirements/test-ft.txt b/requirements/test-ft.txt
index 83762508513..39eedad0242 100644
--- a/requirements/test-ft.txt
+++ b/requirements/test-ft.txt
@@ -146,5 +146,5 @@ yarl==1.21.0
     # via -r requirements/runtime-deps.in
 zlib-ng==1.0.0
     # via -r requirements/test-common.in
-zstandard==0.25.0 ; platform_python_implementation == "CPython" and python_version < "3.14"
+backports.zstd==0.5.0 ; platform_python_implementation == "CPython" and python_version < "3.14"
     # via -r requirements/runtime-deps.in
diff --git a/requirements/test.txt b/requirements/test.txt
index 101f2cb9018..a3c60c025fa 100644
--- a/requirements/test.txt
+++ b/requirements/test.txt
@@ -148,5 +148,5 @@ yarl==1.21.0
     # via -r requirements/runtime-deps.in
 zlib-ng==1.0.0
     # via -r requirements/test-common.in
-zstandard==0.25.0 ; platform_python_implementation == "CPython" and python_version < "3.14"
+backports.zstd==0.5.0 ; platform_python_implementation == "CPython" and python_version < "3.14"
     # via -r requirements/runtime-deps.in
diff --git a/setup.cfg b/setup.cfg
index 7fd0f0c59c6..cd12bc3013c 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -69,7 +69,7 @@ speedups =
   aiodns >= 3.3.0
   Brotli; platform_python_implementation == 'CPython'
   brotlicffi; platform_python_implementation != 'CPython'
-  zstandard; platform_python_implementation == 'CPython' and python_version < "3.14"
+  backports.zstd; platform_python_implementation == 'CPython' and python_version < "3.14"
 
 [options.packages.find]
 exclude =
diff --git a/tests/test_http_parser.py b/tests/test_http_parser.py
index 4aa965e0ae4..3daff5cd206 100644
--- a/tests/test_http_parser.py
+++ b/tests/test_http_parser.py
@@ -37,13 +37,13 @@
 except ImportError:
     brotli = None
 
-if sys.version_info >= (3, 14):
-    import compression.zstd as zstandard  # noqa: I900
-else:
-    try:
-        import zstandard
-    except ImportError:
-        zstandard = None  # type: ignore[assignment]
+try:
+    if sys.version_info >= (3, 14):
+        import compression.zstd as zstandard  # noqa: I900
+    else:
+        import backports.zstd as zstandard
+except ImportError:
+    zstandard = None  # type: ignore[assignment]
 
 REQUEST_PARSERS = [HttpRequestParserPy]
 RESPONSE_PARSERS = [HttpResponseParserPy]

From b8e65962eaa19dbca0928a75e224bad44d36ac7a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 9 Oct 2025 12:52:58 +0000
Subject: [PATCH 2/3] Bump yarl from 1.21.0 to 1.22.0 (#11594)

Bumps [yarl](https://github.com/aio-libs/yarl) from 1.21.0 to 1.22.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/aio-libs/yarl/releases">yarl's
releases</a>.</em></p>
<blockquote>
<h2>1.22.0</h2>
<h2>Features</h2>
<ul>
<li>
<p>Added arm64 Windows wheel builds
-- by :user:<code>finnagin</code>.</p>
<p><em>Related issues and pull requests on GitHub:</em>
<a
href="https://redirect.github.com/aio-libs/yarl/issues/1516">#1516</a>.</p>
</li>
</ul>
<hr />
<h2>1.20.1</h2>
<h2>Bug fixes</h2>
<ul>
<li>
<p>Started raising a :exc:<code>ValueError</code> exception raised for
corrupted
IPv6 URL values.</p>
<p>These fixes the issue where exception :exc:<code>IndexError</code>
was
leaking from the internal code because of not being handled and
transformed into a user-facing error. The problem was happening
under the following conditions: empty IPv6 URL, brackets in
reverse order.</p>
<p>-- by :user:<code>MaelPic</code>.</p>
<p><em>Related issues and pull requests on GitHub:</em>
<a
href="https://redirect.github.com/aio-libs/yarl/issues/1512">#1512</a>.</p>
</li>
</ul>
<h2>Packaging updates and notes for downstreams</h2>
<ul>
<li>
<p>Updated to use Cython 3.1 universally across the build path -- by
:user:<code>lysnikolaou</code>.</p>
<p><em>Related issues and pull requests on GitHub:</em>
<a
href="https://redirect.github.com/aio-libs/yarl/issues/1514">#1514</a>.</p>
</li>
<li>
<p>Made Cython line tracing opt-in via the
<code>with-cython-tracing</code> build config setting -- by
:user:<code>bdraco</code>.</p>
<p>Previously, line tracing was enabled by default in
:file:<code>pyproject.toml</code>, which caused build issues for some
users and made wheels nearly twice as slow.
Now line tracing is only enabled when explicitly requested via <code>pip
install . --config-setting=with-cython-tracing=true</code> or by setting
the <code>YARL_CYTHON_TRACING</code> environment variable.</p>
<p><em>Related issues and pull requests on GitHub:</em>
<a
href="https://redirect.github.com/aio-libs/yarl/issues/1521">#1521</a>.</p>
</li>
</ul>
<hr />
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/aio-libs/yarl/blob/master/CHANGES.rst">yarl's
changelog</a>.</em></p>
<blockquote>
<h1>1.22.0</h1>
<p><em>(2025-10-05)</em></p>
<h2>Features</h2>
<ul>
<li>
<p>Added arm64 Windows wheel builds
-- by :user:<code>finnagin</code>.</p>
<p><em>Related issues and pull requests on GitHub:</em>
:issue:<code>1516</code>.</p>
</li>
</ul>
<hr />
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aio-libs/yarl/commit/ed241dedafda3a75ce17002aac28aa93927cff24"><code>ed241de</code></a>
Release 1.22.0 (<a
href="https://redirect.github.com/aio-libs/yarl/issues/1569">#1569</a>)</li>
<li><a
href="https://github.com/aio-libs/yarl/commit/38588fbed0ecee9110419d9b7492455423c70adb"><code>38588fb</code></a>
Add windows arm64 wheel builds (<a
href="https://redirect.github.com/aio-libs/yarl/issues/1516">#1516</a>)</li>
<li>See full diff in <a
href="https://github.com/aio-libs/yarl/compare/v1.21.0...v1.22.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=yarl&package-manager=pip&previous-version=1.21.0&new-version=1.22.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 requirements/base-ft.txt      |  6 +++---
 requirements/base.txt         |  6 +++---
 requirements/constraints.txt  | 10 +++++-----
 requirements/dev.txt          | 10 +++++-----
 requirements/runtime-deps.txt |  6 +++---
 requirements/test-ft.txt      |  6 +++---
 requirements/test.txt         |  6 +++---
 7 files changed, 25 insertions(+), 25 deletions(-)

diff --git a/requirements/base-ft.txt b/requirements/base-ft.txt
index ef2067ebf3e..3f5f03ffc9e 100644
--- a/requirements/base-ft.txt
+++ b/requirements/base-ft.txt
@@ -12,6 +12,8 @@ aiosignal==1.4.0
     # via -r requirements/runtime-deps.in
 async-timeout==5.0.1 ; python_version < "3.11"
     # via -r requirements/runtime-deps.in
+backports-zstd==0.5.0 ; platform_python_implementation == "CPython" and python_version < "3.14"
+    # via -r requirements/runtime-deps.in
 brotli==1.1.0 ; platform_python_implementation == "CPython"
     # via -r requirements/runtime-deps.in
 cffi==2.0.0
@@ -42,7 +44,5 @@ typing-extensions==4.15.0
     # via
     #   aiosignal
     #   multidict
-yarl==1.21.0
-    # via -r requirements/runtime-deps.in
-backports.zstd==0.5.0 ; platform_python_implementation == "CPython" and python_version < "3.14"
+yarl==1.22.0
     # via -r requirements/runtime-deps.in
diff --git a/requirements/base.txt b/requirements/base.txt
index 45e788dd884..b1406ae50e0 100644
--- a/requirements/base.txt
+++ b/requirements/base.txt
@@ -12,6 +12,8 @@ aiosignal==1.4.0
     # via -r requirements/runtime-deps.in
 async-timeout==5.0.1 ; python_version < "3.11"
     # via -r requirements/runtime-deps.in
+backports-zstd==0.5.0 ; platform_python_implementation == "CPython" and python_version < "3.14"
+    # via -r requirements/runtime-deps.in
 brotli==1.1.0 ; platform_python_implementation == "CPython"
     # via -r requirements/runtime-deps.in
 cffi==2.0.0
@@ -44,7 +46,5 @@ typing-extensions==4.15.0
     #   multidict
 uvloop==0.21.0 ; platform_system != "Windows" and implementation_name == "cpython"
     # via -r requirements/base.in
-yarl==1.21.0
-    # via -r requirements/runtime-deps.in
-backports.zstd==0.5.0 ; platform_python_implementation == "CPython" and python_version < "3.14"
+yarl==1.22.0
     # via -r requirements/runtime-deps.in
diff --git a/requirements/constraints.txt b/requirements/constraints.txt
index 1afb19583c4..2981c9dc1bd 100644
--- a/requirements/constraints.txt
+++ b/requirements/constraints.txt
@@ -24,6 +24,10 @@ async-timeout==5.0.1 ; python_version < "3.11"
     #   valkey
 babel==2.17.0
     # via sphinx
+backports-zstd==0.5.0 ; implementation_name == "cpython"
+    # via
+    #   -r requirements/lint.in
+    #   -r requirements/runtime-deps.in
 blockbuster==1.5.25
     # via
     #   -r requirements/lint.in
@@ -293,16 +297,12 @@ wait-for-it==2.3.0
     # via -r requirements/test-common.in
 wheel==0.46.0
     # via pip-tools
-yarl==1.21.0
+yarl==1.22.0
     # via -r requirements/runtime-deps.in
 zlib-ng==1.0.0
     # via
     #   -r requirements/lint.in
     #   -r requirements/test-common.in
-backports.zstd==0.5.0 ; implementation_name == "cpython"
-    # via
-    #   -r requirements/lint.in
-    #   -r requirements/runtime-deps.in
 
 # The following packages are considered to be unsafe in a requirements file:
 pip==25.2
diff --git a/requirements/dev.txt b/requirements/dev.txt
index 481d99587b6..03d07083bee 100644
--- a/requirements/dev.txt
+++ b/requirements/dev.txt
@@ -24,6 +24,10 @@ async-timeout==5.0.1 ; python_version < "3.11"
     #   valkey
 babel==2.17.0
     # via sphinx
+backports-zstd==0.5.0 ; platform_python_implementation == "CPython" and python_version < "3.14"
+    # via
+    #   -r requirements/lint.in
+    #   -r requirements/runtime-deps.in
 blockbuster==1.5.25
     # via
     #   -r requirements/lint.in
@@ -284,16 +288,12 @@ wait-for-it==2.3.0
     # via -r requirements/test-common.in
 wheel==0.46.0
     # via pip-tools
-yarl==1.21.0
+yarl==1.22.0
     # via -r requirements/runtime-deps.in
 zlib-ng==1.0.0
     # via
     #   -r requirements/lint.in
     #   -r requirements/test-common.in
-backports.zstd==0.5.0 ; platform_python_implementation == "CPython" and python_version < "3.14"
-    # via
-    #   -r requirements/lint.in
-    #   -r requirements/runtime-deps.in
 
 # The following packages are considered to be unsafe in a requirements file:
 pip==25.2
diff --git a/requirements/runtime-deps.txt b/requirements/runtime-deps.txt
index 3faef5825f1..c86e083f2b8 100644
--- a/requirements/runtime-deps.txt
+++ b/requirements/runtime-deps.txt
@@ -12,6 +12,8 @@ aiosignal==1.4.0
     # via -r requirements/runtime-deps.in
 async-timeout==5.0.1 ; python_version < "3.11"
     # via -r requirements/runtime-deps.in
+backports-zstd==0.5.0 ; platform_python_implementation == "CPython" and python_version < "3.14"
+    # via -r requirements/runtime-deps.in
 brotli==1.1.0 ; platform_python_implementation == "CPython"
     # via -r requirements/runtime-deps.in
 cffi==2.0.0
@@ -38,7 +40,5 @@ typing-extensions==4.15.0
     # via
     #   aiosignal
     #   multidict
-yarl==1.21.0
-    # via -r requirements/runtime-deps.in
-backports.zstd==0.5.0 ; platform_python_implementation == "CPython" and python_version < "3.14"
+yarl==1.22.0
     # via -r requirements/runtime-deps.in
diff --git a/requirements/test-ft.txt b/requirements/test-ft.txt
index 39eedad0242..3589f15e9ff 100644
--- a/requirements/test-ft.txt
+++ b/requirements/test-ft.txt
@@ -14,6 +14,8 @@ annotated-types==0.7.0
     # via pydantic
 async-timeout==5.0.1 ; python_version < "3.11"
     # via -r requirements/runtime-deps.in
+backports-zstd==0.5.0 ; platform_python_implementation == "CPython" and python_version < "3.14"
+    # via -r requirements/runtime-deps.in
 blockbuster==1.5.25
     # via -r requirements/test-common.in
 brotli==1.1.0 ; platform_python_implementation == "CPython"
@@ -142,9 +144,7 @@ typing-inspection==0.4.2
     # via pydantic
 wait-for-it==2.3.0
     # via -r requirements/test-common.in
-yarl==1.21.0
+yarl==1.22.0
     # via -r requirements/runtime-deps.in
 zlib-ng==1.0.0
     # via -r requirements/test-common.in
-backports.zstd==0.5.0 ; platform_python_implementation == "CPython" and python_version < "3.14"
-    # via -r requirements/runtime-deps.in
diff --git a/requirements/test.txt b/requirements/test.txt
index a3c60c025fa..a0f64433ddd 100644
--- a/requirements/test.txt
+++ b/requirements/test.txt
@@ -14,6 +14,8 @@ annotated-types==0.7.0
     # via pydantic
 async-timeout==5.0.1 ; python_version < "3.11"
     # via -r requirements/runtime-deps.in
+backports-zstd==0.5.0 ; platform_python_implementation == "CPython" and python_version < "3.14"
+    # via -r requirements/runtime-deps.in
 blockbuster==1.5.25
     # via -r requirements/test-common.in
 brotli==1.1.0 ; platform_python_implementation == "CPython"
@@ -144,9 +146,7 @@ uvloop==0.21.0 ; platform_system != "Windows" and implementation_name == "cpytho
     # via -r requirements/base.in
 wait-for-it==2.3.0
     # via -r requirements/test-common.in
-yarl==1.21.0
+yarl==1.22.0
     # via -r requirements/runtime-deps.in
 zlib-ng==1.0.0
     # via -r requirements/test-common.in
-backports.zstd==0.5.0 ; platform_python_implementation == "CPython" and python_version < "3.14"
-    # via -r requirements/runtime-deps.in

From 62debeb8186d501393a4ae8eabcc24d9bbc1fdf3 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 9 Oct 2025 13:13:00 +0000
Subject: [PATCH 3/3] Bump propcache from 0.4.0 to 0.4.1 (#11618)

Bumps [propcache](https://github.com/aio-libs/propcache) from 0.4.0 to
0.4.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/aio-libs/propcache/releases">propcache's
releases</a>.</em></p>
<blockquote>
<h2>0.4.1</h2>
<h2>Bug fixes</h2>
<ul>
<li>
<p>Fixed reference leak caused by <code>Py_INCREF</code> because Cython
has its own reference counter systems -- by
:user:<code>Vizonex</code>.</p>
<p><em>Related issues and pull requests on GitHub:</em>
<a
href="https://redirect.github.com/aio-libs/propcache/issues/162">#162</a>.</p>
</li>
</ul>
<h2>Contributor-facing changes</h2>
<ul>
<li>
<p>Fixes the default value for the <code>os</code>
parameter in <code>reusable-build-wheel.yml</code>
to be <code>ubuntu-latest</code> instead of
<code>ubuntu</code>.</p>
<p><em>Related issues and pull requests on GitHub:</em>
<a
href="https://redirect.github.com/aio-libs/propcache/issues/155">#155</a>.</p>
</li>
</ul>
<hr />
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/aio-libs/propcache/blob/master/CHANGES.rst">propcache's
changelog</a>.</em></p>
<blockquote>
<h1>0.4.1</h1>
<p><em>(2025-10-08)</em></p>
<h2>Bug fixes</h2>
<ul>
<li>
<p>Fixed reference leak caused by <code>Py_INCREF</code> because Cython
has its own reference counter systems -- by
:user:<code>Vizonex</code>.</p>
<p><em>Related issues and pull requests on GitHub:</em>
:issue:<code>162</code>.</p>
</li>
</ul>
<h2>Contributor-facing changes</h2>
<ul>
<li>
<p>Fixes the default value for the <code>os</code>
parameter in <code>reusable-build-wheel.yml</code>
to be <code>ubuntu-latest</code> instead of
<code>ubuntu</code>.</p>
<p><em>Related issues and pull requests on GitHub:</em>
:issue:<code>155</code>.</p>
</li>
</ul>
<hr />
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aio-libs/propcache/commit/410fc9318e12b70c15e21c70ab75256d1c7b3f41"><code>410fc93</code></a>
Release 0.4.1 (<a
href="https://redirect.github.com/aio-libs/propcache/issues/163">#163</a>)</li>
<li><a
href="https://github.com/aio-libs/propcache/commit/fc73c8fce9b1c8797fa9d65ef877a9ac026aa506"><code>fc73c8f</code></a>
Fix Ref Leak (<a
href="https://redirect.github.com/aio-libs/propcache/issues/162">#162</a>)</li>
<li><a
href="https://github.com/aio-libs/propcache/commit/21ef3696b108653eb94a42e1a3875f60f9818b0d"><code>21ef369</code></a>
Bump github/codeql-action from 3 to 4 (<a
href="https://redirect.github.com/aio-libs/propcache/issues/160">#160</a>)</li>
<li><a
href="https://github.com/aio-libs/propcache/commit/beb42ef2d4dfd1f2c6f08eee482d6d966c95ce4e"><code>beb42ef</code></a>
Bump pytest-codspeed from 4.0.0 to 4.1.1 (<a
href="https://redirect.github.com/aio-libs/propcache/issues/161">#161</a>)</li>
<li><a
href="https://github.com/aio-libs/propcache/commit/48b7325733976a456d84ecc65c162529ff18ffe2"><code>48b7325</code></a>
Update default os parameter in reusable-build-wheel.yml to
'ubuntu-latest' (#...</li>
<li><a
href="https://github.com/aio-libs/propcache/commit/488c6477408b14f8a0bc49e93a9097d71a027d25"><code>488c647</code></a>
Bump version to 0.4.1.dev0 (<a
href="https://redirect.github.com/aio-libs/propcache/issues/151">#151</a>)</li>
<li>See full diff in <a
href="https://github.com/aio-libs/propcache/compare/v0.4.0...v0.4.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=propcache&package-manager=pip&previous-version=0.4.0&new-version=0.4.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 requirements/base-ft.txt      | 2 +-
 requirements/base.txt         | 2 +-
 requirements/constraints.txt  | 2 +-
 requirements/dev.txt          | 2 +-
 requirements/runtime-deps.txt | 2 +-
 requirements/test-ft.txt      | 2 +-
 requirements/test.txt         | 2 +-
 7 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/requirements/base-ft.txt b/requirements/base-ft.txt
index 3f5f03ffc9e..a851bf38281 100644
--- a/requirements/base-ft.txt
+++ b/requirements/base-ft.txt
@@ -32,7 +32,7 @@ multidict==6.7.0
     #   yarl
 packaging==25.0
     # via gunicorn
-propcache==0.4.0
+propcache==0.4.1
     # via
     #   -r requirements/runtime-deps.in
     #   yarl
diff --git a/requirements/base.txt b/requirements/base.txt
index b1406ae50e0..7e9da23c158 100644
--- a/requirements/base.txt
+++ b/requirements/base.txt
@@ -32,7 +32,7 @@ multidict==6.7.0
     #   yarl
 packaging==25.0
     # via gunicorn
-propcache==0.4.0
+propcache==0.4.1
     # via
     #   -r requirements/runtime-deps.in
     #   yarl
diff --git a/requirements/constraints.txt b/requirements/constraints.txt
index 2981c9dc1bd..50e5906ad55 100644
--- a/requirements/constraints.txt
+++ b/requirements/constraints.txt
@@ -149,7 +149,7 @@ pluggy==1.6.0
     #   pytest-cov
 pre-commit==4.3.0
     # via -r requirements/lint.in
-propcache==0.4.0
+propcache==0.4.1
     # via
     #   -r requirements/runtime-deps.in
     #   yarl
diff --git a/requirements/dev.txt b/requirements/dev.txt
index 03d07083bee..73a8fb911d2 100644
--- a/requirements/dev.txt
+++ b/requirements/dev.txt
@@ -146,7 +146,7 @@ pluggy==1.6.0
     #   pytest-cov
 pre-commit==4.3.0
     # via -r requirements/lint.in
-propcache==0.4.0
+propcache==0.4.1
     # via
     #   -r requirements/runtime-deps.in
     #   yarl
diff --git a/requirements/runtime-deps.txt b/requirements/runtime-deps.txt
index c86e083f2b8..c97bd0cd4bb 100644
--- a/requirements/runtime-deps.txt
+++ b/requirements/runtime-deps.txt
@@ -28,7 +28,7 @@ multidict==6.7.0
     # via
     #   -r requirements/runtime-deps.in
     #   yarl
-propcache==0.4.0
+propcache==0.4.1
     # via
     #   -r requirements/runtime-deps.in
     #   yarl
diff --git a/requirements/test-ft.txt b/requirements/test-ft.txt
index 3589f15e9ff..f1491d4ed03 100644
--- a/requirements/test-ft.txt
+++ b/requirements/test-ft.txt
@@ -79,7 +79,7 @@ pluggy==1.6.0
     # via
     #   pytest
     #   pytest-cov
-propcache==0.4.0
+propcache==0.4.1
     # via
     #   -r requirements/runtime-deps.in
     #   yarl
diff --git a/requirements/test.txt b/requirements/test.txt
index a0f64433ddd..7a149924182 100644
--- a/requirements/test.txt
+++ b/requirements/test.txt
@@ -79,7 +79,7 @@ pluggy==1.6.0
     # via
     #   pytest
     #   pytest-cov
-propcache==0.4.0
+propcache==0.4.1
     # via
     #   -r requirements/runtime-deps.in
     #   yarl