[cdnninja]

aiohttp>=3.8.1 still allows releases with published security advisories. 3.14.4 is the oldest release with none listed on PyPI, and it matches what Home Assistant already ships (3.14.5).

Claude-Session: https://claude.ai/code/session_01CxGYP1MF5XktdJeS1hyNaf

Description

Type of change

• Bug fix (fix:)
• New feature or device support (feat:)
• Documentation (docs:)
• Refactor / test / chore (no functional change)

Checklist

• This PR is a single feature, fix, or edit (not a bundle of unrelated changes).
• The change follows the intended architecture (base class → device + API mixin → device map; state in DeviceState; models in models/; constants in pyvesync.const).
• No API request/response fields were invented — all come from a real packet capture.
• ruff check, pylint, mypy, and pytest pass locally.
• Tests added/updated and API fixtures written (pytest --write_api) where relevant.
• Documentation updated if behavior or public API changed.

Real-hardware verification

• Tested on the physical device.
  • Model: ____
  • Firmware version: ____
• Not applicable (explain why): ____
• I do not own the device; a packet capture is provided / the device has been shared with a maintainer for verification.